{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-bulk-update-incidents-request-schema.json",
  "title": "BulkUpdateIncidentsRequest",
  "description": "v2 request body for the cross-workspace bulk incident update endpoint.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contraforce-cross-workspace-incidents-api-openapi.yml#/components/schemas/BulkUpdateIncidentsRequest",
  "type": "object",
  "properties": {
    "items": {
      "type": [
        "null",
        "array"
      ],
      "items": {
        "$ref": "#/$defs/UpdateIncidentRequest"
      }
    }
  },
  "$defs": {
    "Classification": {
      "enum": [
        "BenignPositive",
        "FalsePositive",
        "TruePositive",
        "Undetermined",
        null
      ]
    },
    "ClassificationReason": {
      "enum": [
        "InaccurateData",
        "IncorrectAlertLogic",
        "SuspiciousActivity",
        "SuspiciousButExpected",
        "Unknown",
        "Apt",
        "Malware",
        "SecurityPersonnel",
        "SecurityTesting",
        "UnwantedSoftware",
        "Other",
        "MultistagedAttack",
        "CompromisedUser",
        "Phishing",
        "MaliciousUserActivity",
        "NotMalicious",
        "NoEnoughDataToValidate",
        "ConfirmedUserActivity",
        "LineOfBusinessApplication",
        null
      ]
    },
    "IncidentSource": {
      "enum": [
        "Sentinel",
        "DefenderXDR",
        "QRadar",
        "Splunk",
        "CrowdStrike",
        "SentinelOne",
        "SumoLogic"
      ]
    },
    "Status": {
      "enum": [
        "Active",
        "New",
        "Closed",
        "OnHold",
        "WaitingOnCustomer"
      ]
    },
    "UpdateIncidentRequest": {
      "required": [
        "id"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "status": {
          "oneOf": [
            {
              "type": "null"
            },
            {
              "$ref": "#/$defs/Status"
            }
          ]
        },
        "user": {
          "description": "Represents a light version of the user object, that is used to add reference to a specific user in a foreign entities",
          "$ref": "#/$defs/UserSummary"
        },
        "workspace": {
          "type": [
            "null",
            "string"
          ],
          "description": "Indicates the workspace that the incident is related to in case of multi-workspace environments"
        },
        "removeAssignee": {
          "type": "boolean",
          "description": "If UserId is set to null but this is set to true,\nthe incident will be unassigned,\notherwise it will stay assigned to the current user"
        },
        "comment": {
          "type": [
            "null",
            "string"
          ]
        },
        "classification": {
          "oneOf": [
            {
              "type": "null"
            },
            {
              "$ref": "#/$defs/Classification"
            }
          ]
        },
        "classificationReason": {
          "oneOf": [
            {
              "type": "null"
            },
            {
              "$ref": "#/$defs/ClassificationReason"
            }
          ]
        },
        "incidentSource": {
          "description": "The source system that contains the incident like Sentinel, Defender ..etc",
          "$ref": "#/$defs/IncidentSource"
        }
      }
    },
    "UserSummary": {
      "type": "object",
      "properties": {
        "id": {
          "type": [
            "null",
            "string"
          ]
        },
        "displayName": {
          "type": [
            "null",
            "string"
          ]
        },
        "email": {
          "type": [
            "null",
            "string"
          ]
        }
      },
      "description": "Represents a light version of the user object, that is used to add reference to a specific user in a foreign entities"
    }
  }
}