Incidents coming from DLP Cloud detector in investigate tab appear to be coming from API even though they are coming from DLP Cloud Managed detector in CASB.
This is working as designed. To verify if the incident was detected by DLP Cloud, double click to on the incident.
To remove the additional incident that appears as "API" keyword a feature request ISFR-2793 has been raised.