Classify Incident

POST /api/im/incidents/:id/classification

Classifies an incident for NIS-2 reporting (Implementing Regulation (EU) 2024/2690, Annex 3.1): its category and whether it was a near miss (isNearMiss, an event that could have affected availability, integrity or confidentiality but did not). New incidents start with category: null (not classified yet) and isNearMiss: false; nothing sets them automatically. Allowed in every status, also after the incident is resolved.

Fields you leave out stay unchanged. The change is recorded on the incident timeline as a classification_changed event (with from and to per changed field) and in the organization audit log. It pages nobody and is not sent to status pages or outbound integrations. A request that changes nothing writes nothing and returns the incident as it is.

With NIS-2 on, a resolved incident with category security always needs a postmortem, whatever its severity, and a report case linked to it suggests the criterion malicious_unauthorized_access.

AuthenticationCopy Anchor Link

Any IM-eligible role (admin, editor, responder) or an organization-wide API token, see Authentication. Incident Management must be enabled for the organization. You must be a member of the incident's team, or an organization admin.

Request BodyCopy Anchor Link

* At least one of the two. Any other key is rejected.

Example (cURL)Copy Anchor Link

curl -X POST "$BASE_URL/api/im/incidents/42/classification" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "category": "security", "isNearMiss": false }'

ResponseCopy Anchor Link

200 OK: the updated incident row (same shape as the items of List Incidents, without the enrichment fields).

{
  "id": 42,
  "teamId": 3,
  "title": "Suspicious logins on the admin panel",
  "severity": "sev3",
  "status": "resolved",
  "category": "security",
  "isNearMiss": false
}

(Shortened; the full row is returned.)

Common errorsCopy Anchor Link

• 401 Unauthorized when not authenticated
• 403 Forbidden (customerScopedTokenForbidden) when using a customer-scoped token
• 403 Forbidden (imAccessDenied) when the session user has no IM-eligible role
• 403 Forbidden (imTeamMembershipRequired) when you are not a member of the incident's team and not an organization admin
• 403 Forbidden (imNotEnabled) when Incident Management is not enabled for the organization
• 400 Bad Request (invalidRequestBody) when :id is not a positive integer, the body has neither category nor isNearMiss, category is not one of the three values or null, isNearMiss is not a boolean, or the body has an unknown key
• 404 Not Found (imIncidentNotFound) when the incident does not exist, or belongs to another organization