curl --request POST \
--url https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks \
--header 'Content-Type: application/json' \
--data '
{
"incident_number": 123,
"incident_title": "<string>",
"playbooks": [
{
"playbook_id": "<string>",
"entity_id": "<string>",
"affected_entity": "<string>",
"sequence": 123
}
]
}
'import requests
url = "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks"
payload = {
"incident_number": 123,
"incident_title": "<string>",
"playbooks": [
{
"playbook_id": "<string>",
"entity_id": "<string>",
"affected_entity": "<string>",
"sequence": 123
}
]
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
incident_number: 123,
incident_title: '<string>',
playbooks: [
{
playbook_id: '<string>',
entity_id: '<string>',
affected_entity: '<string>',
sequence: 123
}
]
})
};
fetch('https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'incident_number' => 123,
'incident_title' => '<string>',
'playbooks' => [
[
'playbook_id' => '<string>',
'entity_id' => '<string>',
'affected_entity' => '<string>',
'sequence' => 123
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks"
payload := strings.NewReader("{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks")
.header("Content-Type", "application/json")
.body("{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"data": {
"success": true,
"summary": "<string>",
"gamebook_id": "<string>",
"status": "<string>",
"is_queued_for_approval": true
},
"meta": {
"requestId": "<string>",
"timestamp": "<string>"
}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}Agent tool submit gamebook
curl --request POST \
--url https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks \
--header 'Content-Type: application/json' \
--data '
{
"incident_number": 123,
"incident_title": "<string>",
"playbooks": [
{
"playbook_id": "<string>",
"entity_id": "<string>",
"affected_entity": "<string>",
"sequence": 123
}
]
}
'import requests
url = "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks"
payload = {
"incident_number": 123,
"incident_title": "<string>",
"playbooks": [
{
"playbook_id": "<string>",
"entity_id": "<string>",
"affected_entity": "<string>",
"sequence": 123
}
]
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
incident_number: 123,
incident_title: '<string>',
playbooks: [
{
playbook_id: '<string>',
entity_id: '<string>',
affected_entity: '<string>',
sequence: 123
}
]
})
};
fetch('https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'incident_number' => 123,
'incident_title' => '<string>',
'playbooks' => [
[
'playbook_id' => '<string>',
'entity_id' => '<string>',
'affected_entity' => '<string>',
'sequence' => 123
]
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks"
payload := strings.NewReader("{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks")
.header("Content-Type", "application/json")
.body("{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"incident_number\": 123,\n \"incident_title\": \"<string>\",\n \"playbooks\": [\n {\n \"playbook_id\": \"<string>\",\n \"entity_id\": \"<string>\",\n \"affected_entity\": \"<string>\",\n \"sequence\": 123\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"data": {
"success": true,
"summary": "<string>",
"gamebook_id": "<string>",
"status": "<string>",
"is_queued_for_approval": true
},
"meta": {
"requestId": "<string>",
"timestamp": "<string>"
}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"detail": "<string>",
"instance": "<string>",
"code": "<string>",
"requestId": "<string>",
"timestamp": "<string>",
"target": "<string>",
"errors": {}
}Path Parameters
Sentinel, DefenderXDR, QRadar, Splunk, CrowdStrike, SentinelOne Body
Request DTO for the agent's submit-gamebook tool. Allows the agent to queue one or more remediation gamebooks against an incident as it investigates.
Sequential incident number from the source platform. Used in human-readable summaries and gamebook tracking.
Human-readable incident title from the source platform. Used in summaries and audit logs.
How the agent run was triggered. OnQueue (background): subject to per-severity Gamebooks capability gating — submissions are rejected for severities where Gamebooks is not enabled. ManualInvestigateAndRespond (operator-requested): always allowed to submit gamebooks regardless of capability settings.
OnQueue, ManualInvestigateOnly, ManualInvestigateAndRespond Ordered playbook actions to run as part of this gamebook. Each entry binds a playbook from the registered catalog to its target entity. Must contain at least one entry — empty arrays are rejected.
Show child attributes
Show child attributes
Response
OK
Standard v2 API response envelope for single-item responses.
Result of an agent submit-gamebook tool call. Designed for LLM consumption — the string AgentToolGamebookSubmissionResult.Summary field is a compact human-readable digest the agent can emit directly into chat or chain into follow-up reasoning.
Show child attributes
Show child attributes
Show child attributes
Show child attributes