Incidents
APIs for managing incidents
Import a classifier to Cortex XSOAR
Authorizations
AuthorizationstringRequired
Body
filestringOptional
file
Responses
200
The saved classifiers
application/json
InstanceClassifier - classifies an incident from a specific brand
brandsstring[]Optional
cacheVersninteger · int64Optional
commitMessagestringOptional
createdstring · date-timeOptional
defaultIncidentTypestringOptional
definitionIdstringOptional
descriptionstringOptional
feedbooleanOptional
idstringOptional
incidentSamplesanyOptional
Incidents is a list of incident entities
indexNamestringOptional
instanceIdsstring[]Optional
lockedbooleanOptional
logicalVersioninteger · int64Optional
modifiedstring · date-timeOptional
namestringOptional
nameRawstringOptional
numericIdinteger · int64Optional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
prevNamestringOptional
primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
remotebooleanOptional
sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeInBytesinteger · int64Optional
sortValuesstring[]Optional
sourceClassifierIdstringOptional
syncHashstringOptional
systembooleanOptional
typestringOptional
MapperType for instance classifier
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
post/classifier/import
POST /classifier/import HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: multipart/form-data
Accept: */*
Content-Length: 15
{
"file": "text"
}200
The saved classifiers
[
{
"brands": [
"text"
],
"cacheVersn": 1,
"commitMessage": "text",
"created": "2026-01-01T00:00:00.000Z",
"defaultIncidentType": "text",
"definitionId": "text",
"description": "text",
"feed": true,
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"incidentSamples": null,
"indexName": "text",
"indicatorSamples": [
{
"ExpirationSource": {
"brand": "text",
"expirationInterval": 1,
"expirationPolicy": "text",
"instance": "text",
"moduleId": "text",
"setTime": "2026-01-01T00:00:00.000Z",
"source": "text",
"user": "text"
},
"bypassExclusionList": true,
"classifierId": "text",
"classifierVersion": 1,
"comments": [
{
"content": "text",
"created": "2026-01-01T00:00:00.000Z",
"id": "text",
"user": "text"
}
],
"expirationInterval": 1,
"expirationPolicy": "text",
"fetchTime": "2026-01-01T00:00:00.000Z",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"isEnrichment": true,
"mapperId": "text",
"mapperVersion": 1,
"modifiedTime": "2026-01-01T00:00:00.000Z",
"moduleId": "text",
"rawJSON": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"relationships": [
{
"brand": "text",
"entityA": "text",
"entityAFamily": "text",
"entityAType": "text",
"entityB": "text",
"entityBFamily": "text",
"entityBType": "text",
"fields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"id": "text",
"instance": "text",
"name": "text",
"reliability": "text",
"reverseName": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"type": "text"
}
],
"reliability": "text",
"score": 1,
"sourceBrand": "text",
"sourceInstance": "text",
"timestamp": "2026-01-01T00:00:00.000Z",
"type": "text",
"value": "text"
}
],
"instanceIds": [
"text"
],
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"keyTypeMap": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"locked": true,
"logicalVersion": 1,
"mapping": {
"ANY_ADDITIONAL_PROPERTY": {
"dontMapEventToLabels": true,
"internalMapping": {
"ANY_ADDITIONAL_PROPERTY": {
"complex": "[Circular Reference]",
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
}
},
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"nameRaw": "text",
"numericId": 1,
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"prevName": "text",
"primaryTerm": 1,
"propagationLabels": [
"text"
],
"remote": true,
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sortValues": [
"text"
],
"sourceClassifierId": "text",
"syncHash": "text",
"system": true,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"transformer": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": [
{
"key": "text",
"value": {
"complex": {
"accessor": "text",
"filters": [
[
"[Circular Reference]"
]
],
"root": "text",
"transformers": [
{
"args": "[Circular Reference]",
"operator": "text"
}
]
},
"keyValue": "[Circular Reference]",
"simple": "text"
}
}
],
"simple": "text"
},
"type": "text",
"unclassifiedCases": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": 1
}
},
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1
}
]Create or update incident according to JSON structure. To update incident custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip To get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update
Use the 'createInvestigation: true' to start the investigation process automatically. (by running a playbook based on incident type.)
Authorizations
AuthorizationstringRequired
Body
CreateIncidentRequest is an extension for Incident entity, with additional field of changed-status for the web client.
ShardIDinteger · int64Optional
accountstringOptional
Account holds the tenant name so that slicing and dicing on the master can leverage bleve
activatedstring · date-timeOptional
When was this activated
activatingingUserIdstringOptional
The user that activated this investigation
allReadbooleanOptional
allReadWritebooleanOptional
autimeinteger · int64Optional
AlmostUniqueTime is an attempt to have a unique sortable ID for an incident
cacheVersninteger · int64Optional
canvasesstring[]Optional
Canvases of the incident
categorystringOptional
Category
closeNotesstringOptional
Notes for closing the incident
closeReasonstringOptional
The reason for closing the incident (select from existing predefined values)
closedstring · date-timeOptional
When was this closed
closingUserIdstringOptional
The user ID that closed this investigation
createInvestigationbooleanOptional
createdstring · date-timeOptional
dbotCreatedBystringOptional
Who has created this event - relevant only for manual incidents
dbotCurrentDirtyFieldsstring[]Optional
For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration
dbotDirtyFieldsstring[]Optional
For mirroring, manage a list of dirty fields to not override them from the source of the incident
dbotMirrorDirectionstringOptional
DBotMirrorDirection of how to mirror the incident (in/out/both)
dbotMirrorIdstringOptional
DBotMirrorID of a remote system we are syncing with
dbotMirrorInstancestringOptional
DBotMirrorInstance name of a mirror integration instance
dbotMirrorLastSyncstring · date-timeOptional
The last time we synced this incident even if we did not update anything
dbotMirrorTagsstring[]Optional
The entry tags I want to sync to remote system
detailsstringOptional
The details of the incident - reason, etc.
droppedCountinteger · int64Optional
DroppedCount ...
dueDatestring · date-timeOptional
SLA
feedBasedbooleanOptional
If this incident was triggered by a feed job
hasRolebooleanOptional
Internal field to make queries on role faster
indexNamestringOptional
investigationIdstringOptional
Investigation that was opened as a result of the incoming event
isDebugbooleanOptional
IsDebug ...
isPlaygroundbooleanOptional
IsPlayGround
lastJobRunTimestring · date-timeOptional
If this incident was triggered by a job, this would be the time the previous job started
lastOpenstring · date-timeOptional
linkedCountinteger · int64Optional
LinkedCount ...
linkedIncidentsstring[]Optional
LinkedIncidents incidents that were marked as linked by user
modifiedstring · date-timeOptional
namestringOptional
Incident Name - given by user
notifyTimestring · date-timeOptional
Incdicates when last this field was changed with a value that supposed to send a notification
numericIdinteger · int64Optional
occurredstring · date-timeOptional
When this incident has really occurred
openDurationinteger · int64Optional
Duration incident was open
ownerstringOptional
The user who owns this incident
parentstringOptional
Parent
phasestringOptional
Phase
playbookIdstringOptional
The associated playbook for this incident
previousAllReadbooleanOptional
previousAllReadWritebooleanOptional
previousRolesstring[]Optional
Do not change this field manually
primaryTerminteger · int64Optional
rawCategorystringOptional
rawCloseReasonstringOptional
The reason for closing the incident (select from existing predefined values)
rawJSONstringOptional
rawNamestringOptional
Incident RawName
rawPhasestringOptional
RawPhase
rawTypestringOptional
Incident raw type
reasonstringOptional
The reason an incident was closed.
reminderstring · date-timeOptional
When if at all to send a reminder
rolesstring[]Optional
The role assigned to this investigation
runStatusstringOptional
RunStatus of a job
sequenceNumberinteger · int64Optional
severitynumber · doubleOptional
Severity is the incident severity
sizeInBytesinteger · int64Optional
slanumber · doubleOptional
SLAState is the incident sla at closure time, in minutes.
sortValuesstring[]Optional
sourceBrandstringOptional
SourceBrand ...
sourceInstancestringOptional
SourceInstance ...
statusnumber · double · max: 2Optional
IncidentStatus is the status of the incident
syncHashstringOptional
todoTaskIdsstring[]Optional
ToDoTaskIDs list of to do task ids
typestringOptional
Incident type
versioninteger · int64Optional
xsoarHasReadOnlyRolebooleanOptional
xsoarPreviousReadOnlyRolesstring[]Optional
xsoarReadOnlyRolesstring[]Optional
Responses
200
IncidentWrapper
application/json
IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client
ShardIDinteger · int64Optional
accountstringOptional
Account holds the tenant name so that slicing and dicing on the master can leverage bleve
activatedstring · date-timeOptional
When was this activated
activatingingUserIdstringOptional
The user that activated this investigation
allReadbooleanOptional
allReadWritebooleanOptional
autimeinteger · int64Optional
AlmostUniqueTime is an attempt to have a unique sortable ID for an incident
cacheVersninteger · int64Optional
canvasesstring[]Optional
Canvases of the incident
categorystringOptional
Category
changeStatusstringOptional
closeNotesstringOptional
Notes for closing the incident
closeReasonstringOptional
The reason for closing the incident (select from existing predefined values)
closedstring · date-timeOptional
When was this closed
closingUserIdstringOptional
The user ID that closed this investigation
createdstring · date-timeOptional
dbotCreatedBystringOptional
Who has created this event - relevant only for manual incidents
dbotCurrentDirtyFieldsstring[]Optional
For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration
dbotDirtyFieldsstring[]Optional
For mirroring, manage a list of dirty fields to not override them from the source of the incident
dbotMirrorDirectionstringOptional
DBotMirrorDirection of how to mirror the incident (in/out/both)
dbotMirrorIdstringOptional
DBotMirrorID of a remote system we are syncing with
dbotMirrorInstancestringOptional
DBotMirrorInstance name of a mirror integration instance
dbotMirrorLastSyncstring · date-timeOptional
The last time we synced this incident even if we did not update anything
dbotMirrorTagsstring[]Optional
The entry tags I want to sync to remote system
detailsstringOptional
The details of the incident - reason, etc.
droppedCountinteger · int64Optional
DroppedCount ...
dueDatestring · date-timeOptional
SLA
feedBasedbooleanOptional
If this incident was triggered by a feed job
hasRolebooleanOptional
Internal field to make queries on role faster
idstringOptional
indexNamestringOptional
insightsinteger · uint64Optional
investigationIdstringOptional
Investigation that was opened as a result of the incoming event
isDebugbooleanOptional
IsDebug ...
isPlaygroundbooleanOptional
IsPlayGround
lastJobRunTimestring · date-timeOptional
If this incident was triggered by a job, this would be the time the previous job started
lastOpenstring · date-timeOptional
linkedCountinteger · int64Optional
LinkedCount ...
linkedIncidentsstring[]Optional
LinkedIncidents incidents that were marked as linked by user
modifiedstring · date-timeOptional
namestringOptional
Incident Name - given by user
notifyTimestring · date-timeOptional
Incdicates when last this field was changed with a value that supposed to send a notification
numericIdinteger · int64Optional
occurredstring · date-timeOptional
When this incident has really occurred
openDurationinteger · int64Optional
Duration incident was open
ownerstringOptional
The user who owns this incident
parentstringOptional
Parent
phasestringOptional
Phase
playbookIdstringOptional
The associated playbook for this incident
previousAllReadbooleanOptional
previousAllReadWritebooleanOptional
previousRolesstring[]Optional
Do not change this field manually
primaryTerminteger · int64Optional
rawCategorystringOptional
rawCloseReasonstringOptional
The reason for closing the incident (select from existing predefined values)
rawJSONstringOptional
rawNamestringOptional
Incident RawName
rawPhasestringOptional
RawPhase
rawTypestringOptional
Incident raw type
reasonstringOptional
The reason for the resolve
reminderstring · date-timeOptional
When if at all to send a reminder
rolesstring[]Optional
The role assigned to this investigation
runStatusstringOptional
RunStatus of a job
sequenceNumberinteger · int64Optional
severitynumber · doubleOptional
Severity is the incident severity
sizeInBytesinteger · int64Optional
slanumber · doubleOptional
SLAState is the incident sla at closure time, in minutes.
sortValuesstring[]Optional
sourceBrandstringOptional
SourceBrand ...
sourceInstancestringOptional
SourceInstance ...
statusnumber · double · max: 2Optional
IncidentStatus is the status of the incident
syncHashstringOptional
todoTaskIdsstring[]Optional
ToDoTaskIDs list of to do task ids
typestringOptional
Incident type
versioninteger · int64Optional
xsoarHasReadOnlyRolebooleanOptional
xsoarPreviousReadOnlyRolesstring[]Optional
xsoarReadOnlyRolesstring[]Optional
post/incident
POST /incident HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1816
{
"ShardID": 1,
"account": "text",
"activated": "2026-01-01T00:00:00.000Z",
"activatingingUserId": "text",
"allRead": true,
"allReadWrite": true,
"autime": 1,
"cacheVersn": 1,
"canvases": [
"text"
],
"category": "text",
"closeNotes": "text",
"closeReason": "text",
"closed": "2026-01-01T00:00:00.000Z",
"closingUserId": "text",
"createInvestigation": true,
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"dbotCurrentDirtyFields": [
"text"
],
"dbotDirtyFields": [
"text"
],
"dbotMirrorDirection": "text",
"dbotMirrorId": "text",
"dbotMirrorInstance": "text",
"dbotMirrorLastSync": "2026-01-01T00:00:00.000Z",
"dbotMirrorTags": [
"text"
],
"details": "text",
"droppedCount": 1,
"dueDate": "2026-01-01T00:00:00.000Z",
"feedBased": true,
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"indexName": "text",
"investigationId": "text",
"isDebug": true,
"isPlayground": true,
"labels": [
{
"type": "text",
"value": "text"
}
],
"lastJobRunTime": "2026-01-01T00:00:00.000Z",
"lastOpen": "2026-01-01T00:00:00.000Z",
"linkedCount": 1,
"linkedIncidents": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"notifyTime": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"openDuration": 1,
"owner": "text",
"parent": "text",
"phase": "text",
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"rawCategory": "text",
"rawCloseReason": "text",
"rawJSON": "text",
"rawName": "text",
"rawPhase": "text",
"rawType": "text",
"reason": "text",
"reminder": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"runStatus": "text",
"sequenceNumber": 1,
"severity": 1,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"sourceBrand": "text",
"sourceInstance": "text",
"status": 1,
"syncHash": "text",
"todoTaskIds": [
"text"
],
"type": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}200
IncidentWrapper
{
"ShardID": 1,
"account": "text",
"activated": "2026-01-01T00:00:00.000Z",
"activatingingUserId": "text",
"allRead": true,
"allReadWrite": true,
"attachment": [
{
"description": "text",
"isTempPath": true,
"name": "text",
"path": "text",
"showMediaFile": true,
"type": "text"
}
],
"autime": 1,
"cacheVersn": 1,
"canvases": [
"text"
],
"category": "text",
"changeStatus": "text",
"closeNotes": "text",
"closeReason": "text",
"closed": "2026-01-01T00:00:00.000Z",
"closingUserId": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"dbotCurrentDirtyFields": [
"text"
],
"dbotDirtyFields": [
"text"
],
"dbotMirrorDirection": "text",
"dbotMirrorId": "text",
"dbotMirrorInstance": "text",
"dbotMirrorLastSync": "2026-01-01T00:00:00.000Z",
"dbotMirrorTags": [
"text"
],
"details": "text",
"droppedCount": 1,
"dueDate": "2026-01-01T00:00:00.000Z",
"feedBased": true,
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"insights": 1,
"investigationId": "text",
"isDebug": true,
"isPlayground": true,
"labels": [
{
"type": "text",
"value": "text"
}
],
"lastJobRunTime": "2026-01-01T00:00:00.000Z",
"lastOpen": "2026-01-01T00:00:00.000Z",
"linkedCount": 1,
"linkedIncidents": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"notifyTime": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"openDuration": 1,
"owner": "text",
"parent": "text",
"phase": "text",
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"rawCategory": "text",
"rawCloseReason": "text",
"rawJSON": "text",
"rawName": "text",
"rawPhase": "text",
"rawType": "text",
"reason": "text",
"reminder": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"runStatus": "text",
"sequenceNumber": 1,
"severity": 1,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"sourceBrand": "text",
"sourceInstance": "text",
"status": 1,
"syncHash": "text",
"todoTaskIds": [
"text"
],
"type": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}Update a batch of incidents. To update incident custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip To get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update
Authorizations
AuthorizationstringRequired
Body
allbooleanOptional
closeNotesstringOptional
closeReasonstringOptional
columnsstring[]Optional
forcebooleanOptional
idsstring[]Optional
linestringOptional
originalIncidentIdstringOptional
overrideInvestigationbooleanOptional
Responses
200Success
application/json
IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)
accountErrorsstring[]Optional
notUpdatedinteger · uint64Optional
searchAfterstring[]Optional
searchAfterElasticstring[]Optional
searchBeforestring[]Optional
searchBeforeElasticstring[]Optional
totalinteger · int64Optional
totalAccountsinteger · int64Optional
post/incident/batch
POST /incident/batch HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1668
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"all": true,
"closeNotes": "text",
"closeReason": "text",
"columns": [
"text"
],
"data": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"andOp": true,
"category": [
"text"
],
"details": "text",
"fields": [
"text"
],
"files": [
"text"
],
"filterobjectquery": "text",
"fromActivatedDate": "2026-01-01T00:00:00.000Z",
"fromClosedDate": "2026-01-01T00:00:00.000Z",
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"fromDueDate": "2026-01-01T00:00:00.000Z",
"fromReminder": "2026-01-01T00:00:00.000Z",
"id": [
"text"
],
"ignoreWorkers": true,
"includeTmp": true,
"investigation": [
"text"
],
"level": [
1
],
"name": [
"text"
],
"notCategory": [
"text"
],
"notInvestigation": [
"text"
],
"notStatus": [
1
],
"page": 1,
"parent": [
"text"
],
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"reason": [
"text"
],
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"status": [
1
],
"systems": [
"text"
],
"timeFrame": 1,
"toActivatedDate": "2026-01-01T00:00:00.000Z",
"toClosedDate": "2026-01-01T00:00:00.000Z",
"toDate": "2026-01-01T00:00:00.000Z",
"toDueDate": "2026-01-01T00:00:00.000Z",
"toReminder": "2026-01-01T00:00:00.000Z",
"totalOnly": true,
"trim_events": 1,
"type": [
"text"
],
"urls": [
"text"
],
"users": [
"text"
]
},
"force": true,
"ids": [
"text"
],
"line": "text",
"originalIncidentId": "text",
"overrideInvestigation": true
}200Success
{
"accountErrors": [
"text"
],
"data": [
{
"ShardID": 1,
"account": "text",
"activated": "2026-01-01T00:00:00.000Z",
"activatingingUserId": "text",
"allRead": true,
"allReadWrite": true,
"attachment": [
{
"description": "text",
"isTempPath": true,
"name": "text",
"path": "text",
"showMediaFile": true,
"type": "text"
}
],
"autime": 1,
"cacheVersn": 1,
"canvases": [
"text"
],
"category": "text",
"changeStatus": "text",
"closeNotes": "text",
"closeReason": "text",
"closed": "2026-01-01T00:00:00.000Z",
"closingUserId": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"dbotCurrentDirtyFields": [
"text"
],
"dbotDirtyFields": [
"text"
],
"dbotMirrorDirection": "text",
"dbotMirrorId": "text",
"dbotMirrorInstance": "text",
"dbotMirrorLastSync": "2026-01-01T00:00:00.000Z",
"dbotMirrorTags": [
"text"
],
"details": "text",
"droppedCount": 1,
"dueDate": "2026-01-01T00:00:00.000Z",
"feedBased": true,
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"insights": 1,
"investigationId": "text",
"isDebug": true,
"isPlayground": true,
"labels": [
{
"type": "text",
"value": "text"
}
],
"lastJobRunTime": "2026-01-01T00:00:00.000Z",
"lastOpen": "2026-01-01T00:00:00.000Z",
"linkedCount": 1,
"linkedIncidents": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"notifyTime": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"openDuration": 1,
"owner": "text",
"parent": "text",
"phase": "text",
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"rawCategory": "text",
"rawCloseReason": "text",
"rawJSON": "text",
"rawName": "text",
"rawPhase": "text",
"rawType": "text",
"reason": "text",
"reminder": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"runStatus": "text",
"sequenceNumber": 1,
"severity": 1,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"sourceBrand": "text",
"sourceInstance": "text",
"status": 1,
"syncHash": "text",
"todoTaskIds": [
"text"
],
"type": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
],
"notUpdated": 1,
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"total": 1,
"totalAccounts": 1
}Exports an incidents batch to CSV file (returns file ID)
Authorizations
AuthorizationstringRequired
Body
allbooleanOptional
closeNotesstringOptional
closeReasonstringOptional
columnsstring[]Optional
forcebooleanOptional
idsstring[]Optional
linestringOptional
originalIncidentIdstringOptional
overrideInvestigationbooleanOptional
Responses
200
csv file name
application/json
stringOptional
post/incident/batch/exportToCsv
POST /incident/batch/exportToCsv HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1668
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"all": true,
"closeNotes": "text",
"closeReason": "text",
"columns": [
"text"
],
"data": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"andOp": true,
"category": [
"text"
],
"details": "text",
"fields": [
"text"
],
"files": [
"text"
],
"filterobjectquery": "text",
"fromActivatedDate": "2026-01-01T00:00:00.000Z",
"fromClosedDate": "2026-01-01T00:00:00.000Z",
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"fromDueDate": "2026-01-01T00:00:00.000Z",
"fromReminder": "2026-01-01T00:00:00.000Z",
"id": [
"text"
],
"ignoreWorkers": true,
"includeTmp": true,
"investigation": [
"text"
],
"level": [
1
],
"name": [
"text"
],
"notCategory": [
"text"
],
"notInvestigation": [
"text"
],
"notStatus": [
1
],
"page": 1,
"parent": [
"text"
],
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"reason": [
"text"
],
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"status": [
1
],
"systems": [
"text"
],
"timeFrame": 1,
"toActivatedDate": "2026-01-01T00:00:00.000Z",
"toClosedDate": "2026-01-01T00:00:00.000Z",
"toDate": "2026-01-01T00:00:00.000Z",
"toDueDate": "2026-01-01T00:00:00.000Z",
"toReminder": "2026-01-01T00:00:00.000Z",
"totalOnly": true,
"trim_events": 1,
"type": [
"text"
],
"urls": [
"text"
],
"users": [
"text"
]
},
"force": true,
"ids": [
"text"
],
"line": "text",
"originalIncidentId": "text",
"overrideInvestigation": true
}200
csv file name
textCloses an incidents batch To update incident custom fields you should lowercase them and remove all spaces. For example: Scan IP -> scanip To get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update
Authorizations
AuthorizationstringRequired
Body
allbooleanOptional
closeNotesstringOptional
closeReasonstringOptional
columnsstring[]Optional
forcebooleanOptional
idsstring[]Optional
linestringOptional
originalIncidentIdstringOptional
overrideInvestigationbooleanOptional
Responses
200
IncidentSearchResponseWrapper
application/json
IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)
accountErrorsstring[]Optional
notUpdatedinteger · uint64Optional
searchAfterstring[]Optional
searchAfterElasticstring[]Optional
searchBeforestring[]Optional
searchBeforeElasticstring[]Optional
totalinteger · int64Optional
totalAccountsinteger · int64Optional
post/incident/batchClose
POST /incident/batchClose HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1668
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"all": true,
"closeNotes": "text",
"closeReason": "text",
"columns": [
"text"
],
"data": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"andOp": true,
"category": [
"text"
],
"details": "text",
"fields": [
"text"
],
"files": [
"text"
],
"filterobjectquery": "text",
"fromActivatedDate": "2026-01-01T00:00:00.000Z",
"fromClosedDate": "2026-01-01T00:00:00.000Z",
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"fromDueDate": "2026-01-01T00:00:00.000Z",
"fromReminder": "2026-01-01T00:00:00.000Z",
"id": [
"text"
],
"ignoreWorkers": true,
"includeTmp": true,
"investigation": [
"text"
],
"level": [
1
],
"name": [
"text"
],
"notCategory": [
"text"
],
"notInvestigation": [
"text"
],
"notStatus": [
1
],
"page": 1,
"parent": [
"text"
],
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"reason": [
"text"
],
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"status": [
1
],
"systems": [
"text"
],
"timeFrame": 1,
"toActivatedDate": "2026-01-01T00:00:00.000Z",
"toClosedDate": "2026-01-01T00:00:00.000Z",
"toDate": "2026-01-01T00:00:00.000Z",
"toDueDate": "2026-01-01T00:00:00.000Z",
"toReminder": "2026-01-01T00:00:00.000Z",
"totalOnly": true,
"trim_events": 1,
"type": [
"text"
],
"urls": [
"text"
],
"users": [
"text"
]
},
"force": true,
"ids": [
"text"
],
"line": "text",
"originalIncidentId": "text",
"overrideInvestigation": true
}200
IncidentSearchResponseWrapper
{
"accountErrors": [
"text"
],
"data": [
{
"ShardID": 1,
"account": "text",
"activated": "2026-01-01T00:00:00.000Z",
"activatingingUserId": "text",
"allRead": true,
"allReadWrite": true,
"attachment": [
{
"description": "text",
"isTempPath": true,
"name": "text",
"path": "text",
"showMediaFile": true,
"type": "text"
}
],
"autime": 1,
"cacheVersn": 1,
"canvases": [
"text"
],
"category": "text",
"changeStatus": "text",
"closeNotes": "text",
"closeReason": "text",
"closed": "2026-01-01T00:00:00.000Z",
"closingUserId": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"dbotCurrentDirtyFields": [
"text"
],
"dbotDirtyFields": [
"text"
],
"dbotMirrorDirection": "text",
"dbotMirrorId": "text",
"dbotMirrorInstance": "text",
"dbotMirrorLastSync": "2026-01-01T00:00:00.000Z",
"dbotMirrorTags": [
"text"
],
"details": "text",
"droppedCount": 1,
"dueDate": "2026-01-01T00:00:00.000Z",
"feedBased": true,
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"insights": 1,
"investigationId": "text",
"isDebug": true,
"isPlayground": true,
"labels": [
{
"type": "text",
"value": "text"
}
],
"lastJobRunTime": "2026-01-01T00:00:00.000Z",
"lastOpen": "2026-01-01T00:00:00.000Z",
"linkedCount": 1,
"linkedIncidents": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"notifyTime": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"openDuration": 1,
"owner": "text",
"parent": "text",
"phase": "text",
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"rawCategory": "text",
"rawCloseReason": "text",
"rawJSON": "text",
"rawName": "text",
"rawPhase": "text",
"rawType": "text",
"reason": "text",
"reminder": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"runStatus": "text",
"sequenceNumber": 1,
"severity": 1,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"sourceBrand": "text",
"sourceInstance": "text",
"status": 1,
"syncHash": "text",
"todoTaskIds": [
"text"
],
"type": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
],
"notUpdated": 1,
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"total": 1,
"totalAccounts": 1
}Deletes an incidents batch
Authorizations
AuthorizationstringRequired
Body
allbooleanOptional
closeNotesstringOptional
closeReasonstringOptional
columnsstring[]Optional
forcebooleanOptional
idsstring[]Optional
linestringOptional
originalIncidentIdstringOptional
overrideInvestigationbooleanOptional
Responses
200
IncidentSearchResponseWrapper
application/json
IncidentSearchResponseWrapper is an extension for the IncidentSearchResponse type, which holds list of IncidentWrapper(s)
accountErrorsstring[]Optional
notUpdatedinteger · uint64Optional
searchAfterstring[]Optional
searchAfterElasticstring[]Optional
searchBeforestring[]Optional
searchBeforeElasticstring[]Optional
totalinteger · int64Optional
totalAccountsinteger · int64Optional
post/incident/batchDelete
POST /incident/batchDelete HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1668
{
"CustomFields": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"all": true,
"closeNotes": "text",
"closeReason": "text",
"columns": [
"text"
],
"data": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"andOp": true,
"category": [
"text"
],
"details": "text",
"fields": [
"text"
],
"files": [
"text"
],
"filterobjectquery": "text",
"fromActivatedDate": "2026-01-01T00:00:00.000Z",
"fromClosedDate": "2026-01-01T00:00:00.000Z",
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"fromDueDate": "2026-01-01T00:00:00.000Z",
"fromReminder": "2026-01-01T00:00:00.000Z",
"id": [
"text"
],
"ignoreWorkers": true,
"includeTmp": true,
"investigation": [
"text"
],
"level": [
1
],
"name": [
"text"
],
"notCategory": [
"text"
],
"notInvestigation": [
"text"
],
"notStatus": [
1
],
"page": 1,
"parent": [
"text"
],
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"reason": [
"text"
],
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"status": [
1
],
"systems": [
"text"
],
"timeFrame": 1,
"toActivatedDate": "2026-01-01T00:00:00.000Z",
"toClosedDate": "2026-01-01T00:00:00.000Z",
"toDate": "2026-01-01T00:00:00.000Z",
"toDueDate": "2026-01-01T00:00:00.000Z",
"toReminder": "2026-01-01T00:00:00.000Z",
"totalOnly": true,
"trim_events": 1,
"type": [
"text"
],
"urls": [
"text"
],
"users": [
"text"
]
},
"force": true,
"ids": [
"text"
],
"line": "text",
"originalIncidentId": "text",
"overrideInvestigation": true
}200
IncidentSearchResponseWrapper
{
"accountErrors": [
"text"
],
"data": [
{
"ShardID": 1,
"account": "text",
"activated": "2026-01-01T00:00:00.000Z",
"activatingingUserId": "text",
"allRead": true,
"allReadWrite": true,
"attachment": [
{
"description": "text",
"isTempPath": true,
"name": "text",
"path": "text",
"showMediaFile": true,
"type": "text"
}
],
"autime": 1,
"cacheVersn": 1,
"canvases": [
"text"
],
"category": "text",
"changeStatus": "text",
"closeNotes": "text",
"closeReason": "text",
"closed": "2026-01-01T00:00:00.000Z",
"closingUserId": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"dbotCurrentDirtyFields": [
"text"
],
"dbotDirtyFields": [
"text"
],
"dbotMirrorDirection": "text",
"dbotMirrorId": "text",
"dbotMirrorInstance": "text",
"dbotMirrorLastSync": "2026-01-01T00:00:00.000Z",
"dbotMirrorTags": [
"text"
],
"details": "text",
"droppedCount": 1,
"dueDate": "2026-01-01T00:00:00.000Z",
"feedBased": true,
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"insights": 1,
"investigationId": "text",
"isDebug": true,
"isPlayground": true,
"labels": [
{
"type": "text",
"value": "text"
}
],
"lastJobRunTime": "2026-01-01T00:00:00.000Z",
"lastOpen": "2026-01-01T00:00:00.000Z",
"linkedCount": 1,
"linkedIncidents": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"notifyTime": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"openDuration": 1,
"owner": "text",
"parent": "text",
"phase": "text",
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"rawCategory": "text",
"rawCloseReason": "text",
"rawJSON": "text",
"rawName": "text",
"rawPhase": "text",
"rawType": "text",
"reason": "text",
"reminder": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"runStatus": "text",
"sequenceNumber": 1,
"severity": 1,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"sourceBrand": "text",
"sourceInstance": "text",
"status": 1,
"syncHash": "text",
"todoTaskIds": [
"text"
],
"type": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
],
"notUpdated": 1,
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"total": 1,
"totalAccounts": 1
}Get an incident CSV file that was exported, by ID
Authorizations
AuthorizationstringRequired
Path parameters
idstringRequired
CSV file to fetch (returned from batch export to csv call)
Responses
200
Return Csv file
No content
get/incident/csv/{id}
GET /incident/csv/{id} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
200
Return Csv file
No content
Create single incident from raw JSON, builds incident according to default mapping
Authorizations
AuthorizationstringRequired
Responses
201
Created
application/json
IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client
ShardIDinteger · int64Optional
accountstringOptional
Account holds the tenant name so that slicing and dicing on the master can leverage bleve
activatedstring · date-timeOptional
When was this activated
activatingingUserIdstringOptional
The user that activated this investigation
allReadbooleanOptional
allReadWritebooleanOptional
autimeinteger · int64Optional
AlmostUniqueTime is an attempt to have a unique sortable ID for an incident
cacheVersninteger · int64Optional
canvasesstring[]Optional
Canvases of the incident
categorystringOptional
Category
changeStatusstringOptional
closeNotesstringOptional
Notes for closing the incident
closeReasonstringOptional
The reason for closing the incident (select from existing predefined values)
closedstring · date-timeOptional
When was this closed
closingUserIdstringOptional
The user ID that closed this investigation
createdstring · date-timeOptional
dbotCreatedBystringOptional
Who has created this event - relevant only for manual incidents
dbotCurrentDirtyFieldsstring[]Optional
For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration
dbotDirtyFieldsstring[]Optional
For mirroring, manage a list of dirty fields to not override them from the source of the incident
dbotMirrorDirectionstringOptional
DBotMirrorDirection of how to mirror the incident (in/out/both)
dbotMirrorIdstringOptional
DBotMirrorID of a remote system we are syncing with
dbotMirrorInstancestringOptional
DBotMirrorInstance name of a mirror integration instance
dbotMirrorLastSyncstring · date-timeOptional
The last time we synced this incident even if we did not update anything
dbotMirrorTagsstring[]Optional
The entry tags I want to sync to remote system
detailsstringOptional
The details of the incident - reason, etc.
droppedCountinteger · int64Optional
DroppedCount ...
dueDatestring · date-timeOptional
SLA
feedBasedbooleanOptional
If this incident was triggered by a feed job
hasRolebooleanOptional
Internal field to make queries on role faster
idstringOptional
indexNamestringOptional
insightsinteger · uint64Optional
investigationIdstringOptional
Investigation that was opened as a result of the incoming event
isDebugbooleanOptional
IsDebug ...
isPlaygroundbooleanOptional
IsPlayGround
lastJobRunTimestring · date-timeOptional
If this incident was triggered by a job, this would be the time the previous job started
lastOpenstring · date-timeOptional
linkedCountinteger · int64Optional
LinkedCount ...
linkedIncidentsstring[]Optional
LinkedIncidents incidents that were marked as linked by user
modifiedstring · date-timeOptional
namestringOptional
Incident Name - given by user
notifyTimestring · date-timeOptional
Incdicates when last this field was changed with a value that supposed to send a notification
numericIdinteger · int64Optional
occurredstring · date-timeOptional
When this incident has really occurred
openDurationinteger · int64Optional
Duration incident was open
ownerstringOptional
The user who owns this incident
parentstringOptional
Parent
phasestringOptional
Phase
playbookIdstringOptional
The associated playbook for this incident
previousAllReadbooleanOptional
previousAllReadWritebooleanOptional
previousRolesstring[]Optional
Do not change this field manually
primaryTerminteger · int64Optional
rawCategorystringOptional
rawCloseReasonstringOptional
The reason for closing the incident (select from existing predefined values)
rawJSONstringOptional
rawNamestringOptional
Incident RawName
rawPhasestringOptional
RawPhase
rawTypestringOptional
Incident raw type
reasonstringOptional
The reason for the resolve
reminderstring · date-timeOptional
When if at all to send a reminder
rolesstring[]Optional
The role assigned to this investigation
runStatusstringOptional
RunStatus of a job
sequenceNumberinteger · int64Optional
severitynumber · doubleOptional
Severity is the incident severity
sizeInBytesinteger · int64Optional
slanumber · doubleOptional
SLAState is the incident sla at closure time, in minutes.
sortValuesstring[]Optional
sourceBrandstringOptional
SourceBrand ...
sourceInstancestringOptional
SourceInstance ...
statusnumber · double · max: 2Optional
IncidentStatus is the status of the incident
syncHashstringOptional
todoTaskIdsstring[]Optional
ToDoTaskIDs list of to do task ids
typestringOptional
Incident type
versioninteger · int64Optional
xsoarHasReadOnlyRolebooleanOptional
xsoarPreviousReadOnlyRolesstring[]Optional
xsoarReadOnlyRolesstring[]Optional
post/incident/json
POST /incident/json HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Accept: */*
201
Created
{
"ShardID": 1,
"account": "text",
"activated": "2026-01-01T00:00:00.000Z",
"activatingingUserId": "text",
"allRead": true,
"allReadWrite": true,
"attachment": [
{
"description": "text",
"isTempPath": true,
"name": "text",
"path": "text",
"showMediaFile": true,
"type": "text"
}
],
"autime": 1,
"cacheVersn": 1,
"canvases": [
"text"
],
"category": "text",
"changeStatus": "text",
"closeNotes": "text",
"closeReason": "text",
"closed": "2026-01-01T00:00:00.000Z",
"closingUserId": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"dbotCurrentDirtyFields": [
"text"
],
"dbotDirtyFields": [
"text"
],
"dbotMirrorDirection": "text",
"dbotMirrorId": "text",
"dbotMirrorInstance": "text",
"dbotMirrorLastSync": "2026-01-01T00:00:00.000Z",
"dbotMirrorTags": [
"text"
],
"details": "text",
"droppedCount": 1,
"dueDate": "2026-01-01T00:00:00.000Z",
"feedBased": true,
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"insights": 1,
"investigationId": "text",
"isDebug": true,
"isPlayground": true,
"labels": [
{
"type": "text",
"value": "text"
}
],
"lastJobRunTime": "2026-01-01T00:00:00.000Z",
"lastOpen": "2026-01-01T00:00:00.000Z",
"linkedCount": 1,
"linkedIncidents": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"notifyTime": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"openDuration": 1,
"owner": "text",
"parent": "text",
"phase": "text",
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"rawCategory": "text",
"rawCloseReason": "text",
"rawJSON": "text",
"rawName": "text",
"rawPhase": "text",
"rawType": "text",
"reason": "text",
"reminder": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"runStatus": "text",
"sequenceNumber": 1,
"severity": 1,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"sourceBrand": "text",
"sourceInstance": "text",
"status": 1,
"syncHash": "text",
"todoTaskIds": [
"text"
],
"type": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}post
Add file attachement to an incidents
Authorizations
AuthorizationstringRequired
Path parameters
idstringRequired
Incident id to update
Body
fileNamestringOptional
file name
fileCommentstringOptional
file comment
fieldstringOptional
field name to hold the attachment details. If not specified, attachment will be used.
showMediaFilebooleanOptional
show media file
lastbooleanOptional
If set to true will create an investigation. Used for uploading after creating incident.
filestringOptional
file
Responses
200
IncidentWrapper
application/json
IncidentWrapper is an extension of the Incident entity, which includes an additional field of changed-status for the web client
ShardIDinteger · int64Optional
accountstringOptional
Account holds the tenant name so that slicing and dicing on the master can leverage bleve
activatedstring · date-timeOptional
When was this activated
activatingingUserIdstringOptional
The user that activated this investigation
allReadbooleanOptional
allReadWritebooleanOptional
autimeinteger · int64Optional
AlmostUniqueTime is an attempt to have a unique sortable ID for an incident
cacheVersninteger · int64Optional
canvasesstring[]Optional
Canvases of the incident
categorystringOptional
Category
changeStatusstringOptional
closeNotesstringOptional
Notes for closing the incident
closeReasonstringOptional
The reason for closing the incident (select from existing predefined values)
closedstring · date-timeOptional
When was this closed
closingUserIdstringOptional
The user ID that closed this investigation
createdstring · date-timeOptional
dbotCreatedBystringOptional
Who has created this event - relevant only for manual incidents
dbotCurrentDirtyFieldsstring[]Optional
For mirroring, manage a list of current dirty fields so that we can send delta to outgoing integration
dbotDirtyFieldsstring[]Optional
For mirroring, manage a list of dirty fields to not override them from the source of the incident
dbotMirrorDirectionstringOptional
DBotMirrorDirection of how to mirror the incident (in/out/both)
dbotMirrorIdstringOptional
DBotMirrorID of a remote system we are syncing with
dbotMirrorInstancestringOptional
DBotMirrorInstance name of a mirror integration instance
dbotMirrorLastSyncstring · date-timeOptional
The last time we synced this incident even if we did not update anything
dbotMirrorTagsstring[]Optional
The entry tags I want to sync to remote system
detailsstringOptional
The details of the incident - reason, etc.
droppedCountinteger · int64Optional
DroppedCount ...
dueDatestring · date-timeOptional
SLA
feedBasedbooleanOptional
If this incident was triggered by a feed job
hasRolebooleanOptional
Internal field to make queries on role faster
idstringOptional
indexNamestringOptional
insightsinteger · uint64Optional
investigationIdstringOptional
Investigation that was opened as a result of the incoming event
isDebugbooleanOptional
IsDebug ...
isPlaygroundbooleanOptional
IsPlayGround
lastJobRunTimestring · date-timeOptional
If this incident was triggered by a job, this would be the time the previous job started
lastOpenstring · date-timeOptional
linkedCountinteger · int64Optional
LinkedCount ...
linkedIncidentsstring[]Optional
LinkedIncidents incidents that were marked as linked by user
modifiedstring · date-timeOptional
namestringOptional
Incident Name - given by user
notifyTimestring · date-timeOptional
Incdicates when last this field was changed with a value that supposed to send a notification
numericIdinteger · int64Optional
occurredstring · date-timeOptional
When this incident has really occurred
openDurationinteger · int64Optional
Duration incident was open
ownerstringOptional
The user who owns this incident
parentstringOptional
Parent
phasestringOptional
Phase
playbookIdstringOptional
The associated playbook for this incident
previousAllReadbooleanOptional
previousAllReadWritebooleanOptional
previousRolesstring[]Optional
Do not change this field manually
primaryTerminteger · int64Optional
rawCategorystringOptional
rawCloseReasonstringOptional
The reason for closing the incident (select from existing predefined values)
rawJSONstringOptional
rawNamestringOptional
Incident RawName
rawPhasestringOptional
RawPhase
rawTypestringOptional
Incident raw type
reasonstringOptional
The reason for the resolve
reminderstring · date-timeOptional
When if at all to send a reminder
rolesstring[]Optional
The role assigned to this investigation
runStatusstringOptional
RunStatus of a job
sequenceNumberinteger · int64Optional
severitynumber · doubleOptional
Severity is the incident severity
sizeInBytesinteger · int64Optional
slanumber · doubleOptional
SLAState is the incident sla at closure time, in minutes.
sortValuesstring[]Optional
sourceBrandstringOptional
SourceBrand ...
sourceInstancestringOptional
SourceInstance ...
statusnumber · double · max: 2Optional
IncidentStatus is the status of the incident
syncHashstringOptional
todoTaskIdsstring[]Optional
ToDoTaskIDs list of to do task ids
typestringOptional
Incident type
versioninteger · int64Optional
xsoarHasReadOnlyRolebooleanOptional
xsoarPreviousReadOnlyRolesstring[]Optional
xsoarReadOnlyRolesstring[]Optional
post/incident/upload/{id}
POST /incident/upload/{id} HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: multipart/form-data
Accept: */*
Content-Length: 102
{
"fileName": "text",
"fileComment": "text",
"field": "text",
"showMediaFile": true,
"last": true,
"file": "text"
}200
IncidentWrapper
{
"ShardID": 1,
"account": "text",
"activated": "2026-01-01T00:00:00.000Z",
"activatingingUserId": "text",
"allRead": true,
"allReadWrite": true,
"attachment": [
{
"description": "text",
"isTempPath": true,
"name": "text",
"path": "text",
"showMediaFile": true,
"type": "text"
}
],
"autime": 1,
"cacheVersn": 1,
"canvases": [
"text"
],
"category": "text",
"changeStatus": "text",
"closeNotes": "text",
"closeReason": "text",
"closed": "2026-01-01T00:00:00.000Z",
"closingUserId": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"dbotCurrentDirtyFields": [
"text"
],
"dbotDirtyFields": [
"text"
],
"dbotMirrorDirection": "text",
"dbotMirrorId": "text",
"dbotMirrorInstance": "text",
"dbotMirrorLastSync": "2026-01-01T00:00:00.000Z",
"dbotMirrorTags": [
"text"
],
"details": "text",
"droppedCount": 1,
"dueDate": "2026-01-01T00:00:00.000Z",
"feedBased": true,
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"insights": 1,
"investigationId": "text",
"isDebug": true,
"isPlayground": true,
"labels": [
{
"type": "text",
"value": "text"
}
],
"lastJobRunTime": "2026-01-01T00:00:00.000Z",
"lastOpen": "2026-01-01T00:00:00.000Z",
"linkedCount": 1,
"linkedIncidents": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"notifyTime": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"openDuration": 1,
"owner": "text",
"parent": "text",
"phase": "text",
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"rawCategory": "text",
"rawCloseReason": "text",
"rawJSON": "text",
"rawName": "text",
"rawPhase": "text",
"rawType": "text",
"reason": "text",
"reminder": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"runStatus": "text",
"sequenceNumber": 1,
"severity": 1,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"sourceBrand": "text",
"sourceInstance": "text",
"status": 1,
"syncHash": "text",
"todoTaskIds": [
"text"
],
"type": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}Search incidents across all indices. You can filter by multiple options.
Note: You cannot paginate results in a multi-tenant environment.
Authorizations
AuthorizationstringRequired
Body
userFilterbooleanOptional
Responses
200
incidentSearchResponse
application/json
totalintegerOptional
post/incidents/search
POST /incidents/search HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1432
{
"filter": {
"Cache": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"accounts": {
"ANY_ADDITIONAL_PROPERTY": {}
},
"andOp": true,
"category": [
"text"
],
"details": "text",
"fields": [
"text"
],
"files": [
"text"
],
"filterobjectquery": "text",
"fromActivatedDate": "2026-01-01T00:00:00.000Z",
"fromClosedDate": "2026-01-01T00:00:00.000Z",
"fromDate": "2026-01-01T00:00:00.000Z",
"fromDateLicense": "2026-01-01T00:00:00.000Z",
"fromDueDate": "2026-01-01T00:00:00.000Z",
"fromReminder": "2026-01-01T00:00:00.000Z",
"id": [
"text"
],
"ignoreWorkers": true,
"includeTmp": true,
"investigation": [
"text"
],
"level": [
1
],
"name": [
"text"
],
"notCategory": [
"text"
],
"notInvestigation": [
"text"
],
"notStatus": [
1
],
"page": 1,
"parent": [
"text"
],
"period": {
"by": "text",
"byFrom": "text",
"byTo": "text",
"field": "text",
"fromValue": "text",
"toValue": "text"
},
"query": "text",
"reason": [
"text"
],
"searchAfter": [
"text"
],
"searchAfterElastic": [
"text"
],
"searchAfterMap": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"searchAfterMapOrder": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"searchBefore": [
"text"
],
"searchBeforeElastic": [
"text"
],
"size": 1,
"sort": [
{
"asc": true,
"field": "text",
"fieldType": "text"
}
],
"status": [
1
],
"systems": [
"text"
],
"timeFrame": 1,
"toActivatedDate": "2026-01-01T00:00:00.000Z",
"toClosedDate": "2026-01-01T00:00:00.000Z",
"toDate": "2026-01-01T00:00:00.000Z",
"toDueDate": "2026-01-01T00:00:00.000Z",
"toReminder": "2026-01-01T00:00:00.000Z",
"totalOnly": true,
"trim_events": 1,
"type": [
"text"
],
"urls": [
"text"
],
"users": [
"text"
]
},
"userFilter": true
}200
incidentSearchResponse
{
"data": [
{
"ShardID": 1,
"account": "text",
"activated": "2026-01-01T00:00:00.000Z",
"activatingingUserId": "text",
"allRead": true,
"allReadWrite": true,
"attachment": [
{
"description": "text",
"isTempPath": true,
"name": "text",
"path": "text",
"showMediaFile": true,
"type": "text"
}
],
"autime": 1,
"cacheVersn": 1,
"canvases": [
"text"
],
"category": "text",
"closeNotes": "text",
"closeReason": "text",
"closed": "2026-01-01T00:00:00.000Z",
"closingUserId": "text",
"created": "2026-01-01T00:00:00.000Z",
"dbotCreatedBy": "text",
"dbotCurrentDirtyFields": [
"text"
],
"dbotDirtyFields": [
"text"
],
"dbotMirrorDirection": "text",
"dbotMirrorId": "text",
"dbotMirrorInstance": "text",
"dbotMirrorLastSync": "2026-01-01T00:00:00.000Z",
"dbotMirrorTags": [
"text"
],
"details": "text",
"droppedCount": 1,
"dueDate": "2026-01-01T00:00:00.000Z",
"feedBased": true,
"hasRole": true,
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"id": "text",
"indexName": "text",
"investigationId": "text",
"isDebug": true,
"isPlayground": true,
"labels": [
{
"type": "text",
"value": "text"
}
],
"lastJobRunTime": "2026-01-01T00:00:00.000Z",
"lastOpen": "2026-01-01T00:00:00.000Z",
"linkedCount": 1,
"linkedIncidents": [
"text"
],
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"notifyTime": "2026-01-01T00:00:00.000Z",
"numericId": 1,
"occurred": "2026-01-01T00:00:00.000Z",
"openDuration": 1,
"owner": "text",
"parent": "text",
"phase": "text",
"playbookId": "text",
"previousAllRead": true,
"previousAllReadWrite": true,
"previousRoles": [
"text"
],
"primaryTerm": 1,
"rawCategory": "text",
"rawCloseReason": "text",
"rawJSON": "text",
"rawName": "text",
"rawPhase": "text",
"rawType": "text",
"reason": "text",
"reminder": "2026-01-01T00:00:00.000Z",
"roles": [
"text"
],
"runStatus": "text",
"sequenceNumber": 1,
"severity": 1,
"sizeInBytes": 1,
"sla": 1,
"sortValues": [
"text"
],
"sourceBrand": "text",
"sourceInstance": "text",
"status": 1,
"syncHash": "text",
"todoTaskIds": [
"text"
],
"type": "text",
"version": 1,
"xsoarHasReadOnlyRole": true,
"xsoarPreviousReadOnlyRoles": [
"text"
],
"xsoarReadOnlyRoles": [
"text"
]
}
],
"total": 1
}API to create new Incident Type
Authorizations
AuthorizationstringRequired
Body
autorunbooleanOptional
cacheVersninteger · int64Optional
closureScriptstringOptional
colorstringOptional
commitMessagestringOptional
createdstring · date-timeOptional
daysinteger · int64Optional
daysRinteger · int64Optional
defaultbooleanOptional
definitionIdstringOptional
detachedbooleanOptional
disabledbooleanOptional
hoursinteger · int64Optional
hoursRinteger · int64Optional
idstringOptional
indexNamestringOptional
layoutstringOptional
lockedbooleanOptional
modifiedstring · date-timeOptional
namestringOptional
numericIdinteger · int64Optional
onChangeRepAlgnumber · doubleOptional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
playbookIdstringOptional
preProcessingScriptstringOptional
prevNamestringOptional
primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
readonlybooleanOptional
remotebooleanOptional
reputationCalcnumber · doubleOptional
sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeInBytesinteger · int64Optional
slainteger · int64Optional
slaReminderinteger · int64Optional
sortValuesstring[]Optional
syncHashstringOptional
systembooleanOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
weeksinteger · int64Optional
weeksRinteger · int64Optional
Responses
200
IncidentType
application/json
autorunbooleanOptional
cacheVersninteger · int64Optional
closureScriptstringOptional
colorstringOptional
commitMessagestringOptional
createdstring · date-timeOptional
daysinteger · int64Optional
daysRinteger · int64Optional
defaultbooleanOptional
definitionIdstringOptional
detachedbooleanOptional
disabledbooleanOptional
hoursinteger · int64Optional
hoursRinteger · int64Optional
idstringOptional
indexNamestringOptional
layoutstringOptional
lockedbooleanOptional
modifiedstring · date-timeOptional
namestringOptional
numericIdinteger · int64Optional
onChangeRepAlgnumber · doubleOptional
packIDstringOptional
packNamestringOptional
packPropagationLabelsstring[]Optional
playbookIdstringOptional
preProcessingScriptstringOptional
prevNamestringOptional
primaryTerminteger · int64Optional
propagationLabelsstring[]Optional
readonlybooleanOptional
remotebooleanOptional
reputationCalcnumber · doubleOptional
sequenceNumberinteger · int64Optional
shouldCommitbooleanOptional
sizeInBytesinteger · int64Optional
slainteger · int64Optional
slaReminderinteger · int64Optional
sortValuesstring[]Optional
syncHashstringOptional
systembooleanOptional
vcShouldIgnorebooleanOptional
vcShouldKeepItemLegacyProdMachinebooleanOptional
versioninteger · int64Optional
weeksinteger · int64Optional
weeksRinteger · int64Optional
post/incidenttype
POST /incidenttype HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 1237
{
"autorun": true,
"cacheVersn": 1,
"closureScript": "text",
"color": "text",
"commitMessage": "text",
"created": "2026-01-01T00:00:00.000Z",
"days": 1,
"daysR": 1,
"default": true,
"definitionId": "text",
"detached": true,
"disabled": true,
"extractSettings": {
"fieldCliNameToExtractSettings": {
"ANY_ADDITIONAL_PROPERTY": {
"extractAsIsIndicatorTypeId": "text",
"extractIndicatorTypesIDs": [
"text"
],
"isExtractingAllIndicatorTypes": true
}
},
"mode": "text"
},
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"hours": 1,
"hoursR": 1,
"id": "text",
"indexName": "text",
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"layout": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"onChangeRepAlg": 1,
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"playbookId": "text",
"preProcessingScript": "text",
"prevName": "text",
"primaryTerm": 1,
"propagationLabels": [
"text"
],
"readonly": true,
"remote": true,
"reputationCalc": 1,
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sla": 1,
"slaReminder": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"system": true,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"weeks": 1,
"weeksR": 1
}200
IncidentType
{
"autorun": true,
"cacheVersn": 1,
"closureScript": "text",
"color": "text",
"commitMessage": "text",
"created": "2026-01-01T00:00:00.000Z",
"days": 1,
"daysR": 1,
"default": true,
"definitionId": "text",
"detached": true,
"disabled": true,
"extractSettings": {
"fieldCliNameToExtractSettings": {
"ANY_ADDITIONAL_PROPERTY": {
"extractAsIsIndicatorTypeId": "text",
"extractIndicatorTypesIDs": [
"text"
],
"isExtractingAllIndicatorTypes": true
}
},
"mode": "text"
},
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"hours": 1,
"hoursR": 1,
"id": "text",
"indexName": "text",
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"layout": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"onChangeRepAlg": 1,
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"playbookId": "text",
"preProcessingScript": "text",
"prevName": "text",
"primaryTerm": 1,
"propagationLabels": [
"text"
],
"readonly": true,
"remote": true,
"reputationCalc": 1,
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sla": 1,
"slaReminder": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"system": true,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"weeks": 1,
"weeksR": 1
}Import an incident type to Cortex XSOAR.
Authorizations
AuthorizationstringRequired
Body
filestringOptional
file
Responses
200
The saved incident type
application/json
errorstringOptional
post/incidenttypes/import
POST /incidenttypes/import HTTP/1.1
Host: hostname
Authorization: YOUR_API_KEY
Content-Type: multipart/form-data
Accept: */*
Content-Length: 15
{
"file": "text"
}200
The saved incident type
{
"error": "text",
"incidentTypes": [
{
"autorun": true,
"cacheVersn": 1,
"closureScript": "text",
"color": "text",
"commitMessage": "text",
"created": "2026-01-01T00:00:00.000Z",
"days": 1,
"daysR": 1,
"default": true,
"definitionId": "text",
"detached": true,
"disabled": true,
"extractSettings": {
"fieldCliNameToExtractSettings": {
"ANY_ADDITIONAL_PROPERTY": {
"extractAsIsIndicatorTypeId": "text",
"extractIndicatorTypesIDs": [
"text"
],
"isExtractingAllIndicatorTypes": true
}
},
"mode": "text"
},
"fromServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"highlight": {
"ANY_ADDITIONAL_PROPERTY": [
"text"
]
},
"hours": 1,
"hoursR": 1,
"id": "text",
"indexName": "text",
"itemVersion": {
"Digits": [
1
],
"Label": "text"
},
"layout": "text",
"locked": true,
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"numericId": 1,
"onChangeRepAlg": 1,
"packID": "text",
"packName": "text",
"packPropagationLabels": [
"text"
],
"playbookId": "text",
"preProcessingScript": "text",
"prevName": "text",
"primaryTerm": 1,
"propagationLabels": [
"text"
],
"readonly": true,
"remote": true,
"reputationCalc": 1,
"sequenceNumber": 1,
"shouldCommit": true,
"sizeInBytes": 1,
"sla": 1,
"slaReminder": 1,
"sortValues": [
"text"
],
"syncHash": "text",
"system": true,
"toServerVersion": {
"Digits": [
1
],
"Label": "text"
},
"vcShouldIgnore": true,
"vcShouldKeepItemLegacyProdMachine": true,
"version": 1,
"weeks": 1,
"weeksR": 1
}
]
}Last updated
Was this helpful?