IBM Security Resilient

Expand all | Collapse all

Update multiple incidents via REST API

Jump to Best Answer
  • 1.  Update multiple incidents via REST API

    Posted Fri March 06, 2020 01:13 PM
    I'd like to update multiple incidents using the REST API.  The REST API documentation shows this can be done using a PATCH call to the /orgs/{org_id}/incidents endpoint.  I'm not seeing in the documentation where to specify what incident IDs I want to update. 

    Also, the MultiPatchDTO is a bit different from the PatchDTO that updating a single incident uses - so this is throwing me off as well.

    My initial use case is to use the API to close multiple incidents that meet certain parameters.

    ------------------------------
    David Vasil
    ------------------------------


  • 2.  RE: Update multiple incidents via REST API
    Best Answer

    Posted Mon March 09, 2020 08:52 AM
    I always find that in situations like this seeing how the UI does it is most helpful.

    curl 'https://server.com/rest/orgs/230/incidents' -X PATCH
    -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Content-Type: application/json'
    -H 'X-sess-id: 3298fbf0f50bbfcc8373b0d3db2708ef' -H 'handle_format: ids' -H 'text_content_output_format: objects_convert'
    -H 'browser_locale: en' -H 'X-Requested-With: XMLHttpRequest'
    -H 'Origin: https://server.com' -H 'Connection: keep-alive'
    -H 'Cookie: _ga=GA1.2.1382814266.1575940211; JSESSIONID=E3E2557A199D6C374F60A263F97AB64B; CSRF_TOKEN=7b2276616c7565223a226362313836626237613331343963346264386463316636303162613130663231227d'
    --data '{"patches":{"6063":{"version":6,"changes":[{"old_value":{"object":"A"},"new_value":{"object":"C"},"field":{"name":"plan_status","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":1583193600000},"field":{"name":"actual_release_date","id":null,"null":false}},{"old_value":{},"new_value":{"object":"dfdfd"},"field":{"name":"ga_release_number","id":null,"null":false}},{"old_value":{},"new_value":{"object":"ddfdf"},"field":{"name":"integration_test_time","id":null,"null":false}},{"old_value":{},"new_value":{"object":"fdfd"},"field":{"name":"required","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":14903},"field":{"name":"resolution_id","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":"<div class=\"rte\"><div>dff</div></div>"},"field":{"name":"resolution_summary","id":null,"null":false}}]},"7137":{"version":8,"changes":[{"old_value":{"object":"A"},"new_value":{"object":"C"},"field":{"name":"plan_status","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":1583193600000},"field":{"name":"actual_release_date","id":null,"null":false}},{"old_value":{},"new_value":{"object":"dfdfd"},"field":{"name":"ga_release_number","id":null,"null":false}},{"old_value":{},"new_value":{"object":"ddfdf"},"field":{"name":"integration_test_time","id":null,"null":false}},{"old_value":{},"new_value":{"object":"fdfd"},"field":{"name":"required","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":14903},"field":{"name":"resolution_id","id":null,"null":false}},{"old_value":{"object":null},"new_value":{"object":"<div class=\"rte\"><div>dff</div></div>"},"field":{"name":"resolution_summary","id":null,"null":false}}]}}}'

    Here I selected two incidents from the incident list and closed them. I received a prompt for required fields and then the UI called the patch command to the server.

    ------------------------------
    Ben Lurie
    ------------------------------