<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Case Management

## TheHive APIs

| Endpoint | Purpose |
|---|---|
| `POST /api/v1/case` | Create case |
| `PATCH /api/v1/case/{id}` | Update case |
| `POST /api/v1/case/{id}/task` | Add task to case |
| `POST /api/v1/case/{id}/observable` | Add observable/IOC |
| `GET /api/v1/case/{id}/timeline` | Get case timeline |

## ServiceNow Security Incident APIs

| Endpoint | Purpose |
|---|---|
| `POST /api/now/table/sn_si_incident` | Create security incident |
| `PATCH /api/now/table/sn_si_incident/{sys_id}` | Update incident |
| `GET /api/now/table/sn_si_incident` | List incidents |
| `POST /api/now/table/sn_si_task` | Create investigation task |

## Jira Service Management APIs

| Endpoint | Purpose |
|---|---|
| `POST /rest/api/3/issue` | Create issue/incident |
| `PUT /rest/api/3/issue/{key}` | Update issue |
| `POST /rest/api/3/issue/{key}/transitions` | Transition status |
| `POST /rest/api/3/issue/{key}/comment` | Add investigation note |

## SLA Targets

| Severity | Response | Resolution | Escalation |
|---|---|---|---|
| Critical | 15 min | 4 hours | SOC Lead → CISO |
| High | 30 min | 8 hours | SOC Lead |
| Medium | 1 hour | 24 hours | Shift Lead |
| Low | 4 hours | 72 hours | Queue |

## Agent Script

```bash
# List case templates
node agent.js list

# Create case from template
node agent.js create --template malware_incident \
  --assignee analyst1 --systems FS01 WS023 WS024

# Update case status
node agent.js update --case-id CASE-001 --status contained \
  --notes "All affected endpoints isolated via EDR"
```
