---
title: "Build a Case around a Reference Alert, or a Signal Alert"
method: POST
path: "/create"
tags: ["Case"]
---

# Build a Case around a Reference Alert, or a Signal Alert

`POST /create`

Create a new case linked to a reference alert (document-based) or signal alert (entity risk-based) for triage and investigation.

## Request body

- CreateCaseRequest — Request to create a new case from an alert context.
  - `context` CreateContext — unresolved $ref
  - `organization` string, identity — Organization identity string in uhash:<hash> format (e.g., uhash:2vefBNqkbi). This is the organization ID, not a user identity.
  - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved' — The Status of the Case
  - `priority` 'Informational' | 'Moderate' | 'High' — The Priority of the Case
  - `title` string
  - `description` string
  - `assignee` string, identity — Organization identity string in uhash:<hash> format (e.g., uhash:2vefBNqkbi). This is the organization ID, not a user identity.

## Response `200`

Success

- CreateCaseResponse — Newly created case with its assigned ID.
  - `status` Status — API response status with code and message.
    - `status_code` string
    - `status_message` string
  - `data` string, identity — The identity of a task

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)