# Fork Incident

Copy an incident along with its history (incident states).

Endpoint: POST /api/v1/user/incidents/{incidentId}/fork
Version: 1.0.0
Security: apikeyAuth

## Path parameters:

  - `incidentId` (string, required)
    ID of incident

## Response 200 fields (application/json):

  - `incident` (object)
    Example: {"_id":"{{incidentId}}","scanInterval":3600,"watchedAttributes":["detections","tls"],"userAgents":["Chrome on Linux","Chrome on macOS"],"userAgentsPerInterval":1,"countries":["de","us"],"countriesPerInterval":2,"stopDelaySuspended":3600,"stopDelayInactive":86400,"stopDelayMalicious":90000,"scanIntervalAfterSuspended":86400,"scanIntervalAfterMalicious":86400,"owner":"own","type":"hostname","observable":"foobar.com","state":"active","visibility":"private","channels":["{{channelId}}"],"sourceType":"manual","sourceId":"{{sourceId}}","stateSize":3717,"stateCount":3,"scanIntervalMode":"automatic","labels":["hasHTTP","hasIP","hasMX","hasNS"],"expireAt":"2025-01-24T11:44:52.563Z","createdAt":"2025-01-21T11:44:52.566Z","scannedAt":"2025-01-21T12:44:52.566Z"}

  - `incident._id` (string)
    Incident ID
    Example: "{{incidentId}}"

  - `incident.createdAt` (string)
    Time when the incident was created.
    Example: "2025-01-21T11:44:52.566Z"

  - `incident.scannedAt` (string)
    Time when the incident was last scanned.
    Example: "2025-01-21T12:44:52.566Z"

  - `incident.expireAt` (string)
    Time when the incident will be automatically closed.
    Example: "2025-01-24T11:44:52.563Z"

  - `incident.sourceType` (string)
    How this incident was created.
    Enum: "manual", "api", "subscription", "fork", "copy"

  - `incident.sourceId` (string)
    ID of the original item that created this incident.
    Example: "{{sourceId}}"

  - `incident.incidentProfile` (string)
    ID of the incident profile to use when creating this incident.

  - `incident.state` (string)
    Whether the incident is active or closed
    Enum: "active", "closed"

  - `incident.stateSize` (integer)
    Size in bytes of incident states in database.
    Example: 3717

  - `incident.stateCount` (integer)
    Number of stored incident states in database.
    Example: 3

  - `incident.owner` (string)
    Incident owner.
    Example: "own"

  - `incident.type` (string)
    Enum: "url", "ip", "hostname"

  - `incident.channels` (array)
    Channels subscribed to this incident.
    Example: ["{{channelId}}"]

  - `incident.observable` (string)
    Hostname, domain, IP, or URL to observe
    Example: "foobar.com"

  - `incident.visibility` (string)
    Scan visibility
    Enum: "unlisted", "private"

  - `incident.scanInterval` (integer)
    Interval (seconds) between triggering full website scans.
    Example: 3600

  - `incident.scanIntervalMode` (string)
    If this is set to manual then scanIntervalAfterSuspended and scanIntervalAfterMalicious will not have an effect.
    Enum: "manual", "automatic"

  - `incident.watchedAttributes` (array)
    Determine which items will be monitored for.
    Enum: "detections", "tls", "dns", "labels", "page", "meta", "ip"

  - `incident.userAgents` (array)
    Browser User-Agents to use during scanning
    Example: ["Chrome on Linux","Chrome on macOS"]

  - `incident.userAgentsPerInterval` (integer)
    How many userAgents to use per scanInterval
    Example: 1

  - `incident.countries` (array)
    List of countries to scan from as ISO-3166-1 country codes.
    Example: ["de","us"]

  - `incident.countriesPerInterval` (integer)
    How many countries to use per scan interval.
    Example: 2

  - `incident.stopDelaySuspended` (integer)
    When to automatically close the incident after the observable was suspended.
    Example: 3600

  - `incident.stopDelayInactive` (integer)
    When to automatically close the incident after the observable became inactive.
    Example: 86400

  - `incident.stopDelayMalicious` (integer)
    When to automatically close the incident after the observable became malicious.
    Example: 90000

  - `incident.scanIntervalAfterSuspended` (integer)
    How to change the scan interval after the observable was suspended.
    Example: 86400

  - `incident.scanIntervalAfterMalicious` (integer)
    How to change the scan interval after the observable became malicious.
    Example: 86400