Skip to main content
POST
/
api
/
v2
/
workspaces
/
{workspaceId}
/
agent
/
tools
/
incidents
/
{source}
/
{incidentId}
/
gamebooks
Agent tool submit gamebook
curl --request POST \
  --url https://api.example.com/api/v2/workspaces/{workspaceId}/agent/tools/incidents/{source}/{incidentId}/gamebooks \
  --header 'Content-Type: application/json' \
  --data '
{
  "incident_number": 123,
  "incident_title": "<string>",
  "playbooks": [
    {
      "playbook_id": "<string>",
      "entity_id": "<string>",
      "affected_entity": "<string>",
      "sequence": 123
    }
  ]
}
'
{
  "data": {
    "success": true,
    "summary": "<string>",
    "gamebook_id": "<string>",
    "status": "<string>",
    "is_queued_for_approval": true
  },
  "meta": {
    "requestId": "<string>",
    "timestamp": "<string>"
  }
}

Path Parameters

​
workspaceId
string<uuid>
required
​
source
enum<string>
required
Available options:
Sentinel,
DefenderXDR,
QRadar,
Splunk,
CrowdStrike,
SentinelOne
​
incidentId
string
required

Body

application/json

Request DTO for the agent's submit-gamebook tool. Allows the agent to queue one or more remediation gamebooks against an incident as it investigates.

​
incident_number

Sequential incident number from the source platform. Used in human-readable summaries and gamebook tracking.

​
incident_title
null | string

Human-readable incident title from the source platform. Used in summaries and audit logs.

​
trigger_type
enum<string>

How the agent run was triggered. OnQueue (background): subject to per-severity Gamebooks capability gating — submissions are rejected for severities where Gamebooks is not enabled. ManualInvestigateAndRespond (operator-requested): always allowed to submit gamebooks regardless of capability settings.

Available options:
OnQueue,
ManualInvestigateOnly,
ManualInvestigateAndRespond
​
playbooks
null | object[]

Ordered playbook actions to run as part of this gamebook. Each entry binds a playbook from the registered catalog to its target entity. Must contain at least one entry — empty arrays are rejected.

Response

OK

Standard v2 API response envelope for single-item responses.

​
data
object

Result of an agent submit-gamebook tool call. Designed for LLM consumption — the string AgentToolGamebookSubmissionResult.Summary field is a compact human-readable digest the agent can emit directly into chat or chain into follow-up reasoning.

​
meta
object