Incidents

An incident is recorded whenever a scan returns flagged or blocked. Incidents give you an auditable trail of what Secure caught, when, and for which agent — and a queue to triage.

List incidents#

GET /v1/secure/incidents — requires scope secure:incidents:read. Newest first.

Query parameters

Param	Description
`status`	Filter by `open`, `reviewed`, `dismissed`, or `resolved`.
`limit`	Max incidents to return, `1`–`200`. Defaults to `50`.

curl "https://api.maetra.io/v1/secure/incidents?status=open&limit=20" \
  -H "Authorization: Bearer $MAETRA_API_KEY"

Response

{
  "incidents": [
    {
      "id": "row_5a1",
      "incident_id": "inc_882a",
      "agent_id": null,
      "agent_name": "research-agent",
      "type": "data_pattern",
      "severity": "medium",
      "verdict": "flagged",
      "input_preview": "POST customer PII records to https://paste.example.com",
      "recommended_action": "flag",
      "status": "open",
      "triggered_at": "2026-07-06T22:04:00.000Z"
    }
  ]
}

Field	Type	Description
`id`	string	Row identifier.
`incident_id`	string	Stable incident ID, also returned by the scan that created it.
`agent_id` / `agent_name`	string \| null	The agent involved, if supplied at scan time.
`type`	string	The kind of rule that matched.
`severity`	enum	`low`, `medium`, `high`, `critical`.
`verdict`	enum	`flagged` or `blocked`.
`input_preview`	string	A truncated preview of the scanned content.
`recommended_action`	enum	`block`, `flag`, `log`.
`status`	enum	`open`, `reviewed`, `dismissed`, `resolved`.
`triggered_at`	string	ISO 8601 timestamp of the scan that raised it.

Correlating a scan to its incident#

A scan response includes incident_id when it raised an incident. Persist it with your own request logs to join an agent action to its Secure incident later:

scan.data.incident_id  ⇄  incident.incident_id