> ## Documentation Index > Fetch the complete documentation index at: https://docs.guardhousehq.com/llms.txt > Use this file to discover all available pages before exploring further. # Get full incident report detail > Returns the full report including every question, answer, and attachment metadata for a single incident report. ## OpenAPI ````yaml /api-reference/openapi.json get /api/external/incidentreports/reportdata openapi: 3.1.0 info: title: Guardhouse API version: 1.0.0 description: >- The Guardhouse API gives external systems programmatic access to incident reports, timesheets, staff, customers, sites, and webhook event subscriptions. All endpoints return a consistent envelope (`ApiResponse`, `ApiPagedResponse`, or `ApiPostPagedResponse`). Authentication is a two-step flow: exchange a long-lived **API key** for a short-lived **JWT bearer token**, then send the bearer on every subsequent request. contact: name: Guardhouse Support license: name: Proprietary servers: - url: https://gateway-api.guardhousehq.com description: AU production - url: https://gateway-api.guardhousehq.co.uk description: UK production security: - bearerAuth: [] subscriptionKey: [] tags: - name: Authentication description: >- Exchange a long-lived API key for a short-lived JWT bearer token. The token must be sent as `Authorization: Bearer ` on every subsequent request. - name: Incident Reports description: >- List, fetch, and export incident reports submitted against your customers and sites. Requires an API key with `KeyType=incidentreport`. - name: Timesheets description: List timesheet entries and fetch per-entry rate breakdowns. - name: Live Operations description: >- Retrieve live shift and employee operational data, including clock-in status, location, welfare checks, and license details. - name: Staff description: >- List, create, and update employees and their security licenses. Read endpoints (`GET /api/external/staffs`, `GET /api/external/staffs/{id}/licenses`) are accessible with any valid Public API key. Write endpoints (`POST`, `PATCH`, `GET /staffs/search`) require `KeyType=developer`. - name: Customers description: List customer records visible to your API key. - name: Sites description: List sites visible to your API key. - name: Webhooks description: >- Manage webhook subscribers and event subscriptions so Guardhouse can notify your systems when incident reports or timesheets change. Requires an API key with `KeyType=developer`. - name: Login Audit description: >- Read-only access to login activity (successful logins, failed logins, and reserved logout events) for your company. **Requires an API key issued with the `login-audits.read` entitlement scope** — keys without this special scope are rejected at the auth layer with `403 Forbidden`. Tokens minted from such a key carry `login-audits.read` in their `Scope` claim, which is what the endpoint checks. paths: /api/external/incidentreports/reportdata: get: tags: - Incident Reports summary: Get full incident report detail description: >- Returns the full report including every question, answer, and attachment metadata for a single incident report. parameters: - name: incidentReportId in: query required: true description: The incident report's numeric ID. schema: type: integer format: int32 - $ref: '#/components/parameters/CustomerIdParam' - $ref: '#/components/parameters/SiteIdParam' - $ref: '#/components/parameters/CompanyIdParam' responses: '200': description: Incident report detail content: application/json: schema: $ref: '#/components/schemas/IncidentReportDataEnvelope' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' components: parameters: CustomerIdParam: name: customerId in: query description: >- Semicolon-separated list of customer IDs. Defaults to the customers your API key is scoped to. schema: type: string SiteIdParam: name: siteId in: query description: >- Semicolon-separated list of site IDs. Defaults to the sites your API key is scoped to. schema: type: string CompanyIdParam: name: companyId in: query description: >- Company ID. Normally derived from your API key claims; only set this if you have multi-company access. schema: type: string schemas: IncidentReportDataEnvelope: allOf: - $ref: '#/components/schemas/ApiResponse' - type: object properties: data: $ref: '#/components/schemas/IncidentReportData' ApiResponse: type: object description: The standard envelope for every JSON endpoint. properties: status: $ref: '#/components/schemas/Status' data: description: Endpoint-specific payload. `null` when an error occurred. nullable: true count: type: integer format: int32 nullable: true message: type: string errors: type: array items: $ref: '#/components/schemas/Error' IncidentReportData: type: object description: >- Full report including the report-level summary and every question/answer. properties: incidentReportId: type: integer format: int32 formName: type: string customerName: type: string customerApiReferenceNumber: type: string nullable: true siteType: type: string siteName: type: string nullable: true siteAddress: type: string nullable: true siteCity: type: string nullable: true siteState: type: string nullable: true siteCountry: type: string nullable: true sitePostCode: type: string nullable: true siteApiReferenceNumber: type: string nullable: true patrolSiteName: type: string nullable: true patrolSiteAddress: type: string nullable: true patrolSiteCity: type: string nullable: true patrolSiteState: type: string nullable: true patrolSiteCountry: type: string nullable: true patrolSitePostCode: type: string nullable: true patrolSiteApiReferenceNumber: type: string nullable: true staffName: type: string nullable: true licenseNumber: type: string nullable: true reportId: type: string dateCreated: type: string format: date-time nullable: true submittedByName: type: string nullable: true submittedDate: type: string format: date-time nullable: true modifiedByName: type: string nullable: true modifiedDate: type: string format: date-time nullable: true previousIncidentReportId: type: integer format: int32 nullable: true incidentReportDetail: type: array items: $ref: '#/components/schemas/IncidentReportDetail' Status: type: object properties: code: type: integer format: int32 description: Numeric service result code. `0` indicates success. errorMessage: type: string description: Human-readable error message; empty on success. Error: type: object properties: code: type: integer format: int32 default: 100 message: type: string IncidentReportDetail: type: object properties: incidentReportDetailId: type: integer format: int32 parentIncidentReportDetailAnswerId: type: integer format: int32 nullable: true parentIncidentReportDetailId: type: integer format: int32 nullable: true setNumber: type: integer format: int32 nullable: true isNeedAction: type: boolean nullable: true actionDescription: type: string nullable: true incidentReportQuestion: type: object additionalProperties: true description: Question metadata (text, type, ordering). incidentReportDetailAnswers: type: array description: One or more answers submitted for this question. items: type: object additionalProperties: true responses: Forbidden: description: >- The bearer token is missing the required policy or `KeyType` claim, or the resource is outside your API key's scope. content: application/json: schema: $ref: '#/components/schemas/ApiResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ApiResponse' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- JWT issued by `POST /api/external/token/request`. Send as `Authorization: Bearer `. subscriptionKey: type: apiKey in: header name: external-gh-apim-sub-key description: >- Guardhouse API Management subscription key. Required on every request. The same value is used by all API consumers within a region — contact Guardhouse Support for the subscription key. ````