For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/api/latest/case-management/add-insights-to-a-case.md. A documentation index is available at /llms.txt.
Language
Datadog site

Add insights to a work item

PUThttps://api.datadoghq.com/api/v2/cases/{case_id}/insightshttps://api.us3.datadoghq.com/api/v2/cases/{case_id}/insightshttps://api.us5.datadoghq.com/api/v2/cases/{case_id}/insightshttps://api.datadoghq.eu/api/v2/cases/{case_id}/insightshttps://api.ap1.datadoghq.com/api/v2/cases/{case_id}/insightshttps://api.ap2.datadoghq.com/api/v2/cases/{case_id}/insightshttps://api.uk1.datadoghq.com/api/v2/cases/{case_id}/insightshttps://api.ddog-gov.com/api/v2/cases/{case_id}/insightshttps://api.us2.ddog-gov.com/api/v2/cases/{case_id}/insights

Overview

Adds one or more insights to a work item. Insights are references to related Datadog resources (such as monitors, security signals, incidents, or error tracking issues) that provide investigative context. Up to 100 insights can be added per request. Each insight requires a type (see CaseInsightType for allowed values), a ref (URL path to the resource), and a resource_id.

OAuth apps require the cases_write authorization scope to access this endpoint.

Arguments

Path Parameters

Name
Type
Description
case_id [required]
string

Work item's UUID or key

Request

Body Data (required)

Work item insights request.

Field
Type
Description
data [required]
object

Data object containing the insights to add or remove.

Response

OK

Work item response

Field
Type
Description
data
object

A work item

Code Example

Add insights to a work item
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF
# Path parameters
export case_id="f98a5a5b-e0ff-45d4-b2f5-afe6e74de504"

# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PUT "https://api.${DD_SITE}/api/v2/cases/${case_id}/insights" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "insights": [
        {
          "ref": "/monitors/12345?q=total",
          "resource_id": "12345",
          "type": "SECURITY_SIGNAL"
        }
      ]
    },
    "type": "case"
  }
}
EOF