---
title: "Updates the incident status."
method: PATCH
path: "/v1/{accountId}/incidents/{incidentId}"
tags: ["Update Incident Status"]
---

# Updates the incident status.

`PATCH /v1/{accountId}/incidents/{incidentId}`

## Request

- Base URL: `https://api.usa.cloud.watchguard.com/rest/threatsync/management`
- URL: `https://api.usa.cloud.watchguard.com/rest/threatsync/management/v1/{accountId}/incidents/{incidentId}`
- Auth: API key in header `WatchGuard-API-Key` and HTTP bearer
- TypeScript: <https://skmtc.dev/watchguard/apis/threatsync-management-api/docs/v1/:accountId/incidents/:incidentId/patch.ts> (a function with typed inputs; its response is checked against the schema)

Updates the status of a specific incident.

## Path parameters

- `accountId` string, required
- `incidentId` string, required

## Request body

- object
  - `status` string, required: Updated incident status. This can be one of these values: - new - New incidents not yet reviewed. - read - Reviewed incidents or incidents marked as read. - closed - Incidents closed by an automation policy or manual action.
  - `comment` string: Comment on an incident.

## Response `200`

Successful response.

- UpdateIncident: Incident information.
  - `id` string: ID of the incident.
  - `account` string: Account ID.
  - `category` string: Category of the incident.
  - `type` string: Specific type of incident within an incident category.
  - `timestamp` string: Date and time the incident was created.
  - `threatScore` integer: Threat score of incident.
  - `severity` string: The severity of the incident. Possible values are Low, Medium, High, and Critical.
  - `description` string: A description of the incident.
  - `remediated` boolean: Remediation status of the incident.
  - `entities` object: Details of the entity that the incident belongs to.
    - `8ed6cbce746d4597A6469bbc0c4edce9` object: Entity data.
      - `type` string: Type of entity.
      - `recommendedActions` object[]: List of recommended actions.
        - `command` string: Action to take.
        - `parameters` object: Parameters of an action.
          - `md5` string: The MD5 hash of the file or process associated with the incident.
      - `actionPerformed` object: Information about an action that was performed at the source in response to the event.
        - `command` string: Performed action.
        - `parameters` object: Parameters of an action.
          - `md5` string: The MD5 hash of the file or process associated with the incident.
      - `threatDetails` object: Threat details of an incident.
        - `malware` string: The name of the malware associated with the incident.
        - `file` string: The local path of a file on the computer associated with the incident.
        - `md5` string: The MD5 hash of the file or process associated with the incident.
  - `entityIds` string[]
  - `status` string: Specifies the status of the incident. This can be one of these values: - new - New incidents not yet reviewed. - read - Reviewed incidents or incidents marked as read. - closed - Incidents closed by an automation policy or manually closed.
  - `lastUpdateTime` string: The date and time (in UTC) when the incident status was last changed.
  - `updatedBy` string: The name of the operator that updated the incident status. Or "system" if the update was in response to an automated action.

## Other responses

- `default`: Error response.

---

[API](https://skmtc.dev/watchguard/apis/threatsync-management-api.md) - [All operations](https://skmtc.dev/watchguard/apis/threatsync-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/watchguard/apis/threatsync-management-api/revisions/2993b1908d27?raw)