Case request bodies
{
"unit21_id": 11532914,
"case_id": null,
"status": "OPEN",
"disposition": "",
"object_type": "CASE",
"change": "CREATED",
"changed_by": "[email protected]",
"title": "Bulk resolution case",
"description": "Case created to bulk resolve 2 alerts",
"change_time": 1661958418,
"start_date": 1661958402,
"end_date": null,
"entities": [
{
"entity_id": "",
"entity_type": "user",
"unit21_id": 618865781,
"resolution": null
}
],
"events": [
{
"event_id": "txn-100002891",
"event_type": "transaction",
"unit21_id": 2151796066,
"resolution": null
}
],
"tags": [],
"instruments": [],
"created_by": "[email protected]",
"watchers": [],
"custom_data": {}
}
For the webhook CREATED, the following fields are sent:
| Field Name | Value Type | Details |
|---|---|---|
| unit21_id | Number | A Unit21 internally-assigned unique identifier for the case within our system |
| case_id | String | A non-Unit21 identifier for the case |
| status | String | One of OPEN or CLOSED |
| disposition | String | A state that represents either the case's resolution or a designation for further actions. This field can be defined by an action trigger button, where each action trigger corresponds to one disposition |
| object_type | String | CASE |
| change | String | CREATED |
| changed_by | String | Email address of the agent that triggered the status change (if applicable) |
| title | String | Title assigned to the case |
| description | String | A high level descriptive phrase about the case |
| change_time | Number | Time the change was triggered in [Epoch time format] |
| start_date | Number | Start datetime of the events or entities encapsulated by this case in Epoch time format (number of seconds elapsed since 1 Jan 1970 00:00:00 UTC) |
| end_date | Number | End datetime of the events or entities encapsulated by this case in Epoch time format (number of seconds elapsed since 1 Jan 1970 00:00:00 UTC) |
| entities | Object[] | An object list of entities flagged by the rule. Each object contains a Unit21 ID, the entity type (user or business), a non-Unit21 identifier, and a resolution |
| events | Object[] | An object list of events flagged by the rule. Each object contains a Unit21 ID, the event type (transaction or action), a non-Unit21 identifier, and a resolution well |
| tags | String[] | A list of tags that are associated with this case, always of the format key:value |
| instruments | Object[] | An object list of instruments flagged by the rule. Each object contains a Unit21 ID, the instrument type, a non-Unit21 identifier, and a resolution |
| created_by | String | Email address of the agent that created this case initially |
| watchers | String[] | A list of email addresses of the agents are listed as watchers on this case |
| custom_data | Object | Any custom information that you wish our system to associate with this alert (accepts any valid JSON object) |
{
"unit21_id": 11532914,
"case_id": null,
"status": "CLOSED",
"disposition": "Report Filed ",
"object_type": "CASE",
"change": "CLOSED",
"change_time": 1661958477,
"changed_by": "[email protected]",
"title": "Bulk resolution case",
"description": "Case created to bulk resolve 2 alerts",
"start_date": 1661958402,
"end_date": null,
"entities": [
{
"entity_id": "",
"entity_type": "user",
"unit21_id": 618865781,
"resolution": null
}
],
"events": [
{
"event_id": "txn-100002891",
"event_type": "transaction",
"unit21_id": 2151796066,
"resolution": null
}
],
"instruments": [],
"created_by": "[email protected]",
"watchers": [],
"tags": [],
"custom_data": {}
}
For the webhook CLOSED and OPEN, the following fields are sent:
| Field Name | Value Type | Details |
|---|---|---|
| unit21_id | Number | A Unit21 internally-assigned unique identifier for the case within our system |
| case_id | String | A non-Unit21 identifier for the case |
| status | String | One of OPEN or CLOSED |
| disposition | String | A state that represents either the case's resolution or a designation for further actions. This field can be defined by an action trigger button, where each action trigger corresponds to one disposition |
| object_type | String | CASE |
| change | String | A Unit21-defined value describing the nature of the change to this case. For more details on this, see above section Change trigger types |
| change_time | Number | Time the change was triggered in Epoch time format (number of seconds elapsed since 1 Jan 1970 00:00:00 UTC) |
| changed_by | String | Email address of the agent that triggered the status change (if applicable) |
| title | String | Title assigned to the case |
| description | String | A high level descriptive phrase about the case |
| start_date | Number | Start datetime of the events or entities encapsulated by this case in Epoch time format (number of seconds elapsed since 1 Jan 1970 00:00:00 UTC) |
| end_date | Number | End datetime of the events or entities encapsulated by this case in Epoch time format (number of seconds elapsed since 1 Jan 1970 00:00:00 UTC) |
| entities | Object[] | An object list of entities flagged by the rule. Each object contains a Unit21 ID, the entity type (user or business), a non-Unit21 identifier, and a resolution |
| events | Object[] | An object list of events flagged by the rule. Each object contains a Unit21 ID, the event type (transaction or action), a non-Unit21 identifier, and a resolution well |
| instruments | Object[] | An object list of instruments flagged by the rule. Each object contains a Unit21 ID, the instrument type, a non-Unit21 identifier, and a resolution |
| created_by | String | Email address of the agent that created this case initially |
| watchers | String[] | A list of email addresses of the agents are listed as watchers on this case |
| tags | String[] | A list of tags that are associated with this case, always of the format key:value |
| custom_data | Object | Any custom information that you wish our system to associate with this alert (accepts any valid JSON object) |
{
"unit21_id": 11532914,
"case_id": null,
"status": "CLOSED",
"disposition": "Report Filed ",
"object_type": "CASE",
"change": "ACTION_TRIGGERED",
"change_time": 1661958477,
"changed_by": "[email protected]",
"title": "Bulk resolution case",
"description": "Case created to bulk resolve 2 alerts",
"start_date": 1661958402,
"end_date": null,
"entities": [
{
"entity_id": "",
"entity_type": "user",
"unit21_id": 618865781,
"resolution": null
}
],
"events": [
{
"event_id": "txn-100002891",
"event_type": "transaction",
"unit21_id": 2151796066,
"resolution": null
},
{
"event_id": "Transaction_Test8",
"event_type": "transaction",
"unit21_id": 2311020631,
"resolution": null
},
{
"event_id": "Transaction_Test9",
"event_type": "transaction",
"unit21_id": 2311046142,
"resolution": null
}
],
"instruments": [],
"created_by": "[email protected]",
"watchers": [],
"tags": [],
"custom_data": {},
"action_trigger_external_id": "CLOSED",
"subdisposition": [],
"disposition_notes": null
}
For the webhook ACTION_TRIGGERED, the following fields are sent in addition to the ones above:
| Field Name | Value Type | Details |
|---|---|---|
| action_trigger_external_id | String | A unique identifier defined at button create time |
| subdisposition | List | List of key-value pairs. A sub-state that represents either the alert's resolution or a designation for further actions. This field can be be defined by an action trigger button, where each action trigger allows for agents to dynamically select a subdisposition during alert investigation from a list of predefined values in the action trigger configuration process |
| disposition_notes | String | A free text field that contains agent-entered elaborations on the alert's disposition. A non-empty value may be required by the action trigger depending on the action trigger configuration |