Create a secret incident for the secret of each identity, as the "Promote to incident" action of the dashboard does. An identity whose secret already has an incident reuses it and adds its missing occurrences.

One call takes 1 to 100 identities and returns one result for each identity. To promote more identities, make several calls, one after the other.

An identity is skipped when its secret cannot become an incident: no secret, no secret hash, or no detector. An identity that is not in the workspace, or whose places cannot be found any more, is skipped too.

The workspace must have NHI governance activation and NHI incident promotion. The API token must have the Manager access level or above, or be a service account token.

{
  "identity_ids": [
    1234,
    1235
  ]
}

{
  "created_count": 1,
  "skipped_count": 1,
  "results": [
    {
      "identity_id": 1234,
      "incident_ids": [
        5678
      ]
    }
  ]
}