IngestIncidentRequest

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-ingest-incident-request-schema.json",
  "title": "IngestIncidentRequest",
  "description": "v2 request body for ingesting a Microsoft Sentinel incident from a customer's Content Hub playbook.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contraforce-incidents-api-openapi.yml#/components/schemas/IngestIncidentRequest",
  "required": [
    "incidentArmId"
  ],
  "type": "object",
  "properties": {
    "incidentArmId": {
      "type": "string",
      "description": "Full Azure Resource Manager id of the Sentinel incident, taken from the playbook trigger."
    },
    "incidentTitle": {
      "type": [
        "null",
        "string"
      ],
      "description": "Incident title from the trigger. Accepted for compatibility; not forwarded downstream."
    },
    "severity": {
      "type": [
        "null",
        "string"
      ],
      "description": "Incident severity from the trigger, forwarded to the pipeline only as a hint."
    },
    "workspaceId": {
      "type": "string",
      "description": "The Sentinel (Log Analytics) workspace GUID from the trigger. Accepted for compatibility;\nthe ContraForce workspace used for authorization is taken from the route, not this value.",
      "format": "uuid"
    }
  }
}