Assignment

APIs for managing report assignments

Update report assignment

post

Assigns a user to an MTH/MDR report, or clears the current assignment.

Validation rules:

• xsoar_source_id is required. It accepts a string or an array of strings; when an array is supplied only the first element is used and the rest are silently ignored.
• user is optional. When supplied it is validated against the tenant's user list; an unknown value fails the request. When omitted or null, the assignment is cleared and username is forced to null regardless of what was sent.
• username is a free-text display name and is not validated.
• If the report cannot be found, a generic error response is returned.

Response notes:

• Returns the updated report in the UPPER_SNAKE_CASE shape (ReportUpperCase).
• COMMENTS and ATTACHMENTS are always null on this response — this endpoint reloads the report without its joined comments or parsed attachment list.

Required licenses: MDR, MTH, Managed XSIAM Pro, Managed XSIAM Premium.

Permissions: Users with Instance Administrator privileges only can access these endpoints.

Authorizations

AuthorizationstringRequired

API Key for authentication

x-xdr-auth-idstringRequired

API Key ID for authentication

Header parameters

AuthorizationstringRequired

{api_key}

Example: YOUR_API_KEY_HERE

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

xsoar_source_idone ofRequired

XSOAR source ID of the report to update. Accepts a string or an array of strings; only the first element of an array is used.

stringOptional

or

string[]Optional

userstring · nullableOptional

Identifier (typically email) of the user to assign the report to. Validated against the tenant's users. Omit or set to null to clear the assignment.

usernamestring · nullableOptional

Display name of the assignee. Free text; not validated. Forced to null when user is null.

Responses

200

Successful Response

application/json

Response for the status-update and assignment-update endpoints. reply.COMMENTS and reply.ATTACHMENTS are always null here.

400

Bad Request - Invalid parameters or missing required fields

application/json

401

Unauthorized - Invalid or missing API key

application/json

403

Forbidden - Tenant not authorized for this endpoint, or the caller lacks Instance Administrator privileges

application/json

500

Internal Server Error.

Note: most business-logic and input-validation failures on these endpoints are also returned with HTTP 500 and reply.err_code 500, with the specific reason in reply.err_extra. Do not rely on a 400 status to detect a bad request; inspect reply.err_extra.

application/json

post/public_api/v1/mth/child/report/update/assign

POST /public_api/v1/mth/child/report/update/assign HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY_HERE
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 85

{
  "xsoar_source_id": "777774",
  "user": "[e-mail]",
  "username": "Motti Analysto"
}

{
  "reply": {
    "XSOAR_SOURCE_ID": "777771",
    "NAME": "Updated Report 5",
    "DESCRIPTION": "Updated description",
    "CREATED_BY": "Unit42 Threat Hunting",
    "INSERT_TIME": 1763468832000,
    "UPDATE_TIME": 1765983782000,
    "ATTACHMENTS": null,
    "INCIDENT_ID": 1,
    "REPORT_TYPE": "Threat Report Update",
    "SEVERITY": "SEV_040_HIGH",
    "COMMENTS": null,
    "CLASSIFICATION": "MTH",
    "ASSIGNED_USER": "[e-mail]",
    "ASSIGNED_USER_PRETTY": "Motti Analysto",
    "REPORT_STATUS": "ON_HOLD"
  }
}