---
title: "POST /v1/cases/{caseId}/update-case"
method: POST
path: "/v1/cases/{caseId}/update-case"
---

# POST /v1/cases/{caseId}/update-case

`POST /v1/cases/{caseId}/update-case`

Updates an existing case.

## Path parameters

- `caseId` string, required

## Request body

- object
  - `title` string, password — Optional element for UpdateCase to provide content for the title field.
  - `description` string, password — Optional element for UpdateCase to provide content for the description field.
  - `reportedIncidentStartDate` string, date-time — Optional element for UpdateCase to provide content for the customer reported incident start date field.
  - `actualIncidentStartDate` string, date-time — Optional element for UpdateCase to provide content for the incident start date field.
  - `engagementType` 'Security Incident' | 'Investigation' — Optional element for UpdateCase to provide content for the engagement type field. <code>Available engagement types include Security Incident | Investigation</code>.
  - `watchersToAdd` Watcher[] — Optional element for UpdateCase to provide content to add additional watchers to a case.
    - `email` string, password, required — <p/>
    - `name` string, password — <p/>
    - `jobTitle` string, password — <p/>
  - `watchersToDelete` Watcher[] — Optional element for UpdateCase to provide content to remove existing watchers from a case.
    - `email` string, password, required — <p/>
    - `name` string, password — <p/>
    - `jobTitle` string, password — <p/>
  - `threatActorIpAddressesToAdd` ThreatActorIp[] — Optional element for UpdateCase to provide content to add additional suspicious IP addresses related to a case.
    - `ipAddress` string, password, required — <p/>
    - `userAgent` string — <p/>
  - `threatActorIpAddressesToDelete` ThreatActorIp[] — Optional element for UpdateCase to provide content to remove suspicious IP addresses from a case.
    - `ipAddress` string, password, required — <p/>
    - `userAgent` string — <p/>
  - `impactedServicesToAdd` AwsService[] — Optional element for UpdateCase to provide content to add services impacted.
  - `impactedServicesToDelete` AwsService[] — Optional element for UpdateCase to provide content to remove services impacted.
  - `impactedAwsRegionsToAdd` ImpactedAwsRegion[] — Optional element for UpdateCase to provide content to add regions impacted.
    - `region` 'af-south-1' | 'ap-east-1' | 'ap-east-2' | 'ap-northeast-1' | 'ap-northeast-2' | 'ap-northeast-3' | 'ap-south-1' | 'ap-south-2' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-southeast-3' | 'ap-southeast-4' | 'ap-southeast-5' | 'ap-southeast-6' | 'ap-southeast-7' | 'ca-central-1' | 'ca-west-1' | 'cn-north-1' | 'cn-northwest-1' | 'eu-central-1' | 'eu-central-2' | 'eu-north-1' | 'eu-south-1' | 'eu-south-2' | 'eu-west-1' | 'eu-west-2' | 'eu-west-3' | 'il-central-1' | 'me-central-1' | 'me-south-1' | 'mx-central-1' | 'sa-east-1' | 'us-east-1' | 'us-east-2' | 'us-west-1' | 'us-west-2', required — <p/>
  - `impactedAwsRegionsToDelete` ImpactedAwsRegion[] — Optional element for UpdateCase to provide content to remove regions impacted.
    - `region` 'af-south-1' | 'ap-east-1' | 'ap-east-2' | 'ap-northeast-1' | 'ap-northeast-2' | 'ap-northeast-3' | 'ap-south-1' | 'ap-south-2' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-southeast-3' | 'ap-southeast-4' | 'ap-southeast-5' | 'ap-southeast-6' | 'ap-southeast-7' | 'ca-central-1' | 'ca-west-1' | 'cn-north-1' | 'cn-northwest-1' | 'eu-central-1' | 'eu-central-2' | 'eu-north-1' | 'eu-south-1' | 'eu-south-2' | 'eu-west-1' | 'eu-west-2' | 'eu-west-3' | 'il-central-1' | 'me-central-1' | 'me-south-1' | 'mx-central-1' | 'sa-east-1' | 'us-east-1' | 'us-east-2' | 'us-west-1' | 'us-west-2', required — <p/>
  - `impactedAccountsToAdd` AWSAccountId[] — <p>Optional element for UpdateCase to provide content to add accounts impacted.</p> <note> <p> AWS account ID's may appear less than 12 characters and need to be zero-prepended. An example would be <code>123123123</code> which is nine digits, and with zero-prepend would be <code>000123123123</code>. Not zero-prepending to 12 digits could result in errors. </p> </note>
  - `impactedAccountsToDelete` AWSAccountId[] — <p>Optional element for UpdateCase to provide content to add accounts impacted.</p> <note> <p> AWS account ID's may appear less than 12 characters and need to be zero-prepended. An example would be <code>123123123</code> which is nine digits, and with zero-prepend would be <code>000123123123</code>. Not zero-prepending to 12 digits could result in errors. </p> </note>
  - `caseMetadata` CaseMetadataEntry[] — Update the case request with case metadata
    - `key` string, required — The identifier for the metadata field. This key uniquely identifies the type of metadata being stored, such as "severity", "category", or "assignee".
    - `value` string, required — The value associated with the metadata key. This contains the actual data for the metadata field identified by the key.

## Response `200`

Success

- UpdateCaseResponse

## Other responses

- `480` — ServiceQuotaExceededException
- `481` — AccessDeniedException
- `482` — ValidationException
- `483` — SecurityIncidentResponseNotActiveException
- `484` — InternalServerException
- `485` — ThrottlingException
- `486` — ConflictException
- `487` — ResourceNotFoundException
- `488` — InvalidTokenException

---

[API](https://skmtc.net/aws/apis/security-ir.md) · [All operations](https://skmtc.net/aws/apis/security-ir/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/security-ir/versions/e22a88ccce95/schema)