{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "IncidentSearchRequest",
  "description": "IncidentSearchRequest schema from Palo Alto Networks Cortex XSOAR REST API",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/json-schema/cortex-xsoar-api-incident-search-request-schema.json",
  "type": "object",
  "properties": {
    "filter": {
      "type": "object",
      "description": "Structured filter criteria for the incident search.",
      "properties": {
        "query": {
          "type": "string",
          "description": "Lucene query string (e.g., status:Active severity:High)."
        },
        "status": {
          "type": "array",
          "items": {
            "type": "integer"
          }
        },
        "sort": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "field": {
                "type": "string"
              },
              "asc": {
                "type": "boolean"
              }
            }
          }
        },
        "period": {
          "type": "object",
          "properties": {
            "byFrom": {
              "type": "string",
              "format": "date-time"
            },
            "byTo": {
              "type": "string",
              "format": "date-time"
            }
          }
        }
      }
    },
    "fromDate": {
      "type": "string",
      "format": "date-time"
    },
    "toDate": {
      "type": "string",
      "format": "date-time"
    },
    "size": {
      "type": "integer",
      "default": 10,
      "maximum": 100
    },
    "page": {
      "type": "integer",
      "default": 0
    }
  }
}