---
title: "Attach security findings to a Jira issue"
method: PATCH
path: "/api/v2/security/findings/jira_issues"
tags: ["Security Monitoring"]
---

# Attach security findings to a Jira issue

`PATCH /api/v2/security/findings/jira_issues`

Attach security findings to a Jira issue by providing the Jira issue URL.
You can attach up to 50 security findings per Jira issue. If the Jira issue is not linked to any case, this operation will create a case for the security findings and link the Jira issue to the newly created case. To configure the Jira integration, see [Bidirectional ticket syncing with Jira](https://docs.datadoghq.com/security/ticketing_integrations/#bidirectional-ticket-syncing-with-jira). Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the specified Jira issue.

## Request body

- AttachJiraIssueRequest — Request for attaching security findings to a Jira issue.
  - `data` AttachJiraIssueRequestData — Data of the Jira issue to attach security findings to.
    - `attributes` AttachJiraIssueRequestDataAttributes — Attributes of the Jira issue to attach security findings to.
      - `jira_issue_url` string, required — URL of the Jira issue to attach security findings to.
    - `relationships` AttachJiraIssueRequestDataRelationships — Relationships of the Jira issue to attach security findings to.
      - `findings` Findings, required — A list of security findings.
        - `data` FindingData[] — Array of security finding data objects.
          - `id` string, required — Unique identifier of the security finding.
          - `type` 'findings', required — Security findings resource type.
      - `project` CaseManagementProject, required — Case management project.
        - `data` CaseManagementProjectData, required — Data object representing a case management project.
          - `id` string, required — Unique identifier of the case management project.
          - `type` 'projects', required — Projects resource type.
    - `type` 'jira_issues', required — Jira issues resource type.

## Response `200`

OK

- FindingCaseResponse — Case response.
  - `data` FindingCaseResponseData — Data of the case.
    - `attributes` FindingCaseResponseDataAttributes — Attributes of the case.
      - `archived_at` string, date-time — Timestamp of when the case was archived.
      - `assigned_to` RelationshipToUser — Relationship to user.
        - `data` RelationshipToUserData, required — Relationship to user object.
          - `id` string, required — A unique identifier that represents the user.
          - `type` 'users', required — Users resource type.
      - `attributes` object — Custom attributes associated with the case as key-value pairs where values are string arrays.
      - `closed_at` string, date-time — Timestamp of when the case was closed.
      - `created_at` string, date-time — Timestamp of when the case was created.
      - `creation_source` string — Source of the case creation.
      - `description` string — Description of the case.
      - `due_date` string — Due date of the case.
      - `insights` CaseInsightsItems[] — Insights of the case.
        - `ref` string — Reference of the insight.
        - `resource_id` string — Unique identifier of the resource. For example, the unique identifier of a security finding.
        - `type` string — Type of the resource. For example, the type of a security finding is "SECURITY_FINDING".
      - `jira_issue` FindingJiraIssue — Jira issue associated with the case.
        - `error_message` string — Error message if the Jira issue creation failed.
        - `result` FindingJiraIssueResult — Result of the Jira issue creation.
          - `account_id` string — Account ID of the Jira issue.
          - `issue_id` string — Unique identifier of the Jira issue.
          - `issue_key` string — Key of the Jira issue.
          - `issue_url` string — URL of the Jira issue.
        - `status` string — Status of the Jira issue creation. Can be "COMPLETED" if the Jira issue was created successfully, or "FAILED" if the Jira issue creation failed.
      - `key` string — Key of the case.
      - `linear_issue` FindingLinearIssue — Linear issue associated with the case.
        - `error_message` string — Error message if the Linear issue creation failed.
        - `result` FindingLinearIssueResult — Result of the Linear issue creation.
          - `account_id` string — Account ID of the Linear workspace.
          - `issue_id` string — Unique identifier of the Linear issue.
          - `issue_key` string — Key of the Linear issue.
          - `team_id` string — Team ID of the Linear issue.
          - `url` string — URL of the Linear issue.
        - `status` string — Status of the Linear issue creation. Can be "COMPLETED" if the Linear issue was created successfully, or "FAILED" if the Linear issue creation failed.
      - `modified_at` string, date-time — Timestamp of when the case was last modified.
      - `priority` string — Priority of the case.
      - `servicenow_ticket` FindingServiceNowTicket — ServiceNow ticket associated with the case.
        - `result` FindingServiceNowTicketResult — Result of the ServiceNow ticket creation or attachment.
          - `instance_name` string — ServiceNow instance name extracted from the ticket URL.
          - `sys_id` string — Unique identifier of the ServiceNow incident record.
          - `sys_target_link` string — Direct link to the ServiceNow incident record.
          - `sys_target_sys_id` string — Unique identifier of the target ServiceNow record.
          - `table_name` string — ServiceNow table containing the incident record.
          - `url` string — URL of the ServiceNow incident record.
        - `status` string — Status of the ServiceNow ticket operation. Can be "COMPLETED" if successful, or "FAILED" if the operation failed.
      - `status` string — Status of the case.
      - `status_group` string — Status group of the case.
      - `status_name` string — Status name of the case.
      - `title` string — Title of the case.
      - `type` string — Type of the case. For security cases, this is always "SECURITY".
    - `id` string — Unique identifier of the case.
    - `relationships` FindingCaseResponseDataRelationships — Relationships of the case.
      - `created_by` RelationshipToUser — Relationship to user.
        - `data` RelationshipToUserData, required — Relationship to user object.
          - `id` string, required — A unique identifier that represents the user.
          - `type` 'users', required — Users resource type.
      - `modified_by` RelationshipToUser — Relationship to user.
        - `data` RelationshipToUserData, required — Relationship to user object.
          - `id` string, required — A unique identifier that represents the user.
          - `type` 'users', required — Users resource type.
      - `project` CaseManagementProject — Case management project.
        - `data` CaseManagementProjectData, required — Data object representing a case management project.
          - `id` string, required — Unique identifier of the case management project.
          - `type` 'projects', required — Projects resource type.
    - `type` 'cases', required — Cases resource type.

## Other responses

- `400` — Bad Request
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)