Skip to main content
POST
/
api
/
v2
/
workspaces
/
{workspaceId}
/
agent
/
tools
/
incidents
/
{source}
/
{incidentId}
/
gamebooks
Agent tool submit gamebook
curl --request POST \
  --url https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks \
  --header 'Content-Type: application/json' \
  --data '
{
  "incident_number": 123,
  "incident_title": "<string>",
  "playbooks": [
    {
      "playbook_id": "<string>",
      "entity_id": "<string>",
      "affected_entity": "<string>",
      "sequence": 123
    }
  ]
}
'
import requests

url = "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks"

payload = {
"incident_number": 123,
"incident_title": "<string>",
"playbooks": [
{
"playbook_id": "<string>",
"entity_id": "<string>",
"affected_entity": "<string>",
"sequence": 123
}
]
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)
const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
incident_number: 123,
incident_title: '<string>',
playbooks: [
{
playbook_id: '<string>',
entity_id: '<string>',
affected_entity: '<string>',
sequence: 123
}
]
})
};

fetch('https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'incident_number' => 123,
'incident_title' => '<string>',
'playbooks' => [
[
'playbook_id' => '<string>',
'entity_id' => '<string>',
'affected_entity' => '<string>',
'sequence' => 123
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"strings"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks"

payload := strings.NewReader("{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}")

req, _ := http.NewRequest("POST", url, payload)

req.Header.Add("Content-Type", "application/json")

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.post("https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks")
.header("Content-Type", "application/json")
.body("{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}"

response = http.request(request)
puts response.read_body
{
  "data": {
    "success": true,
    "summary": "<string>",
    "gamebook_id": "<string>",
    "status": "<string>",
    "is_queued_for_approval": true
  },
  "meta": {
    "requestId": "<string>",
    "timestamp": "<string>"
  }
}
{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}
{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}
{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}
{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}
{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}

Path Parameters

workspaceId
string<uuid>
required
source
enum<string>
required
Available options:
Sentinel,
DefenderXDR,
QRadar,
Splunk,
CrowdStrike,
SentinelOne
incidentId
string
required

Body

application/json

Request DTO for the agent's submit-gamebook tool. Allows the agent to queue one or more remediation gamebooks against an incident as it investigates.

incident_number

Sequential incident number from the source platform. Used in human-readable summaries and gamebook tracking.

incident_title
null | string

Human-readable incident title from the source platform. Used in summaries and audit logs.

trigger_type
enum<string>

How the agent run was triggered. OnQueue (background): subject to per-severity Gamebooks capability gating — submissions are rejected for severities where Gamebooks is not enabled. ManualInvestigateAndRespond (operator-requested): always allowed to submit gamebooks regardless of capability settings.

Available options:
OnQueue,
ManualInvestigateOnly,
ManualInvestigateAndRespond
playbooks
null | object[]

Ordered playbook actions to run as part of this gamebook. Each entry binds a playbook from the registered catalog to its target entity. Must contain at least one entry — empty arrays are rejected.

Response

OK

Standard v2 API response envelope for single-item responses.

data
object

Result of an agent submit-gamebook tool call. Designed for LLM consumption — the string AgentToolGamebookSubmissionResult.Summary field is a compact human-readable digest the agent can emit directly into chat or chain into follow-up reasoning.

meta
object