Skip to main content

Triage activity

GET 

/api/security/triage-activity

What PEOPLE did, newest first, merged from finding status changes (audit ledger), finding feedback, incident transitions, incident comments and shadow reviews with a human actor. System actions (a scan reopening a candidate, a detection reopening a finding) are not triage. Keyset on (at, id); tenant comes from the JWT; restricted callers see neutral subject titles and no free text.

Request​

Responses​

Successful Response