Workflow Events

Workflow Events, also known as Timeline Events, represent changes made to a Workflow Case. When an action is performed in a Case, a Workflow Event is automatically added to the Case’s timeline. You can also manually add a Workflow Event to a Case.

Endpoint: /api/v3/workflowEvents

Available Fields

You can retrieve a list of available fields for the /v3/workflowEvents endpoint, including each field’s name, description, and accepted data type, by using the following query:

OPTIONS /v3/workflowEvents

Hint

To view all fields, including read-only fields, include the ?show=readonly query parameter.

Alternatively, refer to the following table for a list of available fields that can be included in the body of a POST or PUT request for the workflowEvents object.

Field Description Type Required for Creation? Updatable? Example Value(s)
caseId The ID of the Case that contains the Workflow Event Integer TRUE* FALSE 1, 2, 3
caseXid The XID of the Case that contains the Workflow Event String TRUE* FALSE “a1a1a1a1-a1a1-a1a1-a1a1-a1a1a1a1a1a1”
eventDate The date and time when the Workflow Event took place Date FALSE TRUE “2021-04-30T12:30:00Z”
notes A list of Notes corresponding to the Workflow Event Note Object FALSE TRUE {“data”: [{“text”: “Additional information about this Workflow Event”}]}
summary A summary of the Workflow Event String TRUE TRUE “New Security Breach Detected by TI Team”

Note

*When creating a Workflow Event, either caseId or caseXid must be included in the body of the POST request. Only one needs to be included in the body of the POST request, but both can be included, if desired.

Create Workflow Events

The basic format for creating a Workflow Event is:

POST /v3/workflowEvents
{
    "caseId": 1,
    "summary": "Summary of the Workflow Event"
}

For example, the following query will create a Workflow Event with a summary of “Updated Case name” for the Case with ID 1.

POST /v3/workflowEvents
{
    "caseId": 1,
    "summary": "New Security Breach Detected by TI Team"
}

JSON Response:

{
    "data": {
        "id": 4,
        "eventDate": "2021-03-05T14:54:31Z",
        "dateAdded": "2021-03-05T14:54:31Z",
        "summary": "Updated Case name",
        "systemGenerated": false,
        "link": "https://app.threatconnect.com/api/v3/cases/1"
    },
    "message": "Created",
    "status": "Success"
}

Refer to the Available Fields and section for a list of available fields that can be included in the body of a POST request for the workflowEvents object.

Note

Creating a Workflow Event only adds the Workflow Event to the Case’s timeline. It does not perform the action indicated in the Workflow Event’s summary.

Retrieve Workflow Events

Retrieve All Workflow Events

To retrieve all Workflow Events, use the following query:

GET /v3/workflowEvents

JSON Response:

{
    "data": [
        {
            "id": 1,
            "eventDate": "2021-03-05T14:48:44Z",
            "dateAdded": "2021-03-05T14:48:44Z",
            "summary": "Case created",
            "systemGenerated": true,
            "link": "https://app.threatconnect.com/api/v3/cases/1"
        },
        {
            "id": 2,
            "eventDate": "2021-03-05T14:49:24Z",
            "dateAdded": "2021-03-05T14:49:24Z",
            "summary": "Added a note",
            "systemGenerated": true,
            "link": "https://app.threatconnect.com/api/v3/notes/1"
        },
        {...}
    ],
    "status": "Success"
}

Retrieve a Single Workflow Event

To retrieve a specific Workflow Event, use a query in the following format:

GET /v3/workflowEvents/{workflowEventId}

For example, the following query will return information about the Workflow Event with ID 1:

GET /v3/workflowEvent/1

JSON Response:

{
    "data": {
        "id": 1,
        "eventDate": "2021-03-05T14:48:44Z",
        "dateAdded": "2021-03-05T14:48:44Z",
        "summary": "Case created",
        "systemGenerated": true,
        "link": "https://app.threatconnect.com/api/v3/cases/1"
    },
    "status": "Success"
}

Request Additional Fields

To request additional fields not automatically included with each returned object, refer to Include Additional Fields for Returned Objects.

Filter Results

To filter returned objects using ThreatConnect Query Language (TQL), refer to Filter Results with TQL.

Update Workflow Events

The basic format for updating a Workflow Event is:

PUT /v3/workflowEvents/{workflowEventId}
{
    {updatedField}: {updatedValue}
}

For example, the following query will update the summary for the Workflow Event with ID 4 and add a Note to the Workflow Event.

PUT /v3/workflowEvents/4
{
    "summary": "New Workflow Event summary",
    "notes": {"data": [{"text": "Additional information about this Workflow Event"}]}
}

JSON Response:

{
    "data": {
        "id": 4,
        "eventDate": "2021-03-05T14:48:44Z",
        "dateAdded": "2021-03-05T14:48:44Z",
        "summary": "New Workflow Event summary",
        "systemGenerated": false,
        "notes": {
            "data": [
                {
                    "id": 7,
                    "text": "Additional information about this Workflow Event",
                    "summary": "Additional information about this Workflow Event",
                    "author": "11112222333344445555",
                    "dateAdded": "2021-03-07T11:17:32Z",
                    "lastModified": "2021-03-07T11:17:32Z",
                    "edited": false,
                    "workflowEventId": 4
                }
            ]
        }
    },
    "message": "Updated",
    "status": "Success"
}

Refer to the Available Fields and section for a list of available fields that can be included in the body of a PUT request for the workflowEvents object.

Attention

You cannot modify system-generated Workflow Events (i.e., Workflow Events with their systemGenerated field set to true). However, you can add Notes that correspond to system-generated Workflow Events.

Delete Workflow Events

The basic format to delete a Workflow Event is:

DELETE /v3/workflowEvents/{workflowEventId}

{
    "deletedReason": "Reason for deleting the Workflow Event."
}

Attention

Only Workflow Events that have been manually added to a Case may be deleted.

For example, the following query will delete the Workflow Event with ID 4:

DELETE /v3/workflowEvents/4

{
    "deletedReason": "No longer needed this Workflow Event."
}

JSON Response:

{
    "message": "Deleted",
    "status": "Success"
}