Acronis

Acronis Incidents API

The Incidents API from Acronis — 5 operation(s) for incidents.

GitHub OpenAPI

Operations 6

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /incidents List security incidents for customers · Get incidents #
Ask an LLM
“How do I pull all incidents for my customers into my MDR backend?”
“Can I filter incidents by severity or by when they were last updated?”
Tell an agent
List incidents for customer {customer_id}.
Get incidents with severity {severity} updated in {updated_at}.
POST /incidents/investigation_state Update investigation state on many incidents · Create incidents investigation state #
Ask an LLM
“How do I set the investigation state of several incidents in one call?”
“Can I post the same comment across a batch of incidents?”
Tell an agent
Set investigation update {update} on incidents {incident_ids}.
Apply update {update} to each customer and incident pair in {customer_incident_ids}.
GET /incidents/{incident_id} Get one incident's details · Get incidents by incident id #
Ask an LLM
“What detections and activities make up a specific incident?”
“Can I see which response actions are available for an incident?”
Tell an agent
Show incident {incident_id}.
Get incident {incident_id} for customer {customer_id} with its detections and activities.
POST /incidents/{incident_id}/investigation_state Update one incident's investigation state · Create incidents by incident id investigation state #
Ask an LLM
“How do I move a single incident to a new investigation state with a comment?”
“Can I link an incident to my external ticket and assignee?”
Tell an agent
Set incident {incident_id} investigation state to {state}.
Comment {comment} on incident {incident_id}.
POST /incidents/{incident_id}/response_action Run a response action on an incident · Create incidents by incident id response action #
Ask an LLM
“How do I isolate a compromised workload from an incident?”
“Can I delay a response action by some minutes before it runs?”
Tell an agent
Perform action {action} on incident {incident_id}.
Run {action} for incident {incident_id} on workload {workload_id} after {delay} minutes.
GET /incidents/{incident_id}/response_action Check the status of a response action · Get incidents by incident id response action #
Ask an LLM
“Did the isolation action I started on an incident finish?”
“What is the detailed status of a response action I already triggered?”
Tell an agent
Show the status of response action {activity_id} on incident {incident_id}.
Check whether action activity {activity_id} for incident {incident_id} completed.

Documentation

📖
Documentation
https://developer.acronis.com/doc/resource-policy-management/v4/guide/index.html
📖
APIReference
https://developer.acronis.com/doc/resource-policy-management/v4/reference/index.html
📖
Documentation
https://developer.acronis.com/doc/outbound/apis/api-library/psa/index.html
📖
APIReference
https://developer.acronis.com/doc/advanced-automation/v1/reference/index.html
📖
Documentation
https://developer.acronis.com/doc/outbound/apis/api-library/events/index.html
📖
APIReference
https://developer.acronis.com/doc/events/v1/reference/index.html
📖
Documentation
https://developer.acronis.com/doc/outbound/apis/api-library/dr/index.html
📖
APIReference
https://developer.acronis.com/doc/disaster-recovery/v2/reference/index.html
📖
Documentation
https://developer.acronis.com/doc/outbound/apis/api-library/mdr/index.html
📖
APIReference
https://developer.acronis.com/doc/mdr/v1/reference/index.html
📖
Documentation
https://developer.acronis.com/doc/vaultman/v1/reference/index.html
📖
APIReference
https://developer.acronis.com/doc/vaultman/v1/reference/index.html
📖
Documentation
https://developer.acronis.com/doc/outbound/apis/api-library/account/index.html
📖
Documentation
https://developer.acronis.com/doc/agents/v2/reference/index.html
📖
Documentation
https://developer.acronis.com/doc/tasks/v2/guide/index.html
📖
APIReference
https://developer.acronis.com/doc/account-management/v2/reference/index.html
📖
APIReference
https://developer.acronis.com/doc/alerts/v1/reference/index.html
📖
APIReference
https://developer.acronis.com/doc/pricelist/v1/reference/index.html
📖
APIReference
https://developer.acronis.com/doc/files/v1/reference/index.html

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/acronis/refs/heads/main/openapi/acronis-incidents-api-openapi.yml

Other Resources

🔗
LLMsTxt
https://developer.acronis.com/doc/account-management/v2/reference/llms.txt
🔗
LLMsTxt
https://developer.acronis.com/doc/alerts/v1/reference/llms.txt
🔗
LLMsTxt
https://developer.acronis.com/doc/pricelist/v1/reference/llms.txt
🔗
LLMsTxt
https://developer.acronis.com/doc/files/v1/reference/llms.txt

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/acronis:acronis-incidents-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

acronis-incidents-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Endpoint Detection and Response (EDR) Incidents API
  version: '1.0'
servers:
- url: https://dev-cloud.acronis.com/api/mdr/v1
  variables: {}
tags:


# --- truncated at 32 KB (79 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/acronis/refs/heads/main/openapi/acronis-incidents-api-openapi.yml