[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[[["\u003cp\u003eThis page covers the Advanced API Security Incidents API, a feature that allows users to view statistics for security incidents related to abuse detection in both Apigee and Apigee hybrid.\u003c/p\u003e\n"],["\u003cp\u003eThe Incidents API provides functionalities to list all incidents within an environment and retrieve detailed information for a specific incident using its UUID.\u003c/p\u003e\n"],["\u003cp\u003eIncidents can be archived to distinguish between reviewed and unreviewed items, impacting their visibility in the Apigee UI and API responses through an \u003ccode\u003eobservability\u003c/code\u003e field that can be \u003ccode\u003eACTIVE\u003c/code\u003e or \u003ccode\u003eARCHIVED\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eThe API supports filtering incidents by their archive status (active or archived), and it also allows the batch archiving or unarchiving of multiple security incidents.\u003c/p\u003e\n"],["\u003cp\u003eThe Security Incidents API has limitations, such as storing incidents for a maximum of 14 months and only supporting filters for \u003ccode\u003efirst_detected_time\u003c/code\u003e, \u003ccode\u003elast_detected_time\u003c/code\u003e, and \u003ccode\u003eapiproxy\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Incidents API\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n| **Preview --- Advanced API Security Incidents API**\n|\n| This feature is covered by the [Pre-GA Offerings Terms](https://cloud.google.com/terms/service-terms#1)\n| of the Google Cloud Terms of Service. Pre-GA features may have limited support, and changes to pre-GA features\n| may not be compatible with other pre-GA versions. For more information, see the [launch stage descriptions](https://cloud.google.com/products#product-launch-stages).\n|\n| Support for the Preview launch of Advanced API Security Incidents API is available through\n| the [Apigee - Google Cloud Community](https://www.googlecloudcommunity.com/gc/Apigee/bd-p/cloud-apigee) forum.\n\nThe Incidents API lets you view statistics for security incidents related to\n[abuse\ndetection](https://cloud.google.com/apigee/docs/api-security/abuse-detection).\n\nParameters in example API calls\n-------------------------------\n\nThe following sections give examples of API calls that\nuse the Incidents API. The API calls contain the following variable parameters:\n\n- \u003cvar translate=\"no\"\u003eORG\u003c/var\u003e is your organization.\n- \u003cvar translate=\"no\"\u003eENV\u003c/var\u003e is the environment in which you want scores to be calculated.\n- \u003cvar translate=\"no\"\u003eINCIDENT_UUID\u003c/var\u003e is the UUID for the incident.\n- `$TOKEN` is the environment variable for an [OAuth access token](/apigee/docs/api-platform/get-started/api-get-started#oauth20).\n\nList incidents and get their details\n------------------------------------\n\nThe following examples show how to list incidents and get their details.\n\n### Example: List all incidents for an environment\n\nTo list all incidents for an environment, send the following request: \n\n```\ncurl \"https://apigee.googleapis.com/v1/organizations/ORG/environments/ENV/securityIncidents\" \\\n -H 'Content-type: application/json' \\\n -H \"Authorization: Bearer $TOKEN\"\n```\n\nSee the\n[`SecurityIncident`](https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments.securityIncidents#SecurityIncident) reference page for descriptions of the\nrequest and response.\n\n### Example: Get details for a specific incident\n\nTo get the details for a specific incident, send a request like the following: \n\n```\ncurl \"https://apigee.googleapis.com/v1/organizations/ORG/environments/ENV/securityIncidents/INCIDENT_UUID\" \\\n -H 'Content-type: application/json' \\\n -H \"Authorization: Bearer $TOKEN\"\n```\n\nwhere \u003cvar translate=\"no\"\u003eINCIDENT_UUID\u003c/var\u003e is the UUID for the incident, which is returned in the `name`\nfield by the call shown in [Example: List\nall incidents for an environment](#example:-list-all-incidents-for-an-environment).\n\nSee the\n[`SecurityIncident`](https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments.securityIncidents#SecurityIncident) reference page for descriptions of the request and response.\n\nArchiving incidents\n-------------------\n\nTo help you distinguish between the incidents you have already investigated from those that\nyou haven't, you can archive the incidents that no longer require you attention.\nArchiving incidents has the following effects:\n\n- In the Apigee UI, archived incidents are not displayed in the [**Environment details \\\u003e Incidents**](/apigee/docs/api-security/abuse-detection#environment-details) list (provided that **Include archived incidents** is not selected).\n- In the API, when you make a call to [list all incidents](#example:-list-all-incidents-for-an-environment), archived incidents have the following line: \n\n ```\n \"observability\": \"ARCHIVED\"\n ```\n\n You can use the `\"observability\"` field to to filter out archived\n incidents from a list of incidents.\n\n The possible values for `\"observability\"` are:\n - `ACTIVE`\n - `ARCHIVED`\n\nArchived incidents are not deleted: you can always unarchive them, which changes the\nincident's `\"observability\"` to `ACTIVE`.\n\nThe following examples show how to archive and unarchive incidents.\n\n### Archive an incident\n\nTo archive an incident, send a request like the following: \n\n```\ncurl \"https://apigee.googleapis.com/v1/organizations/ORG/environments/ENV/securityIncidents/INCIDENT_UUID?updateMask=observability\" \\\n -X POST \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"name\": \"organizations/ORG/environments/ENV/securityIncidents/INCIDENT_UUID\",\n \"observability\": \"ARCHIVED\"}' \\\n -X PATCH\n```\n\nThis returns a response like the following: \n\n```\n{\n \"name\": \"INCIDENT_UUID\",\n \"displayName\": \"Multi type attack from US\",\n \"firstDetectedTime\": \"2023-04-04T17:00:00Z\",\n \"lastDetectedTime\": \"2023-09-12T03:10:00Z\",\n \"detectionTypes\": [\n \"Advanced Anomaly Detection\",\n \"OAuth Abuser\"\n ],\n \"trafficCount\": \"4052130\",\n \"containsMlAbuses\": false,\n \"riskLevel\": \"MODERATE\",\n \"observability\": \"ARCHIVED\"\n}\n```\n\nThe last line, `\"observability\": \"ARCHIVED\"`, shows that the incident has been\narchived.\n\n### Unarchive an incident\n\nTo unarchive an incident, use the same call as in the previous section, but use the line \n\n```\n\"observability\": \"ACTIVE\"\n```\n\n### Filter incidents by archive status\n\nThe next example filters the results of a call to list incidents so that only active\nincidents are returned. \n\n```\ncurl \"https://apigee.googleapis.com/v1/organizations/ORG/environments/ENV/securityIncidents?filter=observability=\\\"ACTIVE\\\"\" \\\n -X POST \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type: application/json\"\n```\n\nThis returns a result like the following. \n\n```\n{\n \"securityIncidents\": [\n {\n \"name\": \"1850fbb9-53a9-44e7-8893-f0b0c987d55e\",\n \"displayName\": \"Multi type attack from US\",\n \"firstDetectedTime\": \"2023-04-04T17:00:00Z\",\n \"lastDetectedTime\": \"2023-09-12T03:10:00Z\",\n \"detectionTypes\": [\n \"Advanced Anomaly Detection\",\n \"OAuth Abuser\"\n ],\n \"trafficCount\": \"4052130\",\n \"containsMlAbuses\": false,\n \"riskLevel\": \"MODERATE\",\n \"observability\": \"ACTIVE\"\n }\n ],\n \"nextPageToken\": \"ClAKAjUwEj1saXN0U2VjdXJpdHlJbmNpZGVudC9hcGlzZWN1cml0eS1tbHRlc3QtYXV0b3B1c2gvZGVmYXVsdC1wcm9kGgsI_KW1qQYQ6fqSDg\"\n}\n```\n\n### Archive or unarchive multiple security incidents\n\nTo archive or unarchive more than one security incident, enter a command like the following: \n\n```\ncurl \"https://apigee.googleapis.com/v1/organizations/ORG/environments/ENV/securityIncidents:batchUpdate\" \\\n -X POST \\\n -d '{\"requests\": \n [{\"security_incident\": {\"name\": \"organizations/apisecurity-mltest-autopush/environments/default-prod/securityIncidents/INCIDENT_UUID1\", \"observability\": \"ARCHIVE\"}, \"update_mask\": \"observability\"}, \n {\"security_incident\": {\"name\": \"organizations/apisecurity-mltest-autopush/environments/default-prod/securityIncidents/INCIDENT_UUID2\", \"observability\": \"ARCHIVE\"}, \"update_mask\": \"observability\"}]}'\n```\n\nLimitations on the Security Incidents API\n-----------------------------------------\n\nThe Security Incidents API has the following limitations:\n\n- Incidents are stored for a maximum of 14 months.\n- `ListIncidents` supports filters only for the following:\n - `first_detected_time`\n - `last_detected_time`\n - `apiproxy`\n- When you first [enable\n Advanced API for an organization](/apigee/docs/api-security/enable-security#enable-advanced-api-security), or later re-enable it, there will be a delay while events are clustered into incidents. After that, incidents are recalculated periodically."]]
