Fetch open incidents across all sites

You can list open incidents across your sites with the PowerSEC CLI or the API. Incidents are part of Pro Protection, Pro + Backup Plus and Agency; sites on other plans are reported as locked.

Using the CLI

# Install once
npm install -g @powersec/cli
psec login --api-key psec_live_xxx

# Open incidents (the default)
psec incidents list

# Up to 50, including investigating, resolved and closed
psec incidents list --status all --limit 50

Via the API

GET https://powersec.io/api/incidents?status=open
Authorization: Bearer <your-api-key>

Parameters

Example response

{
  "success": true,
  "incidents": [
    {
      "id": "inc_abc",
      "title": "Malware detected",
      "type": "malware",
      "severity": "critical",
      "status": "open",
      "siteId": "site_xyz",
      "detectedAt": "2026-05-01T12:00:00Z"
    }
  ],
  "total": 5
}

Create an API key

Open Dashboard → Settings → API Keys and click New API Key. Keys start with psec_live_. Use them for both the CLI and direct API calls.

Shell example

TOKEN="psec_live_xxx"
curl -s "https://powersec.io/api/incidents?status=open&severity=critical" \
  -H "Authorization: Bearer $TOKEN" | jq ".incidents[] | {title, siteId, detectedAt}"

Note: Incidents are security events such as malware, brute-force attacks and downtime. Vulnerabilities (CVEs) are listed separately under Dashboard → Vulnerabilities.