REST API call to get incident IDs for data-in-use or data-in-motion for the specified filters

Use this REST API call to get list of incident IDs generated for data-in-use or data-in-motion according to the specified parameters.

https://<epo_server_name:port>/rest/dlp/incidents/list/useOrMotion

Where, epo_server_name:port is the server IP address and port number.

Parameter name	Description	Required	Values
Authorization	User credentials for ePO - On-prem.	Required
firstId	first incident Id — incident IDs starting from the specified incident ID are returned.	Optional	String
first Timestamp	first Timestamp — incident ids that are generated from the specified timestamp (UTCTime) are returned.	Optional	String (Epoch time)
label	Incident IDs with specified label are returned.	Optional	String
status	Incident IDs with specified status are returned.	Optional	String
customAttributes	Incident IDs with specified values for the specified custom attributes are returned.	Optional	String

Sample GET request URL

https://172.27.108.53:8443/rest/dlp/incidents/list/useOrMotion

{

"firstId":"52",

"status":"2",

"label":"urgent",

"firstTimestamp":"1645539330"

"customAttributes": {"incident":"iv1", "ca1":"CV1"}

}

Sample cURL command

curl -k -v -X GET 'https://172.27.108.53:8443/rest/dlp/incidents/list/useOrMotion' -u '<user>:<password>'

--data-raw '{

"firstId":"52",

"status":"2",

"label":"urgent",

"firstTimestamp":"1645539330"}'

"customAttributes": {"incident":"iv1","ca1":"CV1"} }'

Returns the severity options set for the required incident type.

Parameter name	Description	Data type
Incident Id list	List of Incident IDs generated for data-in-use or motion is displayed. Also, shows the reason for failure, if there is a failure.	List of string

{
   "firstId":"52",
   "status":"2",
   "label":"urgent",
   "firstTimestamp":"1645539330"
   "customAttributes": {"incident":"iv1", "ca1":"CV1"}
}

[
    "52",
    "53",
    "63"
]

List of HTTP status codes returned for the query.

Code	Description
200 OK	Successfully received list of incident IDs satisfying conditions in request.
400 Bad Request	Returns a bad request if: Empty or non-numeric value is passed for firstId. Empty or non-numeric value is passed for firstTimestamp. Empty, invalid, or non-numeric status is passed. Empty value is passed for label. Invalid custom attribute name is passed.
404 Not Found	Incorrect ePO - On-prem URL.
500 Internal Server Error	An error on the server side that failed the request. See the ePO - On-prem `orion.log` file for more details about the error.