ListIncidentsAcrossWorkspacesRequest

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-list-incidents-across-workspaces-request-schema.json",
  "title": "ListIncidentsAcrossWorkspacesRequest",
  "description": "v2 request for listing incidents across multiple workspaces.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contraforce-cross-workspace-incidents-api-openapi.yml#/components/schemas/ListIncidentsAcrossWorkspacesRequest",
  "type": "object",
  "properties": {
    "severities": {
      "type": [
        "null",
        "array"
      ],
      "items": {
        "$ref": "#/$defs/Severity"
      },
      "description": "Filter incidents to only the listed severities. Empty list returns all severities."
    },
    "statuses": {
      "type": [
        "null",
        "array"
      ],
      "items": {
        "$ref": "#/$defs/Status"
      },
      "description": "Filter incidents to only the listed statuses. Empty list returns all statuses."
    },
    "timeFilterSelection": {
      "description": "Time window applied to the incident's creation time, or to its last-modified time when `filterByLastModified` is `true`. Defaults to the last 24 hours.",
      "$ref": "#/$defs/TimeFilterSelection"
    },
    "filterByLastModified": {
      "type": "boolean",
      "description": "When `true`, `timeFilterSelection` bounds the incident's last-modified time instead of its creation time, and each page is ordered by last-modified time descending. Use this to synchronise updates into an external system: poll a short window that ends at the time of the call and receive every incident whose Microsoft Sentinel or Microsoft Defender XDR record changed in that window (alert grouped in, severity, status, owner, label, comment), including incidents created long before the window. An incident created inside the window but modified after its end is not in this window; it appears in the next one. In this mode each workspace's window is returned in full in one call unless it exceeds the server's page cap; if `moreIncidentsAvailable` is `true`, narrow the window rather than paging, because vendor continuations are positional and a concurrent edit can shift them. The timestamp is the vendor's (`lastModifiedTimeUtc` / `lastUpdateDateTime`), not `lastActivityTime`. Supported for `Sentinel` and `DefenderXDR` only: an empty `sources` list selects those two, and listing any other source together with this flag returns 400."
    },
    "workspacePageTokens": {
      "type": [
        "null",
        "array"
      ],
      "items": {
        "description": "Opaque continuation tokens for a single workspace, partitioned by incident source.",
        "$ref": "#/$defs/WorkspaceSourcePageTokens"
      },
      "description": "Opaque pagination tokens echoed from the previous response's `SourcePageTokens`.\nLeave empty on the first call. See type-level remarks for the pagination protocol."
    },
    "query": {
      "type": [
        "null",
        "string"
      ],
      "description": "Free-text search applied across incident title/description fields. Empty matches all."
    },
    "isFirstCall": {
      "type": "boolean",
      "description": "`true` for the initial request; `false` when echoing\n        List<WorkspaceSourcePageTokens> ListIncidentsAcrossWorkspacesRequest.WorkspacePageTokens back for subsequent pages. See type-level\n        remarks for the pagination protocol."
    },
    "sources": {
      "type": [
        "null",
        "array"
      ],
      "items": {
        "$ref": "#/$defs/IncidentSource"
      },
      "description": "Filter incidents to only the listed sources (e.g. Sentinel, DefenderXDR,\nCrowdStrike). Empty list returns all sources the caller has access to."
    },
    "assigneeIds": {
      "type": [
        "null",
        "array"
      ],
      "items": {
        "type": "string"
      },
      "description": "Filter incidents assigned to any of the listed ContraForce user IDs."
    },
    "assigneeEmails": {
      "type": [
        "null",
        "array"
      ],
      "items": {
        "type": "string"
      },
      "description": "Filter incidents assigned to any of the listed user email addresses."
    },
    "includeUnassigned": {
      "type": "boolean",
      "description": "When `true`, include incidents that have no assignee alongside any\nmatches from List<string> ListIncidentsAcrossWorkspacesRequest.AssigneeIds / List<string> ListIncidentsAcrossWorkspacesRequest.AssigneeEmails."
    }
  },
  "$defs": {
    "IncidentSource": {
      "enum": [
        "Sentinel",
        "DefenderXDR",
        "QRadar",
        "Splunk",
        "CrowdStrike",
        "SentinelOne",
        "SumoLogic"
      ]
    },
    "Severity": {
      "enum": [
        "Informational",
        "Low",
        "Medium",
        "High"
      ]
    },
    "Status": {
      "enum": [
        "Active",
        "New",
        "Closed",
        "OnHold",
        "WaitingOnCustomer"
      ]
    },
    "TimeFilterSelection": {
      "type": "object",
      "properties": {
        "type": {
          "$ref": "#/$defs/TimeFilteringType"
        },
        "customStartUtc": {
          "type": [
            "null",
            "string"
          ],
          "format": "date-time"
        },
        "customEndUtc": {
          "type": [
            "null",
            "string"
          ],
          "format": "date-time"
        }
      },
      "description": "Canonical representation of a global time filter.\nWhen Type == Custom, CustomStartUtc and CustomEndUtc must be provided (UTC)."
    },
    "TimeFilteringType": {
      "enum": [
        "ThreeHours",
        "SixHours",
        "TwelveHours",
        "TwentyFourHours",
        "FortyEightHours",
        "Custom",
        "SevenDays",
        "ThirtyDays",
        "NinetyDays",
        "OneHundredEightyDays",
        "SixtyDays",
        null
      ]
    },
    "WorkspaceSourcePageTokens": {
      "type": "object",
      "properties": {
        "workspaceId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Identifier of the workspace these tokens belong to."
        },
        "sourceTokens": {
          "type": [
            "null",
            "object"
          ],
          "additionalProperties": {
            "type": "string"
          },
          "description": "Per-source continuation tokens. Each entry represents one more page of incidents\navailable from that source within this workspace; absent sources have no further\npages."
        }
      },
      "description": "Opaque continuation tokens for a single workspace, partitioned by incident source."
    }
  }
}