Skip to main content

Update Incident

The Patch Incident API updates an existing incident (based on incident ID).


Assignee IDID of the entity assigned to this incident.
Incident IDUnique ID of the incident.
SeverityThe severity of the incident (Low, Medium, High or Critical).
StatusThe status of the incident (Open, InProgress, WaitingForInput, or Closed).

Example Output

"data": {
"apps": [],
"assignee": {
"userEmail": "Email",
"userFirstName": "First Name",
"userId": "Unique ID",
"userLastName": "Last Name"
"assigneeId": "Unique id of assignee.",
"category": "An enumeration.",
"compliance": [],
"createdAt": "The date the incident was first reported.",
"description": "Description",
"entities": [],
"id": "Unique id",
"isResolved": false,
"policy": {
"id": "Unique id of policy.",
"name": "Name of policy.",
"templateId": "Template ID"
"policyId": "Unique id of policy.",
"recommendation": "Recommendation",
"severity": "An enumeration.",
"status": "An enumeration.",
"tactics": [],
"techniques": [],
"updatedAt": "The date the incident was last updated.",
"url": "URL"

Workflow Library Example

Update Incident with Authomize and Send Results Via Email

Workflow LibraryPreview this Workflow on desktop