Create Incident

post

https://{hostname}/api/incident/v1/incidents

Use this API to create a new incident in the Incident Register by providing the necessary details in the request body. The response will return the unique identifier (UUID) of the newly created incident.

Body Params

name

string

required

Name of the incident.
Provide a descriptive name to the incident so that it can be quickly referenced in the incident register.

description

string

Brief description of the incident.

incidentTypeName

string

required

Defaults to Unknown

The name of the type of incident that has occurred.

orgGroupId

uuid

required

Incident Organization ID.
This can be retrieved from the Get List of Organizations API.

dateOccurred

date-time

The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC.

dateDiscovered

date-time

The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC.

deadline

date-time

The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC.

sourceType

string

enum

Defaults to MANUAL

Creation Source

Allowed:

rootCause

string

The root cause summary of the incident.

notificationNeeded

string

enum

Defaults to UNKNOWN

Indicates whether a notification is required for this incident either to an authority or affected individuals.

Allowed:

attributeValues

object

A map of custom attribute field names to the list of values associated with each attribute.
Each entry in the list can contain either an 'id' (for predefined options) or a 'value', depending on the attribute configuration.
If any attribute value is missing in the JSON array, the existing value for that attribute will be overridden, and the attribute will have empty values.

incidentAssigneeRequests

array of objects

A list of incident assignee requests, where each request includes an assignee's ID, optional email, and type (USER or GROUP).

incidentAssigneeRequests

jurisdictions

array of objects

jurisdictions

linkedInventories

object

Map of inventory types to a single inventory link request.
Keys represent inventory types ('assets', 'processing-activities', 'vendors', 'entities'),
and the value contains either externalIds or inventoryIds.

autoAssessJurisdictions

boolean

Defaults to false

If set to true, automatically assess jurisdictions after incident creation.

Responses

400

Bad Request

401

Unauthorized

403

Forbidden

500

Internal Server Error

201Incident created successfully. The response contains the UUID of the newly created incident.

429Too Many Requests. For more information, see API Rate Limits.