{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-update-incident-status-request-schema.json",
  "title": "UpdateIncidentStatusRequest",
  "description": "v2 request body for updating an incident's status.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contraforce-incidents-api-openapi.yml#/components/schemas/UpdateIncidentStatusRequest",
  "required": [
    "status"
  ],
  "type": "object",
  "properties": {
    "status": {
      "description": "New status to apply to the incident.",
      "$ref": "#/$defs/Status"
    },
    "comment": {
      "type": [
        "null",
        "string"
      ],
      "description": "Optional comment recorded alongside the status change. Recommended when\ntransitioning to Status.Closed."
    },
    "classification": {
      "oneOf": [
        {
          "type": "null"
        },
        {
          "description": "Required when `status` is `Closed` for sources that support classifications\n(`Sentinel`, `DefenderXDR`, `SentinelOne`, `CrowdStrike`, `SumoLogic`);\nnot required for other sources, but recorded in ContraForce when supplied. One of\n`TruePositive`, `FalsePositive`, `BenignPositive`, or `Undetermined`; it\ndetermines which `classificationReason` values are accepted.",
          "$ref": "#/$defs/Classification"
        }
      ]
    },
    "classificationReason": {
      "oneOf": [
        {
          "type": "null"
        },
        {
          "description": "Required whenever `classification` is set for a source that supports classifications,\nand must belong to it:\n`TruePositive`: `MultistagedAttack`, `Malware`, `MaliciousUserActivity`, `UnwantedSoftware`, `Phishing`, `CompromisedUser`, `Apt`, `SuspiciousActivity`, `Other`.\n`FalsePositive`: `NotMalicious`, `NoEnoughDataToValidate`, `InaccurateData`, `IncorrectAlertLogic`, `Other`.\n`BenignPositive`: `SecurityTesting`, `ConfirmedUserActivity`, `LineOfBusinessApplication`, `SecurityPersonnel`, `SuspiciousButExpected`, `Other`.\n`Undetermined`: `Unknown`, `Other`.\nA reason outside the classification's list returns `400 VALIDATION_ERROR`.",
          "$ref": "#/$defs/ClassificationReason"
        }
      ]
    },
    "updateTicket": {
      "type": "boolean",
      "description": "When `true`, also closes the linked service ticket identified by\nstring UpdateIncidentStatusRequest.TicketId."
    },
    "ticketId": {
      "type": [
        "null",
        "string"
      ],
      "description": "Linked service ticket id; required when bool UpdateIncidentStatusRequest.UpdateTicket is `true`."
    }
  },
  "$defs": {
    "Classification": {
      "enum": [
        "BenignPositive",
        "FalsePositive",
        "TruePositive",
        "Undetermined",
        null
      ]
    },
    "ClassificationReason": {
      "enum": [
        "InaccurateData",
        "IncorrectAlertLogic",
        "SuspiciousActivity",
        "SuspiciousButExpected",
        "Unknown",
        "Apt",
        "Malware",
        "SecurityPersonnel",
        "SecurityTesting",
        "UnwantedSoftware",
        "Other",
        "MultistagedAttack",
        "CompromisedUser",
        "Phishing",
        "MaliciousUserActivity",
        "NotMalicious",
        "NoEnoughDataToValidate",
        "ConfirmedUserActivity",
        "LineOfBusinessApplication",
        null
      ]
    },
    "Status": {
      "enum": [
        "Active",
        "New",
        "Closed",
        "OnHold",
        "WaitingOnCustomer"
      ]
    }
  }
}