Assignment

APIs for managing report assignments

Update report assignment

post

Assigns a user to an MTH/MDR report, or clears the current assignment.

Validation rules:

• xsoar_source_id is required. It accepts a string or an array of strings; when an array is supplied only the first element is used and the rest are silently ignored.
• user is optional. When supplied it is validated against the tenant's user list; an unknown value fails the request. When omitted or null, the assignment is cleared and username is forced to null regardless of what was sent.
• username is a free-text display name and is not validated.
• If the report cannot be found, a generic error response is returned.

Response notes:

• Returns the updated report in the UPPER_SNAKE_CASE shape (ReportUpperCase).
• COMMENTS and ATTACHMENTS are always null on this response — this endpoint reloads the report without its joined comments or parsed attachment list.

Required licenses: MDR, MTH, Managed XSIAM Pro, Managed XSIAM Premium.

Permissions: Users with Instance Administrator privileges only can access these endpoints.

Authorizations

AuthorizationstringRequired

API Key for authentication

x-xdr-auth-idstringRequired

API Key ID for authentication

Header parameters

AuthorizationstringRequired

{api_key}

Example: YOUR_API_KEY_HERE

x-xdr-auth-idstringRequired

{api_key_id}

Example: 241

Body

request_dataobjectOptional

Request data wrapper

Responses

200

Successful Response

application/json

Response for the status-update and assignment-update endpoints. reply.COMMENTS and reply.ATTACHMENTS are always null here.

400

Bad Request - Invalid parameters or missing required fields

application/json

401

Unauthorized - Invalid or missing API key

application/json

403

Forbidden - Tenant not authorized for this endpoint, or the caller lacks Instance Administrator privileges

application/json

500

Internal Server Error.

Note: most business-logic and input-validation failures on these endpoints are also returned with HTTP 500 and reply.err_code 500, with the specific reason in reply.err_extra. Do not rely on a 400 status to detect a bad request; inspect reply.err_extra.

application/json

post/public_api/v1/mth/child/report/update/assign

POST /public_api/v1/mth/child/report/update/assign HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY_HERE
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 102

{
  "request_data": {
    "xsoar_source_id": "777774",
    "user": "[e-mail]",
    "username": "Motti Analysto"
  }
}

{
  "reply": {
    "XSOAR_SOURCE_ID": "777771",
    "NAME": "Updated Report 5",
    "DESCRIPTION": "Updated description",
    "CREATED_BY": "Unit42 Threat Hunting",
    "INSERT_TIME": 1763468832000,
    "UPDATE_TIME": 1765983782000,
    "ATTACHMENTS": null,
    "INCIDENT_ID": 1,
    "REPORT_TYPE": "Threat Report Update",
    "SEVERITY": "SEV_040_HIGH",
    "COMMENTS": null,
    "CLASSIFICATION": "MTH",
    "ASSIGNED_USER": "[e-mail]",
    "ASSIGNED_USER_PRETTY": "Motti Analysto",
    "REPORT_STATUS": "ON_HOLD",
    "xsoar_source_id": "777771",
    "report_type": "Threat Report Update",
    "insert_time": 1763468832000,
    "name": "Updated Report 5",
    "description": "Updated description",
    "incident_id": 1,
    "update_time": 1765983782000,
    "severity": "SEV_040_HIGH",
    "attachments": "{}",
    "classification": "MTH",
    "assigned_user": "[e-mail]",
    "report_status": "ON_HOLD",
    "assigned_user_pretty": "iavron iavron"
  }
}