---
title: "NIS-2 Settings"
description: "Switch NIS-2 report cases on for your organization, set the entity classification and choose the reporting officers."
---

`GET /api/im/nis2/settings` · `PUT /api/im/nis2/settings`

Report cases help you meet the NIS-2 reporting deadlines (24 h early warning, 72 h notification, final report after one month). They are off by default. You submit every report yourself in the BSI portal; Uptimeify transmits nothing and never classifies an incident on its own.

## Authentication

Session only (dashboard login). API tokens, including organization-wide tokens, are rejected with `403` (`nis2OfficerRequired`). Requires Incident Management access (`admin`, `editor` or `responder`). Reading is open to organization admins and the listed reporting officers, also while report cases are switched off (then admins and the listed reporting officers can still read the settings; only admins can change them). **Updating** requires the `admin` role.

## Get settings

`GET /api/im/nis2/settings`

### Example (cURL)

```bash
curl "$BASE_URL/api/im/nis2/settings" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Accept: application/json"
```

### Response

`200 OK`

```json
{
  "enabled": true,
  "entityClass": "important",
  "officers": [
    { "userId": "u_8f2c", "name": "Jana Weber", "email": "jana.weber@example.com" }
  ],
  "canEdit": true
}
```

| Field | Description |
|-------|-------------|
| `enabled` | Report cases are switched on. Default `false`. |
| `entityClass` | `important` (important entity), `essential` (essential entity) or `kritis` (operator of critical facilities). `kritis` adds the facility and critical service to the report drafts. |
| `officers` | Reporting officers. They receive the deadline reminders. Admins always have access and are not listed. |
| `canEdit` | `true` for organization admins. |

## Update settings

`PUT /api/im/nis2/settings`

Replaces the settings and the officer list. Any other key is a `400`.

### Request Body

| Field | Type | Required | Description |
|-------|------|----------|-------------|
| `enabled` | boolean | Yes | Switch report cases on or off. |
| `entityClass` | string | Yes | `important`, `essential` or `kritis`. |
| `officerUserIds` | string[] | Yes | User IDs of this organization with the role `admin`, `editor` or `responder`, at most 100. Editors assigned to a customer are customer-side and rejected. `[]` clears the list. |

### Example (cURL)

```bash
curl -X PUT "$BASE_URL/api/im/nis2/settings" \
  -H "Cookie: $SESSION_COOKIE" \
  -H "Content-Type: application/json" \
  -d '{ "enabled": true, "entityClass": "kritis", "officerUserIds": ["u_8f2c"] }'
```

### Response

`200 OK`: the saved settings, same shape as the GET response.

## Common errors

- `401 Unauthorized` (`unauthorized`) when not signed in
- `403 Forbidden` (`imAccessDenied`) for a customer login or a role without Incident Management access
- `403 Forbidden` (`nis2OfficerRequired`) for an API token, or a user who is neither admin nor reporting officer
- `403 Forbidden` (`nis2AdminRequired`) when updating without the `admin` role
- `400 Bad Request` (`invalidRequestBody`) when a field is missing, has the wrong type, `entityClass` is not an allowed value, or the body has an unknown key
- `400 Bad Request` (`nis2InvalidOfficer`) when an officer is not a user of your organization with the role `admin`, `editor` or `responder`