Ok I found the time to raise a support ticket for this .
And here the official answer by Thomas Martens, Camunda:
I took a closer look into this and it would appear this is the expected behaviour. The cockpit implements some additional logic to automatically fetch the root cause incident message which the REST API does not offer out of the box unfortunately.
So to replicate the cockpit behaviour through the Get Incident endpoint of our REST API, you would need to fetch the associated root cause incident with a separate request using the rootCauseIncidentId until you have reached the root incident and the value of incidentMessage is available.
That said, I can see how it would be more convenient to (optionally) get the relevant root cause information through the original request. So if this would be of interest to you, I’m happy to pass this on as a feature request to our product management for further validation.
I hope this clarifies! Please do let me know if you’d like to proceed with the feature request or have any further queries on this.
There will be a Feature Request for this - I port it when it is ready.