curl --request POST \
--url 'https://api.flashcat.cloud/insight/incident/export?app_key=' \
--header 'Content-Type: application/json' \
--data '
{
"start_time": 1712000000,
"end_time": 1712604800,
"severities": [
"Critical",
"Warning"
],
"export_fields": [
"incident_id",
"title",
"severity",
"created_at",
"seconds_to_close"
],
"description_html_to_text": true
}
'import requests
url = "https://api.flashcat.cloud/insight/incident/export?app_key="
payload = {
"start_time": 1712000000,
"end_time": 1712604800,
"severities": ["Critical", "Warning"],
"export_fields": ["incident_id", "title", "severity", "created_at", "seconds_to_close"],
"description_html_to_text": True
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
start_time: 1712000000,
end_time: 1712604800,
severities: ['Critical', 'Warning'],
export_fields: ['incident_id', 'title', 'severity', 'created_at', 'seconds_to_close'],
description_html_to_text: true
})
};
fetch('https://api.flashcat.cloud/insight/incident/export?app_key=', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flashcat.cloud/insight/incident/export?app_key=",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'start_time' => 1712000000,
'end_time' => 1712604800,
'severities' => [
'Critical',
'Warning'
],
'export_fields' => [
'incident_id',
'title',
'severity',
'created_at',
'seconds_to_close'
],
'description_html_to_text' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flashcat.cloud/insight/incident/export?app_key="
payload := strings.NewReader("{\n \"start_time\": 1712000000,\n \"end_time\": 1712604800,\n \"severities\": [\n \"Critical\",\n \"Warning\"\n ],\n \"export_fields\": [\n \"incident_id\",\n \"title\",\n \"severity\",\n \"created_at\",\n \"seconds_to_close\"\n ],\n \"description_html_to_text\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/insight/incident/export?app_key=")
.header("Content-Type", "application/json")
.body("{\n \"start_time\": 1712000000,\n \"end_time\": 1712604800,\n \"severities\": [\n \"Critical\",\n \"Warning\"\n ],\n \"export_fields\": [\n \"incident_id\",\n \"title\",\n \"severity\",\n \"created_at\",\n \"seconds_to_close\"\n ],\n \"description_html_to_text\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flashcat.cloud/insight/incident/export?app_key=")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"start_time\": 1712000000,\n \"end_time\": 1712604800,\n \"severities\": [\n \"Critical\",\n \"Warning\"\n ],\n \"export_fields\": [\n \"incident_id\",\n \"title\",\n \"severity\",\n \"created_at\",\n \"seconds_to_close\"\n ],\n \"description_html_to_text\": true\n}"
response = http.request(request)
puts response.read_body"incident_id,title,severity,created_at\n6a86b5d6f72de50ae1ce2ffb,CPU usage above 90%,Critical,2026-01-01 10:00:00 +0800 CST\n"{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InvalidParameter",
"message": "The specified parameter is not valid."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "Unauthorized",
"message": "You are unauthorized."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "RequestTooFrequently",
"message": "Request too frequently."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InternalError",
"message": "We encountered an internal error, and it has been reported. Please try again later."
}
}Export insight incidents
Export the filtered incident analytics list as a CSV file. The response is a CSV stream delivered with Content-Disposition: attachment — it is not a JSON envelope. CSV headers and formatted values use the request locale, falling back to the member locale and then the account locale. time_zone defaults to the account time zone, then Asia/Shanghai. Export stops after at most 100,000 rows. Valid export_fields keys: incident_id, title, severity, progress, channel_id, channel_name, team_id, team_name, created_at, alert_cnt, active_alert_cnt, alert_event_cnt, seconds_to_ack, seconds_to_close, closed_by, owner_id, owner_name, creator_id, creator_name, closer_id, closer_name, engaged_seconds, hours, notifications, interruptions, acknowledgements, ackers, assignments, reassignments, escalations, manual_escalations, timeout_escalations, assigned_to, raw_assigned_to, escalate_rule_name, responders, raw_responders, snooze_status, snoozed_before, ever_muted, frequency, is_rare, description, labels, fields. When export_fields is omitted, all columns are exported.
curl --request POST \
--url 'https://api.flashcat.cloud/insight/incident/export?app_key=' \
--header 'Content-Type: application/json' \
--data '
{
"start_time": 1712000000,
"end_time": 1712604800,
"severities": [
"Critical",
"Warning"
],
"export_fields": [
"incident_id",
"title",
"severity",
"created_at",
"seconds_to_close"
],
"description_html_to_text": true
}
'import requests
url = "https://api.flashcat.cloud/insight/incident/export?app_key="
payload = {
"start_time": 1712000000,
"end_time": 1712604800,
"severities": ["Critical", "Warning"],
"export_fields": ["incident_id", "title", "severity", "created_at", "seconds_to_close"],
"description_html_to_text": True
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
start_time: 1712000000,
end_time: 1712604800,
severities: ['Critical', 'Warning'],
export_fields: ['incident_id', 'title', 'severity', 'created_at', 'seconds_to_close'],
description_html_to_text: true
})
};
fetch('https://api.flashcat.cloud/insight/incident/export?app_key=', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flashcat.cloud/insight/incident/export?app_key=",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'start_time' => 1712000000,
'end_time' => 1712604800,
'severities' => [
'Critical',
'Warning'
],
'export_fields' => [
'incident_id',
'title',
'severity',
'created_at',
'seconds_to_close'
],
'description_html_to_text' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flashcat.cloud/insight/incident/export?app_key="
payload := strings.NewReader("{\n \"start_time\": 1712000000,\n \"end_time\": 1712604800,\n \"severities\": [\n \"Critical\",\n \"Warning\"\n ],\n \"export_fields\": [\n \"incident_id\",\n \"title\",\n \"severity\",\n \"created_at\",\n \"seconds_to_close\"\n ],\n \"description_html_to_text\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flashcat.cloud/insight/incident/export?app_key=")
.header("Content-Type", "application/json")
.body("{\n \"start_time\": 1712000000,\n \"end_time\": 1712604800,\n \"severities\": [\n \"Critical\",\n \"Warning\"\n ],\n \"export_fields\": [\n \"incident_id\",\n \"title\",\n \"severity\",\n \"created_at\",\n \"seconds_to_close\"\n ],\n \"description_html_to_text\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flashcat.cloud/insight/incident/export?app_key=")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"start_time\": 1712000000,\n \"end_time\": 1712604800,\n \"severities\": [\n \"Critical\",\n \"Warning\"\n ],\n \"export_fields\": [\n \"incident_id\",\n \"title\",\n \"severity\",\n \"created_at\",\n \"seconds_to_close\"\n ],\n \"description_html_to_text\": true\n}"
response = http.request(request)
puts response.read_body"incident_id,title,severity,created_at\n6a86b5d6f72de50ae1ce2ffb,CPU usage above 90%,Critical,2026-01-01 10:00:00 +0800 CST\n"{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InvalidParameter",
"message": "The specified parameter is not valid."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "Unauthorized",
"message": "You are unauthorized."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "RequestTooFrequently",
"message": "Request too frequently."
}
}{
"request_id": "01HK8XQE3Z7JM2NTFQ5YJ8P9R4",
"error": {
"code": "InternalError",
"message": "We encountered an internal error, and it has been reported. Please try again later."
}
}Restrictions
| Aspect | Value |
|---|---|
| Rate limits | 100 requests/day; 20 requests/minute; 10 requests/second per account |
| Permissions | Analytics Read (on-call) |
Authorizations
App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account.
Body
Shared filter envelope for insight and export endpoints. Severities accept up to 3 values; team/channel/responder/incident filters accept up to 100 IDs each. The time range cannot exceed one year.
Start time, Unix seconds. Must be greater than 0.
End time, Unix seconds. Must be greater than start_time.
Filter by team IDs. At most 100 entries.
100Filter by channel IDs. At most 100 entries.
100Filter by responder person IDs. At most 100 entries.
100Filter by severity. At most 3 entries.
3Critical, Warning, Info, Ok Filter by incident IDs (MongoDB ObjectIDs). At most 100 entries.
100^[0-9a-fA-F]{24}$Substring match on the incident title (SQL LIKE %query%).
Label filters (exact match).
Show child attributes
Show child attributes
Custom-field filters (exact match).
Sort field of the incident list; only created_at (incident creation time) is supported. Used by /insight/incident/list only.
created_at Sort ascending when true, descending otherwise. Only used by /insight/incident/list.
Restrict results to teams the caller belongs to. When true and the caller has no teams, the result set is empty.
IANA time zone name used to cut day/week/month buckets (e.g. Asia/Shanghai). Optional; defaults to UTC, except that /insight/incident/export falls back to the account time zone and then Asia/Shanghai.
Lower bound (inclusive) on time-to-close, in seconds.
x >= 0Upper bound (exclusive) on time-to-close, in seconds. Must be greater than seconds_to_close_from when both are set.
x >= 0Lower bound (inclusive) on time-to-acknowledge, in seconds.
x >= 0Upper bound (exclusive) on time-to-acknowledge, in seconds. Must be greater than seconds_to_ack_from when both are set.
x >= 0CSV column keys to include in the export, in the given order; unknown or duplicate keys are rejected. The valid key set differs per export endpoint — see each export operation's description. Only used by the export endpoints; at most 50 entries.
50Strip HTML markup from the description column when exporting.
Include incidents that have ever been muted. By default, they are excluded.
Response
Success
CSV file stream (Content-Type: application/octet-stream, Content-Disposition: attachment; filename=incident_export_yyyyMMdd_HHmmss.csv). The first row holds localized column headers. Columns default to the full incident field set, or the keys given in export_fields.
Was this page helpful?