# Cisco XDR Investigation Save/Update API

**Canonical:** https://apis.io/apis/cisco-xdr/cisco-xdr-investigation-save-update-api/  
**Provider:** Cisco XDR — https://apis.io/providers/cisco-xdr/  
**Base URL:** https://private.intel.amp.cisco.com  
**Documentation:** https://developer.cisco.com/docs/cisco-xdr/

Cisco XDR Investigation Save/Update API is one of 89 APIs that [Cisco XDR](https://apis.io/providers/cisco-xdr/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Investigation Save/Update. The published artifact set on APIs.io includes an OpenAPI specification.

The Investigation Save/Update API from Cisco XDR — 8 operation(s) for investigation save/update.

## Operations (8)

| Method | Path | Summary |
|---|---|---|
| POST | `/v2/investigation/{investigation-id}/bundle` | Add Threat context to an investigation |
| POST | `/v2/investigation/{investigation-id}/observable/add` | Add observables to an investigation |
| POST | `/v2/investigation/{investigation-id}/observable/remove` | Remove observables from an investigation |
| POST | `/v2/investigation/{investigation-id}/task` | Run a task |
| PUT | `/v2/investigation/{investigation-id}/edit` | Saves an investigation in place |
| POST | `/v2/investigation/{investigation-id}/copy` | Create a copy of an investigation |
| DELETE | `/v2/investigation/{investigation-id}/delete` | Delete investigation by investigation id delete |
| POST | `/v2/investigation/{investigation-id}/save-as` | Saves an investigation as a new entity |

## Machine-readable artifacts (1)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-investigation-save-update-api-openapi.yml

## Other Cisco XDR APIs (12)

- [Cisco XDR Actor API](https://apis.io/apis/cisco-xdr/cisco-xdr-actor-api/)
- [Cisco XDR Asset API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-api/)
- [Cisco XDR Asset Mapping API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-mapping-api/)
- [Cisco XDR Asset Properties API](https://apis.io/apis/cisco-xdr/cisco-xdr-asset-properties-api/)
- [Cisco XDR Attack Pattern API](https://apis.io/apis/cisco-xdr/cisco-xdr-attack-pattern-api/)
- [Cisco XDR Bulk API](https://apis.io/apis/cisco-xdr/cisco-xdr-bulk-api/)
- [Cisco XDR Bundle API](https://apis.io/apis/cisco-xdr/cisco-xdr-bundle-api/)
- [Cisco XDR Campaign API](https://apis.io/apis/cisco-xdr/cisco-xdr-campaign-api/)
- [Cisco XDR Casebook API](https://apis.io/apis/cisco-xdr/cisco-xdr-casebook-api/)
- [Cisco XDR COA API](https://apis.io/apis/cisco-xdr/cisco-xdr-coa-api/)
- [Cisco XDR Deliberate API](https://apis.io/apis/cisco-xdr/cisco-xdr-deliberate-api/)
- [Cisco XDR Event API](https://apis.io/apis/cisco-xdr/cisco-xdr-event-api/)

## Tags

Investigation Save/Update

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/cisco-xdr/cisco-xdr-investigation-save-update-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/cisco-xdr/.