RunGamebookRequest

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/contraforce/json-schema/contraforce-run-gamebook-request-schema.json",
  "title": "RunGamebookRequest",
  "description": "Public v2 inputs for a new gamebook submission, without portal approval or executor state.",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contraforce-gamebooks-api-openapi.yml#/components/schemas/RunGamebookRequest",
  "required": [
    "incidentId",
    "incidentTitle",
    "source",
    "playbooks"
  ],
  "type": "object",
  "properties": {
    "incidentId": {
      "type": "string",
      "description": "Incident identifier in the authorized route workspace."
    },
    "incidentTitle": {
      "type": "string",
      "description": "Required non-empty incident display title."
    },
    "incidentNumber": {
      "pattern": "^-?(?:0|[1-9]\\d*)$",
      "type": [
        "integer",
        "string"
      ],
      "description": "Optional incident display number.",
      "format": "int32"
    },
    "source": {
      "description": "Detection source of the incident.",
      "$ref": "#/$defs/IncidentSource"
    },
    "isQueued": {
      "type": "boolean",
      "description": "Requests human approval. False never overrides server-side approval requirements."
    },
    "playbooks": {
      "type": "array",
      "items": {
        "description": "Public v2 inputs for one catalog action and its incident target.",
        "$ref": "#/$defs/RunGamebookPlaybookRequest"
      },
      "description": "Actions with unique, contiguous sequence values from 1 through the number of actions."
    }
  },
  "additionalProperties": false,
  "$defs": {
    "IncidentSource": {
      "enum": [
        "Sentinel",
        "DefenderXDR",
        "QRadar",
        "Splunk",
        "CrowdStrike",
        "SentinelOne",
        "SumoLogic"
      ]
    },
    "RunGamebookEntityType": {
      "enum": [
        "User",
        "Endpoint",
        "General",
        "Network",
        "Email"
      ],
      "description": "Action categories supported by the v2 gamebook submission contract."
    },
    "RunGamebookPlaybookRequest": {
      "required": [
        "id",
        "entityType",
        "sequence"
      ],
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "Playbook identifier from the catalog."
        },
        "entityId": {
          "type": [
            "null",
            "string"
          ],
          "description": "Exact incident entity identifier. General actions do not require a target."
        },
        "entityType": {
          "description": "Action category matching the playbook catalog, not the incident entity kind.",
          "$ref": "#/$defs/RunGamebookEntityType"
        },
        "sequence": {
          "pattern": "^-?(?:0|[1-9]\\d*)$",
          "type": [
            "integer",
            "string"
          ],
          "description": "One-based execution position; the complete plan must contain exactly 1..N.",
          "format": "int32"
        },
        "parameters": {
          "type": [
            "null",
            "object"
          ],
          "description": "Optional action configuration, such as the network resource settings for Block IP."
        }
      },
      "additionalProperties": false,
      "description": "Public v2 inputs for one catalog action and its incident target."
    }
  }
}