Add Comment to Existing Incident

The incident comment endpoint provides a method to add comments to an incident by referencing its id and passing the comment as a JSON object.

Endpoint

POST /v1/incident/{id}/comment

Parameters

Parameter	Type	Required	Description
comment	string	Yes	The comment text to add to the incident. Must be a non-empty string of up to 5,000 characters.
author	string	No	Email address to attribute the comment to. It is returned as authorDetails.email on the resulting history entry; when omitted, authorDetails.email is null.

Warning

The comment field cannot be null or empty, and is limited to 5,000 characters. A longer comment returns 400 and is not saved; see Limits. When supplied, author must be a valid email address; invalid values return 400.

Comment attribution

To attribute a comment to a specific individual, provide the author field. When author is omitted, the comment is treated as a general client comment rather than attributed to an individual user.

The comment is added to the incident's history as a client entry (authorDetails.type is client, authorDetails.automated is false). See Incident History for the entry structure.

Request Example

cURLPythonNode.js

curl -X POST 'https://capi.phishfort.com/v1/incident/{id}/comment' \
  -H 'accept: application/json' \
  -H 'x-api-key: YOUR_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"comment": "This incident requires immediate attention", "author": "analyst@example.com"}'

import requests

incident_id = "abc123efd"
response = requests.post(
    f"https://capi.phishfort.com/v1/incident/{incident_id}/comment",
    headers={
        "accept": "application/json",
        "x-api-key": "YOUR_API_KEY",
    },
    json={
        "comment": "This incident requires immediate attention",
        "author": "analyst@example.com",
    },
)
print(response.json())

const incidentId = "abc123efd";
const response = await fetch(
  `https://capi.phishfort.com/v1/incident/${incidentId}/comment`,
  {
    method: "POST",
    headers: {
      accept: "application/json",
      "x-api-key": "YOUR_API_KEY",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      comment: "This incident requires immediate attention",
      author: "analyst@example.com",
    }),
  }
);
const data = await response.json();
console.log(data);

Where {id} is the ID of the incident you wish to add a comment to.

Response Example

{
    "message": "You added a new comment on incidentId: abc123efd",
    "id": "abc123efd"
}

Error Responses

Status	Meaning
400	The comment is missing, empty, or longer than 5,000 characters, or author is not a valid email address. The comment is not added.
404	No incident with the provided ID was found on your account.
409	The id was reported within the last few minutes and is still being linked to its full record. Retry after the Retry-After header, typically 30 seconds. See Using the Returned ID Right Away.