The Patch Incident API updates an existing incident (based on incident ID).

​
Parameters

ParameterDescription
Assignee IDID of the entity assigned to this incident.
Incident IDUnique ID of the incident.
SeverityThe severity of the incident (Low, Medium, High or Critical).
StatusThe status of the incident (Open, InProgress, WaitingForInput, or Closed).

​
Example Output

{
	"data": {
		"apps": [],
		"assignee": {
			"userEmail": "Email",
			"userFirstName": "First Name",
			"userId": "Unique ID",
			"userLastName": "Last Name"
		},
		"assigneeId": "Unique id of assignee.",
		"category": "An enumeration.",
		"compliance": [],
		"createdAt": "The date the incident was first reported.",
		"description": "Description",
		"entities": [],
		"id": "Unique id",
		"isResolved": false,
		"policy": {
			"id": "Unique id of policy.",
			"name": "Name of policy.",
			"templateId": "Template ID"
		},
		"policyId": "Unique id of policy.",
		"recommendation": "Recommendation",
		"severity": "An enumeration.",
		"status": "An enumeration.",
		"tactics": [],
		"techniques": [],
		"updatedAt": "The date the incident was last updated.",
		"url": "URL"
	}
}

​
Workflow Library Example

Update Incident with Authomize and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop