openapi: 3.2.0 info: title: Privacy Automation - Incident Management Incidents API description: The Incident Management API allows you to efficiently manage and respond to incidents. version: '1.0' contact: name: OneTrust Support url: https://my.onetrust.com/s/contactsupport license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0 servers: - url: https://{hostname}/api variables: hostname: default: hostname description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com. tags: - name: Incidents description: APIs used to create, update, search, and manage incidents, including linking incidents to inventories, retrieving details, and tracking their lifecycle. externalDocs: description: OpenAPI 3.1.0 - Download Definition url: https://developer.onetrust.com/onetrust/openapi/privacy-automation-incident-management.json paths: /incident/v1/assignments/entities/{entityId}/stage: post: operationId: assignStageByName summary: Update Incident Stage description: Use this API to update the workflow stage for a specific incident by its unique identifier. tags: - Incidents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-incident-management.json parameters: - name: entityId in: path description: Incident ID required: true schema: type: string format: uuid example: f7114aef-b6b6-42d6-9249-56a467950aa7 requestBody: required: true content: application/json: schema: example: nextStageName: Remediating parameters: executeRule: true justification: stagechangejustification $ref: '#/components/schemas/WorkflowSpecificStageNavigationRequest' responses: '200': description: Successfully assigned the workflow stage. content: application/json: schema: example: id: e567cdde-4c72-46d5-865d-b5b3264d0bab name: Remediating description: Remediating $ref: '#/components/schemas/WorkflowStageListInformation' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - INCIDENT /incident/v1/assignments/entities/{entityId}/types/{type}/stage: post: operationId: assignStageByName_1 summary: Update Incident Stage by Type description: Use this API to update the workflow stage for a specific incident by its unique identifier and workflow type. tags: - Incidents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-incident-management.json parameters: - name: entityId in: path description: Incident ID required: true schema: type: string format: uuid example: f7114aef-b6b6-42d6-9249-56a467950aa7 - name: type in: path required: true schema: type: string example: IncidentWorkflowType requestBody: required: true content: application/json: schema: example: nextStageName: Remediating parameters: executeRule: true justification: stagechangejustification $ref: '#/components/schemas/WorkflowSpecificStageNavigationRequest' responses: '200': description: Successfully assigned the workflow stage. content: application/json: schema: example: id: e567cdde-4c72-46d5-865d-b5b3264d0bab name: Remediating description: Remediating $ref: '#/components/schemas/WorkflowStageListInformation' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - INCIDENT /incident/v1/incidents: post: operationId: createIncidentUsingPOST summary: Create Incident description: Use this API to create a new incident in the Incident Register by providing the necessary details in the request body. The response will return the unique identifier (UUID) of the newly created incident. tags: - Incidents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-incident-management.json requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/IncidentCreateRequest' responses: '201': description: Incident created successfully. The response contains the UUID of the newly created incident. content: application/json: schema: type: string format: uuid example: f7114aef-b6b6-42d6-9249-56a467950aa7 '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - INCIDENT_CREATE - INCIDENT /incident/v1/incidents/search: post: operationId: searchIncidentsUsingPOST summary: Search Incidents description: Use this API to search for incidents by key terms and filters. tags: - Incidents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-incident-management.json parameters: - name: page in: query description: Page number (0-based index) schema: type: integer default: 0 minimum: 0 example: 1 - name: size in: query description: Number of records per page schema: type: integer default: 20 maximum: 2000 minimum: 1 example: 50 - name: sort in: query description: 'Sort criteria in the format: property,(asc|desc)' schema: type: string enum: - createdDate,asc - createdDate,desc - name,asc - name,desc example: createdDt,desc requestBody: content: application/json: schema: $ref: '#/components/schemas/SearchCriteriaInformation' responses: '200': description: OK content: application/json: schema: type: array items: $ref: '#/components/schemas/IncidentListInformation' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - INCIDENT - INCIDENT_READ /incident/v1/incidents/{incidentId}: get: operationId: getIncidentDetailByIncidentIdUsingGET summary: Get Incident description: Use this API to retrieve a single incident by its unique identifier along with the linked assessments, status, and the associated attributes. tags: - Incidents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-incident-management.json parameters: - name: incidentId in: path description: Unique identifier of the incident. The value can be obtained using Create Incident API. required: true schema: description: Incident ID type: string format: uuid example: f7114aef-b6b6-42d6-9249-56a467950aa7 responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/IncidentDetails' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - INCIDENT - INCIDENT_READ put: operationId: updateIncidentUsingPUT summary: Update Incident description: Use this API to update the details of a specific incident by providing the incident's unique ID in the URL path and the updated information in the request body. The response will return the updated incident information. tags: - Incidents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-incident-management.json parameters: - name: incidentId in: path description: ID of an incident. The value can be obtained using Create Incident API. required: true schema: description: Incident ID type: string format: uuid example: f7114aef-b6b6-42d6-9249-56a467950aa7 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/IncidentUpdateRequest' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/IncidentInformation' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - INCIDENT /incident/v1/incidents/{incidentId}/inventory-links/{inventoryType}: post: operationId: createInventoryLinks summary: Link Incident to Inventory description: Use this API to link an incident with a specific inventory type. tags: - Incidents x-onetrust: spec-label: https://developer.onetrust.com/onetrust/openapi/privacy-automation-incident-management.json parameters: - name: incidentId in: path description: Incident ID required: true schema: type: string format: uuid example: f7114aef-b6b6-42d6-9249-56a467950aa7 - name: inventoryType in: path description: 'Type of inventory being linked. Allowed values: {assets, processing-activities, vendors, entities}' required: true schema: type: string enum: - assets - processing-activities - vendors - entities example: assets requestBody: required: true content: application/json: schema: description: Inventory Link Creation Request $ref: '#/components/schemas/InventoryLinkCreationRequest' responses: '201': description: Inventory links successfully created content: application/json: schema: description: List of inventory link associations $ref: '#/components/schemas/InventoryLinkAssociationInformation' '400': description: Bad Request '401': description: Unauthorized '403': description: Forbidden '429': description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)." headers: Retry-After: schema: description: The number of seconds after which requests will be allowed again. format: int32 ot-period: schema: description: The unit of time for which the rate limit applies enum: - HOUR - MINUTE ot-ratelimit-event-id: schema: description: The unique identifier for the rate-limiting event. format: uuid ot-request-made: schema: description: The number of requests made within the specified period. format: int32 ot-requests-allowed: schema: description: The number of requests allowed within the specified period. format: int32 '500': description: Internal Server Error security: - OAUTH2: - INCIDENT components: schemas: AssessmentInformation: type: object properties: assessmentId: description: Assessment Identifier type: string format: uuid assessmentName: description: Assessment Name type: string example: Incident Assessment assessmentStatus: description: Assessment Status type: string example: IN_PROGRESS enum: - NOT_STARTED - IN_PROGRESS - UNDER_REVIEW - COMPLETED primary: type: boolean required: - assessmentId IncidentListInformation: type: object properties: incidentId: description: Incident Identifier type: string format: uuid example: 1d429adf-26c5-413b-9b01-e7845a5dde99 number: description: Incident Number type: integer format: int64 example: 1 incidentTypeId: description: The unique identifier for the incident type. type: string format: uuid incidentTypeName: description: The name of the incident type. type: string example: Misdirected Email description: description: Incident Description type: string example: 'An employee accessed a restricted HR file without proper authorization. Access logs confirmed the breach, and the user’s permissions were immediately revoked. ' sourceType: description: Creation Source type: string example: INTEGRATION enum: - MANUAL - ASSESSMENT - WEBFORM - NONE - INTEGRATION orgGroupId: description: Organization Group Id type: string format: uuid orgGroupName: description: Organization Group Name type: string example: Business Unit dateOccurred: description: The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-01T12:43:24.173Z' dateClosed: description: The date and time when the incident was closed, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-03T12:43:24.173Z' dateDiscovered: description: The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-02T12:43:24.173Z' deadline: description: The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-03T12:43:24.173Z' assigneeName: description: Incident User Assignee Name type: string example: User Name totalAssessment: description: Count of Assessment Linked to this Incident type: integer format: int64 example: 0 isExtended: description: Indicates whether the notification deadline has been extended. type: boolean isDeleted: description: Indicates whether the incident has been deleted. type: boolean example: false createdBy: description: Incident Created User Id. type: string format: uuid creator: description: Incident Created User Name type: string example: User Name createdDate: description: The date and time when the incident was created, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-02T13:00:00.173Z' name: description: Incident Name type: string example: Joe sent an email to the wrong client openAssessment: description: Count of Open Assessments Linked to this Incident type: integer format: int64 example: 1 workflowId: description: Incident Workflow Id type: string format: uuid workflowName: description: Incident Workflow Name. type: string example: Default Workflow incidentStageId: description: Incident Stage Id type: string format: uuid incidentStageName: description: Incident Stage Name type: string example: Investigating incidentStageBadgeColor: description: The badge color of the incident workflow stage. type: string example: InProgress notificationNeeded: description: Incident Notification Needed type: string example: UNKNOWN enum: - 'YES' - 'NO' - UNKNOWN incidentStatus: description: Incident Status type: string example: OPEN enum: - OPEN - CLOSED attributeValues: description: Custom Attributes type: object example: customTextAttributeFieldName: - value: Attribute Value disabled: false customSingleSelectAttributeFieldName: - id: 0f5afc29-7fe1-4145-b541-ac33158312b6 value: Option Value 1 disabled: false customMultiSelectAttributeFieldName: - id: 736a8cb4-4e0e-4938-a43f-74edbaf46c0a value: Option Value 2 disabled: false - id: b4e17ed9-5e11-44f8-bb20-100af4d9e39b value: Option Value 3 disabled: false additionalProperties: type: array items: $ref: '#/components/schemas/AttributeValueInformation' IncidentSourceType: type: string example: INTEGRATION default: MANUAL enum: - MANUAL - ASSESSMENT - WEBFORM - INTEGRATION IncidentJurisdictionGuidanceInformation: type: object properties: jurisdictionId: description: Incident Jurisdiction Id type: string format: uuid regionName: description: Region Name type: string example: Americas countryName: description: Country Name type: string example: United States of America countryCode: description: Country Code type: string example: USA stateProvinceName: description: State Province Name type: string example: California stateProvinceCode: description: State Province Code type: string example: CA urgency: description: Urgency type: string example: HIGH enum: - LOW - MEDIUM - HIGH - NONE notifyIndividual: description: Individual Incident Guidance Notification State type: string example: NOTIFICATION_REQUIRED enum: - NOTIFICATION_REQUIRED - NOTIFICATION_NOT_REQUIRED - NEEDS_MORE_INFO notifyIndividualDeadline: description: The recommended deadline by which an individual should be notified, represented as an ISO 8601 timestamp in UTC. type: string format: date-time notifyAuthority: description: Guidance Notify Authority type: string example: NOTIFICATION_REQUIRED enum: - NOTIFICATION_REQUIRED - NOTIFICATION_NOT_REQUIRED - NEEDS_MORE_INFO notifyAuthorityDeadline: description: The recommended notification deadline for an authority, in ISO 8601 UTC format. type: string format: date-time numberOfGuidances: description: Number Of Guidances type: integer format: int32 example: 2 numberOfAcceptedGuidances: description: Number Of Accepted Guidances type: integer format: int32 example: 1 numberOfAddressedGuidances: description: Number Of Addressed Guidances type: integer format: int32 example: 1 LinkCreationMode: type: string example: INTEGRATION default: MANUAL enum: - MANUAL - ASSESSMENT - INTEGRATION InventoryLinkAssociationInformation: type: object properties: inventoryType: description: Type of the associated inventory type: string example: assets enum: - assets - processing-activities - vendors - entities id: description: Unique identifier of the associated inventory type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440001 name: description: Name of the associated inventory type: string example: Customer Data Asset organization: description: Organization of the associated inventory example: id: d1119953-b4b5-4042-8cb9-b78038cc2c46 name: Organization $ref: '#/components/schemas/EntityOrganizationInformation' IncidentDetails: type: object properties: id: description: Incident Identifier type: string format: uuid example: 1d429adf-26c5-413b-9b01-e7845a5dde99 number: description: Incident Number type: integer format: int64 example: 1 incidentTypeId: description: The unique identifier for the incident type. type: string format: uuid incidentTypeName: description: The name of the incident type. type: string example: Misdirected Email name: description: Incident Name type: string example: Joe sent an email to the wrong client description: description: Incident Description type: string example: 'An employee accessed a restricted HR file without proper authorization. Access logs confirmed the breach, and the user’s permissions were immediately revoked. ' sourceType: description: Creation Source type: string example: INTEGRATION enum: - MANUAL - ASSESSMENT - WEBFORM - NONE - INTEGRATION assessmentLinks: description: Source Assessment Link type: array items: $ref: '#/components/schemas/AssessmentInformation' orgGroupId: description: Organization Group Id type: string format: uuid orgGroupName: description: Organization Group Name type: string example: Business Unit rootCause: description: Root Cause type: string example: 'The root cause was traced to a lack of validation in the email recipient auto-fill feature, leading to sensitive data being sent to the wrong external recipient. ' dateOccurred: description: The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-21T05:22:40.187Z' dateClosed: description: The date and time when the incident was closed, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-28T05:22:40.187Z' dateDiscovered: description: The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-21T12:22:40.187Z' deadline: description: The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-23T05:22:40.187Z' createdBy: description: Incident Created User Id. type: string format: uuid creator: description: Incident Created User Name type: string example: User Name assigneeId: description: Incident User Assignee Id type: string format: uuid assigneeName: description: Incident User Assignee Name type: string example: User Name createdDT: description: The date and time when the incident was created, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-21T14:10:00.187Z' workflowId: description: Incident Workflow Id type: string format: uuid workflowName: description: Incident Workflow Name. type: string example: Default Workflow incidentStageId: description: Incident Stage Id type: string format: uuid incidentStageName: description: Incident Stage Name type: string example: Investigating incidentStageBadgeColor: description: The badge color of the incident workflow stage. type: string example: InProgress notificationNeeded: description: Incident Notification Needed type: string enum: - 'YES' - 'NO' - UNKNOWN incidentStatus: description: Incident Status type: string example: OPEN enum: - OPEN - CLOSED $ref: '#/components/schemas/IncidentStatus' schemaId: description: The unique identifier of the custom attribute schema associated with the incident. type: string format: uuid updatedDT: description: The date and time when the incident was last updated, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-28T05:22:40.187Z' attributeValues: description: Custom Attributes type: object example: customTextAttributeFieldName: - value: Attribute Value disabled: false customSingleSelectAttributeFieldName: - id: 0f5afc29-7fe1-4145-b541-ac33158312b6 value: Option Value 1 disabled: false customMultiSelectAttributeFieldName: - id: 736a8cb4-4e0e-4938-a43f-74edbaf46c0a value: Option Value 2 disabled: false - id: b4e17ed9-5e11-44f8-bb20-100af4d9e39b value: Option Value 3 disabled: false additionalProperties: type: array items: $ref: '#/components/schemas/NamedAttributeValueInformation' incidentAssigneeInformation: description: A list containing information about users or groups assigned to the incident type: array items: $ref: '#/components/schemas/IncidentAssigneeInformation' attachments: description: List of attachments associated with this incident, including both files and URL links type: array items: $ref: '#/components/schemas/IncidentAttachmentResponse' example: - attachmentId: 3fa85f64-5717-4562-b3fc-2c963f66afa6 name: evidence.pdf description: Evidence document type: FILE link: https://example.com/attachments/evidence.pdf createdDate: '2025-04-21T14:10:00.187Z' creator: id: 1d429adf-26c5-413b-9b01-e7845a5dde99 name: John Doe closedSettingOn: type: boolean EntityOrganizationInformation: type: object properties: id: description: The unique identifier of the organization. type: string format: uuid example: f2229953-b4b5-4042-8cb9-b78038cc4c46 name: description: The name of the organization. type: string example: Business Unit required: - id AdvanceStageActionInformation: type: object properties: id: description: Advance Stage Action Identifier type: string format: uuid actionType: description: Advance Stage Action Type type: string enum: - ATTRIBUTES, ATTACHMENT actionMetadata: description: Advance Stage Action metadata type: object additionalProperties: type: object required: - actionType - id IncidentCreateRequest: type: object properties: name: description: 'Name of the incident. Provide a descriptive name to the incident so that it can be quickly referenced in the incident register. ' type: string example: Joe sent an email to the wrong client description: description: Brief description of the incident. type: string example: 'An employee accessed a restricted HR file without proper authorization. Access logs confirmed the breach, and the user’s permissions were immediately revoked. ' incidentTypeName: description: The name of the type of incident that has occurred. type: string example: Misdirected Email default: Unknown orgGroupId: description: 'Incident Organization ID. This can be retrieved from the [Get List of Organizations](/onetrust/reference/organizationtreestructureusingget) API. ' type: string format: uuid example: 123e4567-e89b-12d3-a456-426614174000 dateOccurred: description: The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2019-05-31T12:43:24.173Z' dateDiscovered: description: The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2019-05-31T15:00:00.000Z' deadline: description: The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2019-07-31T12:43:24.173Z' sourceType: description: Creation Source example: INTEGRATION default: MANUAL enum: - MANUAL - ASSESSMENT - WEBFORM - INTEGRATION $ref: '#/components/schemas/IncidentSourceType' rootCause: description: The root cause summary of the incident. type: string example: 'The root cause was traced to a lack of validation in the email recipient auto-fill feature, leading to sensitive data being sent to the wrong external recipient. ' notificationNeeded: description: Indicates whether a notification is required for this incident either to an authority or affected individuals. example: 'YES' default: UNKNOWN enum: - 'YES' - 'NO' - UNKNOWN $ref: '#/components/schemas/NotificationNeededType' attributeValues: description: 'A map of custom attribute field names to the list of values associated with each attribute. Each entry in the list can contain either an ''id'' (for predefined options) or a ''value'', depending on the attribute configuration. If any attribute value is missing in the JSON array, the existing value for that attribute will be overridden, and the attribute will have empty values. ' type: object example: customTextAttributeFieldName: - value: Attribute Value customSingleSelectAttributeFieldName: - value: Option Value 1 customMultiSelectAttributeFieldName: - value: Option Value 2 - value: Option Value 3 additionalProperties: type: array items: $ref: '#/components/schemas/AttributeValueInformation' incidentAssigneeRequests: description: A list of incident assignee requests, where each request includes an assignee's ID, optional email, and type (USER or GROUP). type: array items: $ref: '#/components/schemas/IncidentAssigneeRequest' properties: list: type: array items: $ref: '#/components/schemas/IncidentAssigneeRequest' empty: type: boolean first: $ref: '#/components/schemas/IncidentAssigneeRequest' last: $ref: '#/components/schemas/IncidentAssigneeRequest' jurisdictions: type: array items: $ref: '#/components/schemas/IncidentJurisdictionCreateRequest' description: Impacted jurisdictions for the incident. linkedInventories: description: 'Map of inventory types to a single inventory link request. Keys represent inventory types (''assets'', ''processing-activities'', ''vendors'', ''entities''), and the value contains either externalIds or inventoryIds. ' type: object example: assets: externalIds: - Asset External ID processing-activities: externalIds: - Processing Activity External ID vendors: externalIds: - Vendor External ID entities: externalIds: - Legal Entity External ID additionalProperties: $ref: '#/components/schemas/InventoryLinkCreationRequest' autoAssessJurisdictions: description: If set to true, automatically assess jurisdictions after incident creation. type: boolean default: 'false' required: - incidentTypeName - name - orgGroupId WorkflowStageAssignmentInformation: type: object properties: id: description: Workflow Stage Assignment Id type: string format: uuid name: description: Workflow Stage Assignment name type: string sourceType: description: Assignment type System/Customer type: string approverCategory: description: 'Approver Category for stage assignment: Stage/Exception' type: string IncidentAssigneeInformation: type: object properties: assigneeId: description: Incident User Assignee Id type: string format: uuid assigneeName: description: Incident User Assignee Name type: string example: User Name type: description: Indicates whether the assignee is an individual user or a group of users. type: string default: USER enum: - USER - GROUP WorkflowStageListInformation: type: object properties: id: description: Workflow Stage Identifier type: string format: uuid example: 123e4567-e89b-12d3-a456-426614174000 name: description: Workflow Stage Name type: string example: Investigation nameKey: description: Workflow Stage Name Key for translation purposes type: string example: workflow.stage.investigation description: description: Workflow Stage Description type: string example: Investigation stage for incident workflow descriptionKey: description: Workflow Stage Description Key for translation purposes type: string example: workflow.stage.investigation.description sequence: description: Workflow Stage Sequence number type: integer format: int32 example: 2 minimum: 1 allowDeletion: description: Indicates if Workflow Stage can be deleted type: boolean example: true default: 'false' badgeColor: description: Workflow Stage Badge Color for UI purposes type: string example: blue approvalStage: description: Indicates if the stage is an approval stage type: boolean example: true default: 'false' exceptionStage: description: Indicates if the stage is an exception approval stage type: boolean example: false default: 'false' autoAdvanceOnApproval: description: Can Workflow Stage Auto-Advance on Approval? type: boolean example: true default: 'false' customFields: description: Custom fields type: object example: priority: high category: security additionalProperties: type: object stageApprovers: description: Workflow Stage Approvers type: array items: $ref: '#/components/schemas/WorkflowStageApproverInformation' additionalFields: description: Additional fields associated with Workflow Stage type: object example: notificationEnabled: true additionalProperties: type: object advanceStageActionEnabled: description: Does Workflow Stage has advance stage action enabled? type: boolean example: true default: 'false' advanceStageActions: description: Workflow Stage Advance Actions type: array items: $ref: '#/components/schemas/AdvanceStageActionInformation' stageExceptionConfiguration: description: Workflow Stage Exception details $ref: '#/components/schemas/StageExceptionInformation' stageAssignments: description: Workflow Stage assignments type: array items: $ref: '#/components/schemas/WorkflowStageAssignmentInformation' example: id: 123e4567-e89b-12d3-a456-426614174000 name: Investigation nameKey: workflow.stage.investigation description: Investigation stage for incident workflow descriptionKey: workflow.stage.investigation.description sequence: 2 allowDeletion: true badgeColor: blue approvalStage: true exceptionStage: false autoAdvanceOnApproval: true customFields: priority: high category: security stageApprovers: - id: abc-123 name: Security Approver additionalFields: notificationEnabled: true advanceStageActionEnabled: true advanceStageActions: - id: def-456 name: Approve stageExceptionConfiguration: enabled: true approverCount: 2 required: - id - name - sequence NotificationNeededType: type: string example: 'YES' default: UNKNOWN enum: - 'YES' - 'NO' - UNKNOWN AttributeValueInformation: type: object properties: id: description: Unique identifier for the attribute option type: string format: uuid example: a34ccec7-1ec0-4d65-9075-bdd0d923f1d1 value: description: Attribute value type: string example: Text Value valueKey: description: Translation key used for localizing the value type: string example: attribute.option.valueKey colorCode: description: Color code associated with the option. Used for score-based attributes. type: string example: red optionSelectionValue: description: Selection score value linked to the option. Used for score-based or numerical-based attributes. type: string example: '3.5' displayLabel: description: Display name for the option, used for external attributes managed by other systems type: string example: United State | San Francisco associatedAttributeValueInformation: description: Associated attribute option information type: array items: $ref: '#/components/schemas/AssociatedAttributeValueInformation' disabled: description: Indicates whether this attribute option is currently disabled. type: boolean example: false default: 'false' required: - value WorkflowSpecificStageNavigationRequest: type: object properties: nextStageName: description: Name of the next stage to navigate to type: string example: Investigation parameters: description: Additional parameters for workflow navigation customization additionalProperties: type: object example: skipValidation: true notifyUsers: false type: object example: nextStageName: Investigation parameters: notifyUsers: false priority: high reason: Critical security incident skipValidation: true required: - nextStageName WorkflowStageApproverInformation: type: object properties: id: description: Workflow Stage Approver Identifier type: string format: uuid workFlowStageId: description: Workflow Stage Id type: string format: uuid approverType: description: Workflow Stage Approver Type type: string enum: - SYSTEM_USER, USER_ATTRIBUTE approverUserId: description: Workflow Stage Approver User Id, User ID from Onetrust System type: string format: uuid referenceApproverUserSourceId: description: Reference identifier for approver' source. ie, fieldName from attribute Manager type: string referenceApproverUserSourceOwner: description: Reference Source Owner. ie, schemaname from attribute manager type: string approverUserGroupId: description: Workflow Stage Approver User Group Id, User Group ID from Onetrust System type: string format: uuid approverCategory: description: Field to indicate if the approver is for stage approval or exception type: string customFields: description: Custom fields type: object additionalProperties: type: object required: - approverType - id - workFlowStageId InventoryLinkCreationRequest: type: object properties: inventoryIds: description: Inventory Identifiers type: array items: type: string format: uuid example: - 550e8400-e29b-41d4-a716-446655440000 - 550e8400-e29b-41d4-a716-446655440001 uniqueItems: true externalIds: description: Set of unique identifiers for the record from an external system type: array items: type: string example: - EXT-12345 - EXT-67890 uniqueItems: true sourceType: description: Source of inventory link creation type: string example: INTEGRATION default: MANUAL enum: - MANUAL - ASSESSMENT - INTEGRATION $ref: '#/components/schemas/LinkCreationMode' IncidentUpdateRequest: type: object properties: name: description: 'Name of the incident. Provide a descriptive name to the incident so that it can be quickly referenced in the incident register. ' type: string example: Joe sent an email to the wrong client description: description: Brief description of the incident. type: string example: 'An employee accessed a restricted HR file without proper authorization. Access logs confirmed the breach, and the user’s permissions were immediately revoked. ' incidentTypeName: description: The name of the type of incident that has occurred. type: string example: Misdirected Email default: Unknown orgGroupId: description: 'Incident Organization ID. This can be retrieved from the [Get List of Organizations](/onetrust/reference/organizationtreestructureusingget) API. ' type: string format: uuid example: 123e4567-e89b-12d3-a456-426614174000 dateOccurred: description: The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2019-05-31T12:43:24.173Z' dateDiscovered: description: The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2019-05-31T15:00:00.000Z' deadline: description: The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2019-07-31T12:43:24.173Z' sourceType: description: Creation Source example: INTEGRATION default: MANUAL enum: - MANUAL - ASSESSMENT - WEBFORM - INTEGRATION $ref: '#/components/schemas/IncidentSourceType' rootCause: description: The root cause summary of the incident. type: string example: 'The root cause was traced to a lack of validation in the email recipient auto-fill feature, leading to sensitive data being sent to the wrong external recipient. ' notificationNeeded: description: Indicates whether a notification is required for this incident either to an authority or affected individuals. example: 'YES' default: UNKNOWN enum: - 'YES' - 'NO' - UNKNOWN $ref: '#/components/schemas/NotificationNeededType' attributeValues: description: 'A map of custom attribute field names to the list of values associated with each attribute. Each entry in the list can contain either an ''id'' (for predefined options) or a ''value'', depending on the attribute configuration. If any attribute value is missing in the JSON array, the existing value for that attribute will be overridden, and the attribute will have empty values. ' type: object example: customTextAttributeFieldName: - value: Attribute Value customSingleSelectAttributeFieldName: - value: Option Value 1 customMultiSelectAttributeFieldName: - value: Option Value 2 - value: Option Value 3 additionalProperties: type: array items: $ref: '#/components/schemas/AttributeValueInformation' incidentAssigneeRequests: description: A list of incident assignee requests, where each request includes an assignee's ID, optional email, and type (USER or GROUP). type: array items: $ref: '#/components/schemas/IncidentAssigneeRequest' properties: list: type: array items: $ref: '#/components/schemas/IncidentAssigneeRequest' empty: type: boolean first: $ref: '#/components/schemas/IncidentAssigneeRequest' last: $ref: '#/components/schemas/IncidentAssigneeRequest' jurisdictions: type: array items: $ref: '#/components/schemas/IncidentJurisdictionCreateRequest' description: Impacted jurisdictions for the incident. required: - incidentTypeName - name - orgGroupId SearchCriteriaInformation: type: object properties: filters: description: filters, which is a map of the field name and the value. Can filter on Incident Id, assignee Id, type Id, organization group Id, number, created By, is extended, is deleted type: object additionalProperties: type: object description: filters, which is a map of the field name and the value. Can filter on Incident Id, assignee Id, type Id, organization group Id, number, created By, is extended, is deleted fullText: description: full text search term. Can search on Incident name, description, type name, assignee name, organization group name, root cause, creator and stage name type: string example: Joe NamedAttributeValueInformation: type: object properties: attributeName: description: Customer-defined attribute name type: string example: Custom_SS id: description: Unique identifier for the attribute option type: string format: uuid example: a34ccec7-1ec0-4d65-9075-bdd0d923f1d1 value: description: Attribute value type: string example: Text Value valueKey: description: Translation key used for localizing the value type: string example: attribute.option.valueKey colorCode: description: Color code associated with the option. Used for score-based attributes. type: string example: red optionSelectionValue: description: Selection score value linked to the option. Used for score-based or numerical-based attributes. type: string example: '3.5' displayLabel: description: Display name for the option, used for external attributes managed by other systems type: string example: United State | San Francisco associatedAttributeValueInformation: description: Associated attribute option information type: array items: $ref: '#/components/schemas/AssociatedAttributeValueInformation' disabled: description: Indicates whether this attribute option is currently disabled. type: boolean example: false default: 'false' required: - value StageExceptionInformation: type: object properties: stageExceptionApprovers: description: Workflow Stage Exception Approvers type: array items: $ref: '#/components/schemas/WorkflowStageApproverInformation' exceptionGrantedTargetStageId: description: Target stage for exception approval type: string format: uuid workflowExceptionApprovalRequiredFromAll: description: Is exception required from all approvers type: boolean IncidentAssigneeRequest: type: object properties: assigneeId: description: Incident User Assignee Id type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 assigneeEmail: description: Email of the incident assignee. This field is valid only when the assignee type is "USER". type: string format: email example: user@example.com type: description: Indicates whether the assignee is an individual user or a group of users. type: string example: USER default: USER enum: - USER - GROUP required: - assigneeId IncidentInformation: type: object properties: id: description: Incident Identifier type: string format: uuid example: 1d429adf-26c5-413b-9b01-e7845a5dde99 number: description: Incident Number type: integer format: int64 example: 1 incidentTypeId: description: The unique identifier for the incident type. type: string format: uuid incidentTypeName: description: The name of the incident type. type: string example: Misdirected Email name: description: Incident Name type: string example: Joe sent an email to the wrong client description: description: Incident Description type: string example: 'An employee accessed a restricted HR file without proper authorization. Access logs confirmed the breach, and the user’s permissions were immediately revoked. ' sourceType: description: Creation Source type: string example: INTEGRATION enum: - MANUAL - ASSESSMENT - WEBFORM - NONE - INTEGRATION assessmentLinks: description: Source Assessment Link type: array items: $ref: '#/components/schemas/AssessmentInformation' orgGroupId: description: Organization Group Id type: string format: uuid orgGroupName: description: Organization Group Name type: string example: Business Unit rootCause: description: Root Cause type: string example: 'The root cause was traced to a lack of validation in the email recipient auto-fill feature, leading to sensitive data being sent to the wrong external recipient. ' dateOccurred: description: The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-21T05:22:40.187Z' dateClosed: description: The date and time when the incident was closed, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-28T05:22:40.187Z' dateDiscovered: description: The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-21T12:22:40.187Z' deadline: description: The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-23T05:22:40.187Z' createdBy: description: Incident Created User Id. type: string format: uuid creator: description: Incident Created User Name type: string example: User Name assigneeId: description: Incident User Assignee Id type: string format: uuid assigneeName: description: Incident User Assignee Name type: string example: User Name createdDT: description: The date and time when the incident was created, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-21T14:10:00.187Z' workflowId: description: Incident Workflow Id type: string format: uuid workflowName: description: Incident Workflow Name. type: string example: Default Workflow incidentStageId: description: Incident Stage Id type: string format: uuid incidentStageName: description: Incident Stage Name type: string example: Investigating incidentStageBadgeColor: description: The badge color of the incident workflow stage. type: string example: InProgress notificationNeeded: description: Incident Notification Needed type: string enum: - 'YES' - 'NO' - UNKNOWN incidentStatus: description: Incident Status type: string example: OPEN enum: - OPEN - CLOSED $ref: '#/components/schemas/IncidentStatus' schemaId: description: The unique identifier of the custom attribute schema associated with the incident. type: string format: uuid updatedDT: description: The date and time when the incident was last updated, represented as an ISO 8601 timestamp in UTC. type: string format: date-time example: '2025-04-28T05:22:40.187Z' attributeValues: description: Custom Attributes type: object example: customTextAttributeFieldName: - value: Attribute Value disabled: false customSingleSelectAttributeFieldName: - id: 0f5afc29-7fe1-4145-b541-ac33158312b6 value: Option Value 1 disabled: false customMultiSelectAttributeFieldName: - id: 736a8cb4-4e0e-4938-a43f-74edbaf46c0a value: Option Value 2 disabled: false - id: b4e17ed9-5e11-44f8-bb20-100af4d9e39b value: Option Value 3 disabled: false additionalProperties: type: array items: $ref: '#/components/schemas/NamedAttributeValueInformation' incidentAssigneeInformation: description: A list containing information about users or groups assigned to the incident type: array items: $ref: '#/components/schemas/IncidentAssigneeInformation' attachments: description: List of attachments associated with this incident, including both files and URL links type: array items: $ref: '#/components/schemas/IncidentAttachmentResponse' example: - attachmentId: 3fa85f64-5717-4562-b3fc-2c963f66afa6 name: evidence.pdf description: Evidence document type: FILE link: https://example.com/attachments/evidence.pdf createdDate: '2025-04-21T14:10:00.187Z' creator: id: 1d429adf-26c5-413b-9b01-e7845a5dde99 name: John Doe jurisdictions: type: array items: $ref: '#/components/schemas/IncidentJurisdictionGuidanceInformation' description: Impacted jurisdictions for the incident. closedSettingOn: type: boolean IncidentAttachmentResponse: type: object properties: Incident Attachment Identifier: description: Unique identifier for the incident attachment type: string format: uuid example: 3fa85f64-5717-4562-b3fc-2c963f66afa6 Attachment Created Date: description: Date and time when the attachment was created type: string format: date-time example: '2025-04-21T14:10:00.187Z' Incident Attachment Name: description: Display name of the attachment file or URL type: string example: evidence.pdf Incident Attachment Description: description: Optional description providing additional context about the attachment type: string example: Evidence document containing screenshots of the security incident Attachment Creator User Name: description: Information about the user who uploaded/created this attachment $ref: '#/components/schemas/BasicEntityDetail' Incident Attachment Type: description: Type of attachment - either a file upload or URL link type: string example: FILE enum: - FILE - URL Incident Attachment Link: description: URL link to access the attachment. For FILE type, this is the download link. For URL type, this is the external link. type: string example: https://example.com/attachments/evidence.pdf Incident Sub Task Identifier: description: Optional identifier of the incident subtask this attachment is associated with. Null if attached directly to the incident. type: string format: uuid example: 7ba85f64-5717-4562-b3fc-2c963f66afa9 Attachment resource path: description: Internal system path where the attachment file is stored. Only applicable for FILE type attachments. type: string example: /attachments/incident/3fa85f64-5717-4562-b3fc-2c963f66afa6/evidence.pdf required: - Incident Attachment Identifier - Incident Attachment Link - Incident Attachment Name - Incident Attachment Type BasicEntityDetail: type: object properties: id: type: string format: uuid name: type: string AssociatedAttributeValueInformation: type: object properties: id: description: Unique identifier for the attribute option type: string format: uuid example: a34ccec7-1ec0-4d65-9075-bdd0d923f1d1 value: description: Attribute value type: string example: Text Value valueKey: description: Translation key used for localizing the value type: string example: attribute.option.valueKey colorCode: description: Color code associated with the option. Used for score-based attributes. type: string example: red required: - value IncidentStatus: type: string example: OPEN enum: - OPEN - CLOSED IncidentJurisdictionCreateRequest: type: object properties: jurisdictionId: description: Incident Jurisdiction Id type: string format: uuid example: 123e4567-e89b-12d3-a456-426614174000 countryCode: description: Three-digit country code of the jurisdiction. type: string default: USA stateProvinceCode: description: State Province Code. **Required if countryCode is 'USA' or 'CAN'**. type: string example: CA required: - countryCode securitySchemes: OAUTH2: type: oauth2 flows: clientCredentials: tokenUrl: https://{hostname}/api/access/v1/oauth/token scopes: INCIDENT: Grants the user permission to view and manage the incident details. INCIDENT_READ: Grants the user permission to read incident data, including retrieving incident details. INCIDENT_CREATE: Grants the user permission to create incident. x-onetrust: spec-label: OpenAPI 3.1.0 links: - '{''Incident Management Knowledge Base'': ''https://my.onetrust.com/s/topic/0TO1Q000000ItS1WAK/incident-management''}' x-readme: explorer-enabled: false proxy-enabled: false metrics-enabled: false