Skip to content
/Incidents

Create Incident

Request

Create an incident with specific options

Security
apikeyAuth(Required scopes: readwrite)
Bodyapplication/json
incidentobject(incident)required
Example:
{
  "scanInterval": 3600,
  "watchedAttributes": [
    "detections",
    "tls"
  ],
  "userAgents": [
    "Chrome on Linux",
    "Chrome on macOS"
  ],
  "userAgentsPerInterval": 1,
  "countries": [
    "de",
    "us"
  ],
  "countriesPerInterval": 2,
  "stopDelaySuspended": 3600,
  "stopDelayInactive": 86400,
  "stopDelayMalicious": 90000,
  "scanIntervalAfterSuspended": 86400,
  "scanIntervalAfterMalicious": 86400,
  "observable": "foobar.com",
  "visibility": "private",
  "channels": [
    "{{channelId}}"
  ],
  "scanIntervalMode": "automatic",
  "expireAfter": 86400
}
POST
/api/v1/user/incidents
curl -i -X POST \
  https://urlscan.io/api/v1/user/incidents \
  -H 'Content-Type: application/json' \
  -H 'api-key: YOUR_API_KEY_HERE' \
  -d '{
    "incident": {
      "scanInterval": 3600,
      "watchedAttributes": [
        "detections",
        "tls"
      ],
      "userAgents": [
        "Chrome on Linux",
        "Chrome on macOS"
      ],
      "userAgentsPerInterval": 1,
      "countries": [
        "de",
        "us"
      ],
      "countriesPerInterval": 2,
      "stopDelaySuspended": 3600,
      "stopDelayInactive": 86400,
      "stopDelayMalicious": 90000,
      "scanIntervalAfterSuspended": 86400,
      "scanIntervalAfterMalicious": 86400,
      "observable": "foobar.com",
      "visibility": "private",
      "channels": [
        "{{channelId}}"
      ],
      "scanIntervalMode": "automatic",
      "expireAfter": 86400
    }
  }'

Responses

Incident body

Bodyapplication/json
incidentobject(incident)
Example:
{
  "_id": "{{incidentId}}",
  "scanInterval": 3600,
  "watchedAttributes": [
    "detections",
    "tls"
  ],
  "userAgents": [
    "Chrome on Linux",
    "Chrome on macOS"
  ],
  "userAgentsPerInterval": 1,
  "countries": [
    "de",
    "us"
  ],
  "countriesPerInterval": 2,
  "stopDelaySuspended": 3600,
  "stopDelayInactive": 86400,
  "stopDelayMalicious": 90000,
  "scanIntervalAfterSuspended": 86400,
  "scanIntervalAfterMalicious": 86400,
  "owner": "own",
  "type": "hostname",
  "observable": "foobar.com",
  "state": "active",
  "visibility": "private",
  "channels": [
    "{{channelId}}"
  ],
  "sourceType": "manual",
  "sourceId": "{{sourceId}}",
  "stateSize": 3717,
  "stateCount": 3,
  "scanIntervalMode": "automatic",
  "labels": [
    "hasHTTP",
    "hasIP",
    "hasMX",
    "hasNS"
  ],
  "expireAt": "2025-01-24T11:44:52.563Z",
  "createdAt": "2025-01-21T11:44:52.566Z",
  "scannedAt": "2025-01-21T12:44:52.566Z"
}
Response
{
  "incident": {
    "_id": "{{incidentId}}",
    "scanInterval": 3600,
    "watchedAttributes": [ … ],
    "userAgents": [ … ],
    "userAgentsPerInterval": 1,
    "countries": [ … ],
    "countriesPerInterval": 2,
    "stopDelaySuspended": 3600,
    "stopDelayInactive": 86400,
    "stopDelayMalicious": 90000,
    "scanIntervalAfterSuspended": 86400,
    "scanIntervalAfterMalicious": 86400,
    "owner": "own",
    "type": "hostname",
    "observable": "foobar.com",
    "state": "active",
    "visibility": "private",
    "channels": [ … ],
    "sourceType": "manual",
    "sourceId": "{{sourceId}}",
    "stateSize": 3717,
    "stateCount": 3,
    "scanIntervalMode": "automatic",
    "labels": [ … ],
    "expireAt": "2025-01-24T11:44:52.563Z",
    "createdAt": "2025-01-21T11:44:52.566Z",
    "scannedAt": "2025-01-21T12:44:52.566Z"
  }
}