Skip to main content
POST
Submit a verdict for a case

Authorizations

X-API-Key
string
header
required

Domain-scoped API key. Generate and manage keys from the API Keys page in Settings.

Accepted in two forms:

  • X-API-Key: <key> header (preferred)
  • Authorization: Bearer <key> header (also accepted)

Path Parameters

case_id
string<uuid>
required

Body

application/json
outcome
string
required

What happened to the case. One label, no ambiguity:

  • SAFE — Benign, no threat (enforcement Mark Safe; not triage swipe)
  • TRUE_POSITIVE — Confirmed threat, actioned
  • FALSE_POSITIVE — Incorrectly classified (same enforcement Mark Safe as SAFE)
  • DUPLICATE — Already handled under another case
  • ESCALATED — Passed to investigation or SOC tier
comment
string
Maximum string length: 2000
event_ids
string<uuid>[]

Optional event IDs supporting this verdict

Maximum array length: 200

Response

Verdict accepted and applied

success
boolean
required
case_id
string<uuid>
required
outcome
string
required

What happened to the case. One label, no ambiguity:

  • SAFE — Benign, no threat (enforcement Mark Safe; not triage swipe)
  • TRUE_POSITIVE — Confirmed threat, actioned
  • FALSE_POSITIVE — Incorrectly classified (same enforcement Mark Safe as SAFE)
  • DUPLICATE — Already handled under another case
  • ESCALATED — Passed to investigation or SOC tier
resolved
boolean
required
processed_at
string<date-time>
required