Skip to main content
POST
Claim a case for investigation

Authorizations

X-API-Key
string
header
required

Domain-scoped API key. Generate and manage keys from the API Keys page in Settings.

Accepted in two forms:

  • X-API-Key: <key> header (preferred)
  • Authorization: Bearer <key> header (also accepted)

Path Parameters

case_id
string<uuid>
required

Body

application/json
comment
string

Why the case is being claimed, e.g. the SOAR ticket. Recorded with the claim.

Maximum string length: 2000

Response

Case claimed, or already claimed

case_id
string<uuid>
required
claimed
boolean
required

True when this call claimed the case; false when it was already claimed.

case_state
string
required

Lifecycle state of a case:

  • discover — Vetted by the AI judge, ready for triage
  • pending_investigation — Claimed for investigation, by an analyst in TOTAL or through POST /cases/{case_id}/claim
  • investigating — Investigation underway
  • closed — Case closed