---
title: "Create Incident"
method: POST
path: "/incident/v1/incidents"
tags: ["Incidents"]
---

# Create Incident

`POST /incident/v1/incidents`

Use this API to create a new incident in the Incident Register by providing the necessary details in the request body. The response will return the unique identifier (UUID) of the newly created incident.

## Request body

- IncidentCreateRequest
  - `name` string, required — Name of the incident. Provide a descriptive name to the incident so that it can be quickly referenced in the incident register.
  - `description` string — Brief description of the incident.
  - `incidentTypeName` string, required — The name of the type of incident that has occurred.
  - `orgGroupId` string, uuid, required — Incident Organization ID. This can be retrieved from the [Get List of Organizations](/onetrust/reference/organizationtreestructureusingget) API.
  - `dateOccurred` string, date-time — The date and time when the incident occurred, represented as an ISO 8601 timestamp in UTC.
  - `dateDiscovered` string, date-time — The date and time when the incident was discovered, represented as an ISO 8601 timestamp in UTC.
  - `deadline` string, date-time — The date by which the incident investigation or notification must be completed, represented as an ISO 8601 timestamp in UTC.
  - `sourceType` 'MANUAL' | 'ASSESSMENT' | 'WEBFORM' | 'INTEGRATION'
  - `rootCause` string — The root cause summary of the incident.
  - `notificationNeeded` 'YES' | 'NO' | 'UNKNOWN'
  - `attributeValues` object — A map of custom attribute field names to the list of values associated with each attribute. Each entry in the list can contain either an 'id' (for predefined options) or a 'value', depending on the attribute configuration. If any attribute value is missing in the JSON array, the existing value for that attribute will be overridden, and the attribute will have empty values.
  - `incidentAssigneeRequests` IncidentAssigneeRequest[] — A list of incident assignee requests, where each request includes an assignee's ID, optional email, and type (USER or GROUP).
    - `assigneeId` string, uuid, required — Incident User Assignee Id
    - `assigneeEmail` string, email — Email of the incident assignee. This field is valid only when the assignee type is "USER".
    - `type` 'USER' | 'GROUP' — Indicates whether the assignee is an individual user or a group of users.
  - `jurisdictions` IncidentJurisdictionCreateRequest[]
    - `jurisdictionId` string, uuid — Incident Jurisdiction Id
    - `countryCode` string, required — Three-digit country code of the jurisdiction.
    - `stateProvinceCode` string — State Province Code. **Required if countryCode is 'USA' or 'CAN'**.
  - `linkedInventories` object — Map of inventory types to a single inventory link request. Keys represent inventory types ('assets', 'processing-activities', 'vendors', 'entities'), and the value contains either externalIds or inventoryIds.
  - `autoAssessJurisdictions` boolean — If set to true, automatically assess jurisdictions after incident creation.

## Response `201`

Incident created successfully. The response contains the UUID of the newly created incident.

- string, uuid

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500` — Internal Server Error

---

[API](https://skmtc.net/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.net/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/revisions/21de3aa0b170/schema)