---
title: "Create Case Comment"
method: POST
path: "/connect/case/comments/"
tags: ["Cases"]
---

# Create Case Comment

`POST /connect/case/comments/`

Add a new comment to an existing case.

## Request body

- ModelComment
  - `caseId` string, required — The case ID for which this comment is to be attached, or is already attached.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `description` string, required — The comment content itself. Can contain limited markdown syntax.
  - `hours` number — The number of hours spent on the work referenced in this comment. Can be a decimal value.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `kind` string — The kind of object. This is a read-only field.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Response `200`

Outputs the comment object including its generated ID.

- ModelRelatedEvent
  - `caseId` string, required — The case ID for which this related event is to be attached, or is already attached.
  - `createTime` string — The date and time that this object was created. This is a read-only field.
  - `fields` object, required — A mapping of related event field names and their values.
  - `id` string — The ID assigned to this object by the server. This is a read-only field.
  - `kind` string — The kind of object. This is a read-only field.
  - `operation` string — The operation that was applied to the object. This is a read-only field.
  - `updateTime` string — The date and time that this object was last modified. This is a read-only field.
  - `userId` string — The user ID (or API client ID) that initiated this event. This is a read-only field.

## Other responses

- `400` — The provided input object or parameters are malformed or invalid
- `401` — Request was not properly authenticated
- `403` — Insufficient permissions for this request
- `405` — Case module not configured on server
- `500` — Internal SOC error; review SOC logs

---

[API](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api.md) · [All operations](https://skmtc.net/security-onion-solutions/apis/security-onion-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/security-onion-solutions/security-onion-connect-api/versions/0576ce393f8d/schema)