Skip to main content
POST
/
api
/
v2
/
workspaces
/
{workspaceId}
/
incidents
/
{source}
/
{incidentId}
/
comments
Create incident comment
curl --request POST \
  --url https://api.example.com/api/v2/workspaces/{workspaceId}/incidents/{source}/{incidentId}/comments \
  --header 'Content-Type: application/json' \
  --data '
{
  "content": "<string>",
  "extensionId": "<string>"
}
'
{
  "data": {
    "id": "<string>",
    "message": "<string>",
    "createdTime": "2023-11-07T05:31:56Z",
    "authorEmail": "<string>",
    "authorName": "<string>",
    "isActivityComment": true,
    "isAgentComment": true,
    "agentName": "<string>",
    "isClosingComment": true,
    "ticketNoteId": "<string>",
    "ticketId": "<string>"
  },
  "meta": {
    "requestId": "<string>",
    "timestamp": "<string>"
  }
}

Path Parameters

​
workspaceId
string<uuid>
required
​
source
enum<string>
required
Available options:
Sentinel,
DefenderXDR,
QRadar,
Splunk,
CrowdStrike,
SentinelOne
​
incidentId
string
required

Body

application/json

v2 request body for creating a comment on an incident.

​
content
null | string
required

Body of the comment.

​
extensionId
null | string
required

Id of the extension associated with the incident; required to route the write back to the originating system (e.g. Sentinel, Defender XDR).

Response

Created

Standard v2 API response envelope for single-item responses.

​
data
object
​
meta
object