# Incidents

> A guided response to a leaked gateway key, a breached host, a leaked provider key or a taken-over account, ending in a report for your provider's support team.

Source: https://infro.io/docs/security/incidents

> **Warning:** **On the roadmap — not available yet.** Incident mode and its report is built and in testing, and not deployed. This page describes what it will ship with.

**Security → Incidents** walks through the response to one of four situations, takes the containing steps for you where INFRO can, and ends in a **report**: the evidence a provider's support team asks for when you dispute charges made with a stolen key. It is on every plan.

## The four flows

| Situation | It is about | Steps |
| --- | --- | --- |
| A gateway key leaked | One gateway key | Contain the key, rotate it, review its requests, review the audit log, report. |
| Our host was breached | The organization | Turn off every key at once, rotate them one by one, review requests, review the audit log, report. |
| A provider key leaked | One provider connection | Revoke the key at the provider, replace the credential, check usage outside INFRO, review the audit log, report. INFRO does not revoke keys at your provider; the step links to its key page. |
| A member's account was taken over | One member | Sign the member out everywhere, review their sign-ins, review the audit log, contain keys, report. |

- Opening an incident needs the role that contains keys: owners, admins, Security members and developers. Everyone who opens the Security screen reads incidents and their reports. A member limited to some projects cannot open them: an incident crosses projects.
- Containing from an incident turns the named keys off through Security (every active gateway key for a breached host), with the incident in each audit entry. Rotate each key from Keys afterwards, once the place it leaked from is fixed.
- Signing a member out from an incident is for owners, admins and Security members, on the account-takeover flow; see [Members' sessions and sign-ins](https://infro.io/docs/org/security#members-sessions-and-sign-ins).
- Each step is ticked by the action that does it or by a person. Closing an incident, with an optional summary, ends it: further actions answer `400` `incident_closed`.
- Opening and closing are in the audit log as `security_incident.opened` and `security_incident.closed`.

## The report

The report covers the incident's window (from seven days before it was opened by default, at most 90 days back) and the gateway keys it is about, including every key contained under it. It holds:

- the timeline: audit entries, security signals and rule runs, with who did what;
- each request the keys made: time, key, environment, model, provider, status, input and output tokens, and estimated provider cost, up to 10,000 requests (more are counted, not listed);
- totals: requests, the estimated provider cost of the priced ones, the number of unpriced requests, models and countries;
- where each key was used from, per UTC day, with what its own controls refused. INFRO keeps these daily country counts for 30 days, so an older window has requests without them.

Metadata only: never a prompt, a response or a caller's address. Amounts are **estimated** provider cost, what your provider's invoice is expected to say, never an INFRO charge; an unpriced request is `null`, never $0. Download it as JSON, as CSV (the requests, with the columns `id`, `created_at`, `key_id`, `environment`, `model`, `provider`, `status`, `input_tokens`, `output_tokens`, `estimated_cost_usd`) or as a page to print or save as PDF from your browser.

## API

Through the console session: `GET /console/security/incidents` lists them. `POST /console/security/incidents` with `kind` (`gateway_key_leaked`, `host_breached`, `provider_key_leaked` or `account_taken_over`), `subject_id` (the key, connection or member; none for a breached host), an optional `title` and an optional `window_start` returns `201` and the incident: `id`, `kind`, `title`, `status`, `subject_type`, `subject_id`, `key_ids`, `window_start`, `opened_at`, `opened_by`, `closed_at`, `closed_by`, `summary` and `steps`. `GET /console/security/incidents/{id}` reads one.

`PUT /console/security/incidents/{id}/steps/{step}` with `{done}` ticks a step. `POST .../contain-keys` with optional `key_ids` and `reason` returns `contained` and `already_off`. `POST .../revoke-sessions` signs the member out. `POST .../close` with an optional `summary` closes it. `GET .../report?format=json|csv|html` returns the report; the headers `X-INFRO-Report-Requests` and `X-INFRO-Report-Listed` carry the requests counted and listed.