---
title: "Investigation Follow Up V2"
method: POST
path: "/v2/investigation/follow-up"
---

# Investigation Follow Up V2

`POST /v2/investigation/follow-up`

## Request

- Base URL: `https://api.traversal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.traversal.com/v2/investigation/follow-up`
- Auth: none declared

V2 investigation follow-up endpoint that accepts thinking_mode parameter.

The thinking_mode parameter determines how the follow-up is conducted:
- AUTO: Uses message classifier to determine RCA vs CHAT investigation
- DEEP: Forces RCA (root cause analysis) investigation
- FAST: Forces CHAT (exploratory) investigation

## Request body

- InvestigationFollowUpRequest
  - `session_id` string, required
  - `user_uuid` string, nullable
  - `user_message` string, required
  - `config_name` string, required
  - `files` RequestFile[]
    - `file_name` string, required
    - `base64_file` string
    - `mime_type` string, nullable
    - `url` string, nullable
  - `mode` 'rca' | 'chat' | 'triage' | 'alert_story'
  - `thinking_mode` 'auto' | 'deep' | 'fast' | 'lightning' | 'ultra': Determines the investigation depth and approach. - AUTO: Use message classifier to determine RCA vs CHAT - DEEP: Force RCA (root cause analysis) investigation - FAST: Force CHAT (exploratory) investigation - LIGHTNING: Fast, tool-rich investigation with tight iteration cap. Uses the union of all tools from fast + deep configs with a speed-focused prompt. - ULTRA: Same agent config as DEEP. The client-side trigger for first-turn ensembling. A no-op on follow-ups.
  - `alert_params` AlertParams: Parameters for alert-based investigations.
    - `start_time` string, required
    - `end_time` string, required
    - `status` 'escalated' | 'anomalous' | 'dismissed': Derived status for an alert event based on escalation and anomaly detection.
    - `search_query` string, nullable
  - `context_items` ContextItem[]
    - `id` string, required
    - `organization_id` string, required
    - `context_item_name` 'central_id' | 'function' | 'application' | 'service' | 'team' | 'url_endpoint' | 'correlation_id' | 'topology_node' | 'account' | 'storage' | 'environment' | 'cluster' | 'snow_alert' | 'snow_incident' | 'snow_problem' | 'snow_change_request' | 'customer_journey' | 'domain' | 'mim_id' | 'monitor_id', required: Enum for context item names.
    - `value` string, required
    - `metadata` object, required
  - `services_context` ServiceContext[]
    - `id` string, required
    - `name` string, required
    - `description` string, nullable

## Response `200`

Successful Response

- InvestigationFollowUpResponse
  - `session_id` string, required
  - `system_chat_id` string, required
  - `user_chat_id` string, required

## Other responses

- `422`: Validation Error

## Changes

> 66 revisions in range; 9 not diffed.

- **2026-09-11** `c5e1ea955e81`: 1 info
  - added the new `ultra` enum value to the request property `thinking_mode/anyOf[subschema #1: ThinkingMode]/`

[Operation history](https://skmtc.dev/traversal/apis/traversal-api/changes/v2/investigation/follow-up/post.md)

---

[API](https://skmtc.dev/traversal/apis/traversal-api.md) - [All operations](https://skmtc.dev/traversal/apis/traversal-api/llms.txt) - [OpenAPI document](https://skmtc.dev/traversal/apis/traversal-api/revisions/31e1a8b7cf89?raw)