API Object Models and JSON Examples

Use these models as a reference when building integrations. Request and response bodies use application/json (or multipart/form-data for operating procedure uploads). Successful responses are wrapped in the standard envelope; error responses follow RFC 7807 ProblemDetails — see the error reference for the full catalogue.

Response Envelopes

Success response

{
  "data": { ... },
  "meta": {
    "requestId": "0HN8Q3V0001",
    "timestamp": "2026-04-15T20:00:00.0000000+00:00"
  }
}

Paginated response

{
  "data": [ ... ],
  "pagination": {
    "continuationToken": "eyJjb250...",
    "hasMore": true
  },
  "meta": {
    "requestId": "0HN8Q3V0001",
    "timestamp": "2026-04-15T20:00:00.0000000+00:00"
  }
}

Error response

Errors are RFC 7807 ProblemDetails, served as application/problem+json. Switch on the stable code extension; the title and detail strings are human-readable and may be reworded between releases.

{
  "type": "about:blank",
  "title": "Resource not found",
  "status": 404,
  "detail": "Incident 'INC-12345' not found",
  "instance": "/api/v2/workspaces/.../incidents/Sentinel/INC-12345",
  "code": "NOT_FOUND",
  "requestId": "0HN8Q3V0002",
  "timestamp": "2026-04-15T20:01:00.0000000+00:00"
}

The full set of code values, validation errors map shape, and resolution guidance live on the error reference page.

Incidents

Incident object

Returned by GET /workspaces/{workspaceId}/incidents/{source}/{incidentId}:

{
  "source": "Sentinel",
  "incident": {
    "id": "INC-12345",
    "title": "Suspicious sign-in from anonymous IP address",
    "severity": "High",
    "status": "Active",
    "workspaceId": "ws-abc123",
    "createdAt": "2026-04-15T10:30:00Z",
    "updatedAt": "2026-04-15T14:22:00Z"
  },
  "investigationDetails": {
    "entities": [ ],
    "alerts": [ ]
  },
  "evidence": { },
  "gamebookCatalog": { }
}

Enum values:

Field	Values
`source`	`Sentinel`, `DefenderXDR`, `CrowdStrike`, `QRadar`, `Splunk`, `SentinelOne`, `SumoLogic`
`severity`	`Informational`, `Low`, `Medium`, `High`
`status`	`New`, `Active`, `Closed`

Incident comment

Response object from GET /workspaces/{workspaceId}/incidents/{source}/{incidentId}/comments:

{
  "id": "comment-001",
  "message": "Confirmed this was a legitimate admin action.",
  "createdTime": "2026-04-15T16:00:00Z",
  "authorEmail": "analyst@contoso.example",
  "authorName": "Jane Doe",
  "isActivityComment": false,
  "isAgentComment": false,
  "agentName": null,
  "isClosingComment": false,
  "ticketNoteId": null,
  "ticketId": null
}

List incidents across workspaces

Request body for POST /incidents/across-workspaces:

{
  "severities": ["High", "Medium"],
  "statuses": ["New", "Active"],
  "sources": ["Sentinel", "DefenderXDR"],
  "timeFilterSelection": {
    "type": "TwentyFourHours"
  },
  "filterByLastModified": false,
  "isFirstCall": true,
  "query": "malware",
  "assigneeEmails": ["analyst@contoso.example"],
  "includeUnassigned": true
}

Time filter enum values for type: ThreeHours, SixHours, TwelveHours, TwentyFourHours, FortyEightHours, Custom. Any other value is rejected. filterByLastModified (boolean, default false): when true, timeFilterSelection bounds the incident’s vendor last-modified time instead of its creation time and the page is ordered by last-modified time descending. Supported for Sentinel and DefenderXDR only; an empty sources list selects those two. See Syncing incident updates. When using Custom, include customStartUtc and customEndUtc:

{
  "timeFilterSelection": {
    "type": "Custom",
    "customStartUtc": "2026-04-01T00:00:00Z",
    "customEndUtc": "2026-04-15T23:59:59Z"
  }
}

Webhooks

For the full list of event types, their payload schemas, and delivery behavior, see the Webhook Event Reference.

Webhook configuration

Response object from GET /webhooks/{id}:

{
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "serviceProviderId": "00000000-0000-0000-0000-000000000001",
  "targetAccountId": "00000000-0000-0000-0000-000000000001",
  "targetAccountName": "Contoso MSP",
  "workspaceId": null,
  "name": "SIEM-ingest-prod",
  "url": "https://siem.contoso.example/api/webhook",
  "status": "Active",
  "eventTypes": ["incident.created.v1", "incident.closed.v1"],
  "monitoredAccountIds": [
    "11111111-1111-1111-1111-111111111111",
    "22222222-2222-2222-2222-222222222222"
  ],
  "authenticationType": "Bearer",
  "hasSigningToken": true,
  "disableReason": null,
  "disabledAt": null,
  "createdAt": "2026-03-01T12:00:00Z",
  "lastModifiedAt": "2026-04-10T09:30:00Z"
}

Create webhook

Request body for POST /webhooks:

{
  "name": "SIEM-ingest-prod",
  "url": "https://siem.contoso.example/api/webhook",
  "eventTypes": ["incident.created.v1", "incident.closed.v1"],
  "monitoredAccountIds": [
    "11111111-1111-1111-1111-111111111111"
  ],
  "authenticationType": "Bearer",
  "token": "your-bearer-token",
  "signingToken": "your-hmac-signing-secret"
}

Enum values for authenticationType: None, Bearer, Basic, ApiKey

Delivery log

Response object from GET /webhooks/{id}/delivery-logs/{logId}?createdAt=. The list endpoint returns the same object per entry, always with eventPayload set to null.

{
  "id": "5f1c2c1e-6b0f-4a1a-9c3d-2e8b7a6d5c40",
  "webhookConfigurationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "eventId": "9d2f0a7b-3c4e-4f5a-8b6c-1d2e3f4a5b6c",
  "eventType": "incident.created.v1",
  "status": "Failed",
  "httpStatusCode": 503,
  "errorMessage": "HTTP 503 Service Unavailable",
  "latencyMs": 812,
  "attemptNumber": 3,
  "originalDeliveryId": "0c9e8d7f-6a5b-4c3d-2e1f-0a9b8c7d6e5f",
  "isTest": false,
  "eventSourceAccountId": "11111111-1111-1111-1111-111111111111",
  "eventSourceAccountName": "Contoso Retail",
  "eventSubjectId": "6f2a9c1d-0b3e-4a5f-8c7d-1e2f3a4b5c6d",
  "eventSubjectDisplayName": "Incident #1042",
  "eventSubjectAttributes": {
    "source": "Sentinel",
    "severity": "High",
    "status": "Active",
    "number": "1042"
  },
  "eventPayload": "{\"type\":\"incident.created.v1\", ... }",
  "responseSnippet": null,
  "eventOccurredAt": "2026-08-03T14:21:55Z",
  "completedAt": "2026-08-03T14:22:09Z",
  "redeliveryRequestedAt": null,
  "createdAt": "2026-08-03T14:22:08Z"
}

Enum values for status: Pending, Succeeded, Failed

Field	Notes
`eventPayload`	Not stored. The single-entry endpoint rebuilds it from the incident’s current state for `incident.created.v1`; it is `null` for other event types and when the incident is no longer available.
`responseSnippet`	Not stored. Always `null` for entries written after 2026-08-27.
`eventSubjectDisplayName`	The label `Incident #<number>`, or `null` when the source has no incident number. The incident title is not stored.
`originalDeliveryId`	Set on retries and redeliveries; points at the first attempt for the event.
`redeliveryRequestedAt`	Set once a redelivery has been requested for the entry; a second request returns `409`.

See Delivery logs for what is retained and how redelivery works.

Service Accounts

Service account

Response object from GET /service-accounts/{id}:

{
  "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "accountId": "00000000-0000-0000-0000-000000000001",
  "name": "Jira-incident-sync-prod",
  "description": "Syncs incidents to Jira Service Management",
  "isActive": true,
  "organizationalRole": "Member",
  "clientSecretPrefix": "cf_sa_",
  "credentialExpirationDate": "2027-04-15T00:00:00Z",
  "workspaceAssignments": [
    {
      "workspaceId": "ws-abc123",
      "workspaceName": "Contoso Prod",
      "role": "IncidentAnalyst"
    }
  ],
  "credentials": [
    {
      "id": "cred-001",
      "scopes": ["incidents:read", "incidents:write"],
      "status": "Active",
      "expiresAt": "2027-04-15T00:00:00Z",
      "lastUsedAt": "2026-04-15T19:00:00Z",
      "createdAt": "2026-04-01T12:00:00Z"
    }
  ],
  "lastUsedAt": "2026-04-15T19:00:00Z",
  "createdAt": "2026-04-01T12:00:00Z",
  "lastModifiedAt": "2026-04-10T09:30:00Z"
}

Create service account

Request body for POST /service-accounts:

{
  "name": "Jira-incident-sync-prod",
  "description": "Syncs incidents to Jira Service Management",
  "organizationalRole": "Member",
  "workspaceAssignments": [
    {
      "workspaceId": "ws-abc123",
      "role": "IncidentAnalyst"
    }
  ],
  "scopes": ["incidents:read", "incidents:write"],
  "expirationDate": "2027-04-15T00:00:00Z"
}

Credential created (shown once)

Response from POST /service-accounts/{id}/credentials:

{
  "clientId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "clientSecret": "cf_sa_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345678==",
  "id": "cred-002",
  "scopes": ["incidents:read"],
  "status": "Active",
  "expiresAt": "2027-04-15T00:00:00Z",
  "lastUsedAt": null,
  "createdAt": "2026-04-15T20:00:00Z"
}

The clientSecret is returned only once in this response. Store it immediately in a secrets manager.

Users

User object

Each item returned by GET /users:

{
  "id": "61eec97d-57b2-5b00-686e-8544a1b2c3d4",
  "displayName": "Jane Doe",
  "email": "jane.doe@contoso.example",
  "organizationalRole": "Member",
  "isActive": true
}

​Response Envelopes

​Success response

​Paginated response

​Error response

​Incidents

​Incident object

​Incident comment

​List incidents across workspaces

​Webhooks

​Webhook configuration

​Create webhook

​Delivery log

​Service Accounts

​Service account

​Create service account

​Credential created (shown once)

​Users

​User object

Response Envelopes

Success response

Paginated response

Error response

Incidents

Incident object

Incident comment

List incidents across workspaces

Webhooks

Webhook configuration

Create webhook

Delivery log

Service Accounts

Service account

Create service account

Credential created (shown once)

Users

User object