---
title: "POST /v1/create-case"
method: POST
path: "/v1/create-case"
---

# POST /v1/create-case

`POST /v1/create-case`

Creates a new case.

## Request body

- object
  - `clientToken` string — <p><note> <p>The <code>clientToken</code> field is an idempotency key used to ensure that repeated attempts for a single action will be ignored by the server during retries. A caller supplied unique ID (typically a UUID) should be provided. </p> </note></p>
  - `resolverType` 'AWS' | 'Self', required — Required element used in combination with CreateCase to identify the resolver type.
  - `title` string, password, required — Required element used in combination with CreateCase to provide a title for the new case.
  - `description` string, password, required — <p>Required element used in combination with CreateCase</p> <p>to provide a description for the new case.</p>
  - `engagementType` 'Security Incident' | 'Investigation', required — Required element used in combination with CreateCase to provide an engagement type for the new cases. Available engagement types include Security Incident | Investigation
  - `reportedIncidentStartDate` string, date-time, required — Required element used in combination with CreateCase to provide an initial start date for the unauthorized activity.
  - `impactedAccounts` AWSAccountId[], required — <p>Required element used in combination with CreateCase to provide a list of impacted accounts.</p> <note> <p> AWS account ID's may appear less than 12 characters and need to be zero-prepended. An example would be <code>123123123</code> which is nine digits, and with zero-prepend would be <code>000123123123</code>. Not zero-prepending to 12 digits could result in errors. </p> </note>
  - `watchers` Watcher[], required — Required element used in combination with CreateCase to provide a list of entities to receive notifications for case updates.
    - `email` string, password, required — <p/>
    - `name` string, password — <p/>
    - `jobTitle` string, password — <p/>
  - `threatActorIpAddresses` ThreatActorIp[] — An optional element used in combination with CreateCase to provide a list of suspicious internet protocol addresses associated with unauthorized activity.
    - `ipAddress` string, password, required — <p/>
    - `userAgent` string — <p/>
  - `impactedServices` AwsService[] — An optional element used in combination with CreateCase to provide a list of services impacted.
  - `impactedAwsRegions` ImpactedAwsRegion[] — An optional element used in combination with CreateCase to provide a list of impacted regions.
    - `region` 'af-south-1' | 'ap-east-1' | 'ap-east-2' | 'ap-northeast-1' | 'ap-northeast-2' | 'ap-northeast-3' | 'ap-south-1' | 'ap-south-2' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-southeast-3' | 'ap-southeast-4' | 'ap-southeast-5' | 'ap-southeast-6' | 'ap-southeast-7' | 'ca-central-1' | 'ca-west-1' | 'cn-north-1' | 'cn-northwest-1' | 'eu-central-1' | 'eu-central-2' | 'eu-north-1' | 'eu-south-1' | 'eu-south-2' | 'eu-west-1' | 'eu-west-2' | 'eu-west-3' | 'il-central-1' | 'me-central-1' | 'me-south-1' | 'mx-central-1' | 'sa-east-1' | 'us-east-1' | 'us-east-2' | 'us-west-1' | 'us-west-2', required — <p/>
  - `tags` object — An optional element used in combination with CreateCase to add customer specified tags to a case.

## Response `201`

Success

- CreateCaseResponse
  - `caseId` string, required — A response element providing responses for requests to CreateCase. This element responds with the case ID.

## Other responses

- `480` — ServiceQuotaExceededException
- `481` — AccessDeniedException
- `482` — ValidationException
- `483` — SecurityIncidentResponseNotActiveException
- `484` — InternalServerException
- `485` — ThrottlingException
- `486` — ConflictException
- `487` — ResourceNotFoundException
- `488` — InvalidTokenException

---

[API](https://skmtc.net/aws/apis/security-ir.md) · [All operations](https://skmtc.net/aws/apis/security-ir/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/security-ir/revisions/e22a88ccce95/schema)