Managing API Responses

The Incidents API returns 500 incidents per call; responses are based on the start time of incidents. To ensure that incidents with identical start times are not split into two API responses, the Incidents API includes any subsequent incidents that have the same start times as the 500th incident. 

In each call, there is a responseInfo object returned along with the incidents, which includes a field with the next start time. This next start time continues the query.

For example, let's say we want a query with starttime=a and endtime=b. This query would return 100,000 incidents for the defined duration. Skyhigh Security Service Edge sends the first 500 incidents with starttime=a. The nextstarttime is included in the response (as there is more data in the <a,b> duration interval). To get the rest of the incidents, we'll run another query, with with starttime= nextstarttime.

This will continue until nextstarttime=null, at which point all 100,000 incidents have been returned.