---
title: "Classify Incident"
description: "Sets the NIS-2 category of an Incident Management incident (availability, security, other) and marks it as a near miss."
---

`POST /api/im/incidents/:id/classification`

Classifies an incident for NIS-2 reporting (Implementing Regulation (EU) 2024/2690, Annex 3.1): its `category` and whether it was a near miss (`isNearMiss`, an event that could have affected availability, integrity or confidentiality but did not). New incidents start with `category: null` (not classified yet) and `isNearMiss: false`; nothing sets them automatically. Allowed in every status, also after the incident is resolved.

Fields you leave out stay unchanged. The change is recorded on the incident timeline as a `classification_changed` event (with `from` and `to` per changed field) and in the organization audit log. It pages nobody and is not sent to status pages or outbound integrations. A request that changes nothing writes nothing and returns the incident as it is.

With NIS-2 on, a resolved incident with category `security` always needs a [postmortem](/api/incident-management/postmortems), whatever its severity, and a [report case](/api/incident-management/report-cases) linked to it suggests the criterion `malicious_unauthorized_access`.

## Authentication

Any IM-eligible role (`admin`, `editor`, `responder`) or an organization-wide API token, see [Authentication](/api/incident-management#authentication). Incident Management must be enabled for the organization. You must be a member of the incident's team, or an organization `admin`.

## Request Body

| Field | Type | Required | Description |
|-------|------|----------|--------------|
| `category` | string or null | No* | One of `availability`, `security`, `other`. `null` clears it (not classified). |
| `isNearMiss` | boolean | No* | `true` marks the incident as a near miss. |

\* At least one of the two. Any other key is rejected.

## Example (cURL)

```bash
curl -X POST "$BASE_URL/api/im/incidents/42/classification" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "category": "security", "isNearMiss": false }'
```

## Response

`200 OK`: the updated incident row (same shape as the `items` of [List Incidents](/api/incident-management/list-incidents), without the enrichment fields).

```json
{
  "id": 42,
  "teamId": 3,
  "title": "Suspicious logins on the admin panel",
  "severity": "sev3",
  "status": "resolved",
  "category": "security",
  "isNearMiss": false
}
```

(Shortened; the full row is returned.)

## Common errors

- `401 Unauthorized` when not authenticated
- `403 Forbidden` (`customerScopedTokenForbidden`) when using a customer-scoped token
- `403 Forbidden` (`imAccessDenied`) when the session user has no IM-eligible role
- `403 Forbidden` (`imTeamMembershipRequired`) when you are not a member of the incident's team and not an organization `admin`
- `403 Forbidden` (`imNotEnabled`) when Incident Management is not enabled for the organization
- `400 Bad Request` (`invalidRequestBody`) when `:id` is not a positive integer, the body has neither `category` nor `isNearMiss`, `category` is not one of the three values or `null`, `isNearMiss` is not a boolean, or the body has an unknown key
- `404 Not Found` (`imIncidentNotFound`) when the incident does not exist, or belongs to another organization