Add a comment to an Incident Report. Comments are visible to everyone in your account who can see the report, and notify the people on your account who receive Incident Report notifications.

The Huntress SOC is not notified of comments and will not respond to them. To reach the SOC about a remediation plan, reject the plan instead.

This endpoint requires an API key with permissions to comment on incident reports. Note that the default account API key is read-only, so you'll need to create a user-based API key with the appropriate permissions to access this endpoint.

{
  "comment": {
    "id": 1,
    "body": "We have already rebuilt this host.",
    "author": "John Smith",
    "created_at": "2025-06-26T18:57:03Z",
    "updated_at": "2025-06-26T18:57:03Z"
  }
}