Update an event
/api/v1/events/{event_uuid}
operationId: event.update
Base: https://portal.watcheye.com.au/api/v1/events/{event_uuid}
Update an event's status and/or attach a note. At least one of status or note must
be supplied; sending neither returns 400 No updates to apply.
Status
The status field accepts any of the lifecycle values:
new- the default starting stateinvestigating- someone (or some integration) is actively working the eventclosed_dismissed- reviewed and dismissed (e.g. false positive)closed_duplicate- this event duplicates another eventclosed_error- the event was caused by a data entry errorclosed_confirmed- the event has been confirmed and acted on
Notes
The note field accepts up to 5000 characters. Each PATCH that supplies a note value
creates a new note attached to the event - this endpoint does not update an existing
note. Notes created via this endpoint are attributed to the calling API key (the response
notes[].created_by carries { type: "api_key", uuid, label }) and cannot be edited
or deleted from the portal. Any API key on the same account can manage them via the
notes PATCH / DELETE endpoints.
They appear in the portal alongside notes created by portal users.
Author attribution
When this endpoint changes the status, the event's "last actioned by" attribution in the
portal is cleared because an API key is not a user. The audit log records the API key
and the request api_reference UUID, so you can always identify which integration made
the change.
Path parameters
| Field | Description |
|---|---|
event_uuidrequired |
string (uuid) The event UUID |
Request body
Content type application/json.
At least one of `status` or `note` must be supplied.
| Field | Description |
|---|---|
status |
string |
note |
string [max 5000 characters] Free-text note to attach to the event. Max 5000 characters. |
Responses
Event updated
application/json
| Field | Description |
|---|---|
data |
object Same as Event, plus the embedded |
data. |
string (uuid) The event's UUID |
data. |
string A short obfuscated public identifier for the event |
data. |
string Lifecycle status of the event |
data. |
string The operation type of the parent check |
data. |
string or null Short, human-readable summary of the parent check |
data. |
integer or null Index into the parent check's |
data. |
array of integers Provider-side result identifiers that triggered this event |
data. |
string (date-time) or null |
data. |
string (date-time) or null |
data. |
string (uuid) |
data. |
string (uuid) |
data. |
string (uuid) |
data. |
integer |
data. |
array of objects All notes attached to the event, oldest first. |
data. |
string (uuid) The note's UUID |
data. |
string The free-text content of the note (max 5000 characters) |
data. |
object or null Identifies who created the note. The
|
data. |
string Discriminator for the actor type. |
data. |
string (uuid) UUID of the user or API key that created the note. |
data. |
string Username of the portal user. Present only when |
data. |
string Label of the API key. Present only when |
data. |
boolean When true, the note is an immutable audit-trail entry (for example, a bulk-update record) and cannot be edited or deleted through any channel. |
data. |
string (date-time) ISO 8601 timestamp at which the note was created |
data. |
string (date-time) ISO 8601 timestamp at which the note was last updated |
data. |
string (date-time) |
api_reference |
string (uuid) |