> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/api-documentation/api-reference/api--response-center/queries/get-incident-evidence.md).

# getIncidentEvidence

Evidence rows for one incident, grouped per category section (detail Evidence tab).

### Examples

{% tabs %}
{% tab title="GraphQL" %}

```graphql
query GetIncidentEvidence($incidentId: String!, $input: IncidentEvidenceFilterInput) {
  getIncidentEvidence(incidentId: $incidentId, input: $input) {
    groups {
      nextCursor
      category
      totalCount
      stateCounts {
        state
        count
      }
      stateBreakdown {
        label
        count
      }
      latestAsOf
      severityCounts {
        severity
        count
      }
      breakdownCounts {
        label
        count
      }
      items {
        id
        incidentId
        category
        state
        severity
        title
        resourceName
        resourceDetail
        pipelineOutcome
        targetBranch
        appName
        appType
        hitIndicatorValues
        foundVersion
        libraryName
        libraryVersion
        isRunning
        runtimeStatus
        cloudRunState
        isUsed
        aiSimulation
        exploitabilityVerdict
        cveExploitability {
          cve
          library
          verdict
          aiSimulation
          runtimeStatus
        }
        cveExploitabilityOverflow
        linkedIssueId
        factorEvidence {
          signal
          factorId
          factorName
          cve
          library
          items {
            key
            value
            link
            snippet {
              fileName
              snippetLineNumber
              text
            }
          }
        }
        isInternetExposed
        dependencyType
        pinState
        stateReason
        externalUrl
        asOf
        developerEmail
        commandRanAt
        devEnvironmentOutcome
        resourceOwner
        issueId
        joinableIssueId
        jiraTicketKeys
        sbomAppId
        sbomLibrary
        isFixAvailable
        hasTicket
        commentCount
        latestCommentText
        latestCommentAuthorName
        latestCommentAt
        isGptAvailable
        isExcluded
        hasJiraTicket
        hasNonJiraTicket
        hasSeverityOverride
        originalIssueSeverity
        hasOwnerOverride
        originalOwnerName
        originalOwnerEmail
        currentOwnerName
        currentOwnerEmail
        hasMessages
        isFixApplied
        isExcludedByAlert
        isFalsePositive
        isCanceledFalsePositive
        appTags
        businessUnits {
          id
          name
        }
        hasPullRequest
        eventAt
        exposureBlocked
        exposureSuppressedBy
        exposureCounted
        exposureNotCountedReason
        hasFalsePositiveDetails
        falsePositiveComment
        cancelFalsePositiveComment
      }
      columnPresence {
        aiSimulation
        isUsed
        runtimeStatus
      }
    }
  }
}
```

#### Variables

This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.

```json
{
  "incidentId": "example",
  "input": {
    "cursor": "example",
    "conditionalFilters": [
      {
        "fieldName": "example",
        "values": ["example"],
        "condition": "OR"
      }
    ],
    "search": "example",
    "category": "CodeIssue",
    "itemLimit": 42,
    "safeVersions": true,
    "includeFactorEvidence": true,
    "related": true
  }
}
```

{% endtab %}

{% tab title="cURL" %}

```shell
curl -X POST \
https://api.cloud.ox.security/api/apollo-gateway \
-H 'Content-Type: application/json' \
-H 'Authorization: YOUR_API_TOKEN' \
-d '{
 "query": "query GetIncidentEvidence($incidentId: String!, $input: IncidentEvidenceFilterInput) { getIncidentEvidence(incidentId: $incidentId, input: $input) { groups { nextCursor category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues foundVersion libraryName libraryVersion isRunning runtimeStatus cloudRunState isUsed aiSimulation exploitabilityVerdict cveExploitability { cve library verdict aiSimulation runtimeStatus } cveExploitabilityOverflow linkedIssueId factorEvidence { signal factorId factorName cve library items { key value link snippet { fileName snippetLineNumber text } } } isInternetExposed dependencyType pinState stateReason externalUrl asOf developerEmail commandRanAt devEnvironmentOutcome resourceOwner issueId joinableIssueId jiraTicketKeys sbomAppId sbomLibrary isFixAvailable hasTicket commentCount latestCommentText latestCommentAuthorName latestCommentAt isGptAvailable isExcluded hasJiraTicket hasNonJiraTicket hasSeverityOverride originalIssueSeverity hasOwnerOverride originalOwnerName originalOwnerEmail currentOwnerName currentOwnerEmail hasMessages isFixApplied isExcludedByAlert isFalsePositive isCanceledFalsePositive appTags businessUnits { id name } hasPullRequest eventAt exposureBlocked exposureSuppressedBy exposureCounted exposureNotCountedReason hasFalsePositiveDetails falsePositiveComment cancelFalsePositiveComment } columnPresence { aiSimulation isUsed runtimeStatus } } } }",
 "variables": {
    "incidentId": "example",
    "input": {
      "cursor": "example",
      "conditionalFilters": [
        {
          "fieldName": "example",
          "values": ["example"],
          "condition": "OR"
        }
      ],
      "search": "example",
      "category": "CodeIssue",
      "itemLimit": 42,
      "safeVersions": true,
      "includeFactorEvidence": true,
      "related": true
    }
  }
}'
```

{% endtab %}

{% tab title="Node.js" %}

```javascript
const query = 'query GetIncidentEvidence($incidentId: String!, $input: IncidentEvidenceFilterInput) { getIncidentEvidence(incidentId: $incidentId, input: $input) { groups { nextCursor category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues foundVersion libraryName libraryVersion isRunning runtimeStatus cloudRunState isUsed aiSimulation exploitabilityVerdict cveExploitability { cve library verdict aiSimulation runtimeStatus } cveExploitabilityOverflow linkedIssueId factorEvidence { signal factorId factorName cve library items { key value link snippet { fileName snippetLineNumber text } } } isInternetExposed dependencyType pinState stateReason externalUrl asOf developerEmail commandRanAt devEnvironmentOutcome resourceOwner issueId joinableIssueId jiraTicketKeys sbomAppId sbomLibrary isFixAvailable hasTicket commentCount latestCommentText latestCommentAuthorName latestCommentAt isGptAvailable isExcluded hasJiraTicket hasNonJiraTicket hasSeverityOverride originalIssueSeverity hasOwnerOverride originalOwnerName originalOwnerEmail currentOwnerName currentOwnerEmail hasMessages isFixApplied isExcludedByAlert isFalsePositive isCanceledFalsePositive appTags businessUnits { id name } hasPullRequest eventAt exposureBlocked exposureSuppressedBy exposureCounted exposureNotCountedReason hasFalsePositiveDetails falsePositiveComment cancelFalsePositiveComment } columnPresence { aiSimulation isUsed runtimeStatus } } } }';

fetch("https://api.cloud.ox.security/api/apollo-gateway", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  body: JSON.stringify({
    query: query,
    // This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    variables: {
      incidentId: "example",
      input: {
        cursor: "example",
        conditionalFilters: [
          {
            fieldName: "example",
            values: ["example"],
            condition: "OR"
          }
        ],
        search: "example",
        category: "CodeIssue",
        itemLimit: 42,
        safeVersions: true,
        includeFactorEvidence: true,
        related: true
      }
    }
  })
})
.then(response => response.json())
.then(result => console.log(JSON.stringify(result, null, 2)))
.catch(error => console.error('Error:', error));
```

{% endtab %}

{% tab title="Python" %}

```python
import requests

query = 'query GetIncidentEvidence($incidentId: String!, $input: IncidentEvidenceFilterInput) { getIncidentEvidence(incidentId: $incidentId, input: $input) { groups { nextCursor category totalCount stateCounts { state count } stateBreakdown { label count } latestAsOf severityCounts { severity count } breakdownCounts { label count } items { id incidentId category state severity title resourceName resourceDetail pipelineOutcome targetBranch appName appType hitIndicatorValues foundVersion libraryName libraryVersion isRunning runtimeStatus cloudRunState isUsed aiSimulation exploitabilityVerdict cveExploitability { cve library verdict aiSimulation runtimeStatus } cveExploitabilityOverflow linkedIssueId factorEvidence { signal factorId factorName cve library items { key value link snippet { fileName snippetLineNumber text } } } isInternetExposed dependencyType pinState stateReason externalUrl asOf developerEmail commandRanAt devEnvironmentOutcome resourceOwner issueId joinableIssueId jiraTicketKeys sbomAppId sbomLibrary isFixAvailable hasTicket commentCount latestCommentText latestCommentAuthorName latestCommentAt isGptAvailable isExcluded hasJiraTicket hasNonJiraTicket hasSeverityOverride originalIssueSeverity hasOwnerOverride originalOwnerName originalOwnerEmail currentOwnerName currentOwnerEmail hasMessages isFixApplied isExcludedByAlert isFalsePositive isCanceledFalsePositive appTags businessUnits { id name } hasPullRequest eventAt exposureBlocked exposureSuppressedBy exposureCounted exposureNotCountedReason hasFalsePositiveDetails falsePositiveComment cancelFalsePositiveComment } columnPresence { aiSimulation isUsed runtimeStatus } } } }'

response = requests.post(
  "https://api.cloud.ox.security/api/apollo-gateway",
  headers={
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_TOKEN"
  },
  json={
    "query": query,
    # This is an example input showing all available input fields. Only fields marked as required in the schema are mandatory.
    "variables": {
      "incidentId": "example",
      "input": {
        "cursor": "example",
        "conditionalFilters": [
          {
            "fieldName": "example",
            "values": ["example"],
            "condition": "OR"
          }
        ],
        "search": "example",
        "category": "CodeIssue",
        "itemLimit": 42,
        "safeVersions": true,
        "includeFactorEvidence": true,
        "related": true
      }
    }
  }
)

if response.status_code == 200:
    result = response.json()
    print(result)
else:
    print(f"Error: {response.status_code}")
    print(response.text)
```

{% endtab %}
{% endtabs %}

### Arguments

You can use the following argument(s) to customize your `getIncidentEvidence` query.

| Argument                                                                                                                                    | Description | Supported fields                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| ------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| incidentId `String!` <mark style="color:red;background-color:red;">required</mark>                                                          |             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| input [`IncidentEvidenceFilterInput`](/api-documentation/api-reference/api--response-center/types/inputs/incident-evidence-filter-input.md) |             | <p>cursor <code>String</code><br>conditionalFilters <a href="/api-documentation/api-reference/api--response-center/types/inputs/incident-conditional-filter-input.md"><code>\[IncidentConditionalFilterInput!]</code></a><br>search <code>String</code><br>category <a href="/api-documentation/api-reference/api--response-center/types/enums/evidence-category.md"><code>EvidenceCategory</code></a><br>itemLimit <code>Int</code><br><del>itemOffset <code>Int</code></del> ⚠️<br>safeVersions <code>Boolean</code><br>includeFactorEvidence <code>Boolean</code><br>related <code>Boolean</code></p> |

### Fields

Return type: [`IncidentEvidenceResult!`](/api-documentation/api-reference/api--response-center/types/objects/incident-evidence-result.md)

You can use the following field(s) to specify what information your `getIncidentEvidence` query will return. Please note that some fields may have their own subfields.

| Field                                                                                                                                | Description | Supported fields                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ------------------------------------------------------------------------------------------------------------------------------------ | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| groups [`[IncidentEvidenceGroup!]!`](/api-documentation/api-reference/api--response-center/types/objects/incident-evidence-group.md) |             | <p>nextCursor <code>String</code><br>category <a href="/api-documentation/api-reference/api--response-center/types/enums/evidence-category.md"><code>EvidenceCategory!</code></a><br>totalCount <code>Int!</code><br>stateCounts <a href="/api-documentation/api-reference/api--response-center/types/objects/evidence-state-count.md"><code>\[EvidenceStateCount!]!</code></a><br>stateBreakdown <a href="/api-documentation/api-reference/api--response-center/types/objects/incident-named-count.md"><code>\[IncidentNamedCount!]!</code></a><br>latestAsOf <code>DateTime</code><br>severityCounts <a href="/api-documentation/api-reference/api--response-center/types/objects/severity-histogram-bucket.md"><code>\[SeverityHistogramBucket!]!</code></a><br>breakdownCounts <a href="/api-documentation/api-reference/api--response-center/types/objects/incident-named-count.md"><code>\[IncidentNamedCount!]!</code></a><br>items <a href="/api-documentation/api-reference/api--response-center/types/objects/incident-evidence-item.md"><code>\[IncidentEvidenceItem!]!</code></a><br>columnPresence <a href="/api-documentation/api-reference/api--response-center/types/objects/incident-evidence-column-presence.md"><code>IncidentEvidenceColumnPresence!</code></a></p> |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.ox.security/api-documentation/api-reference/api--response-center/queries/get-incident-evidence.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.