Incident Response Common Operating Picture

Incident Response COP API (v1.0.0)

API for managing key terrain project status, battle rhythm events, RFIs, change requests, CCIRs, the Incident Tracker, and related dashboard data. Incident rows are exposed at /api/incident-tracker-entries.

Machine-readable spec: /api/openapi.json

API tag groups

Logical groupings used in the OpenAPI spec (e.g. incident management).

• Incidents

  Incident Tracker rows on the dashboard. Use GET/POST/DELETE on /api/incident-tracker-entries. Responses use incident_name, status, team_assigned, and details (stored in the action_tracker_entries table). List order is in_progress, then backlog, then completed, then by recorded_at descending. Updates: JSON PATCH or PUT on /api/incident-tracker-entries/{entry_id}, or HTML POST /incident-tracker/{entry_id}/edit.

Endpoints

• GET /api/health Health check
  Response 200 Example

  {
    "status": "ok"
  }

• GET /api/projects List all projects
• POST /api/projects Create project
  Request JSON Example

  {
    "description": "Milestone 2 deployment prep.",
    "name": "Customer Portal",
    "owner": "Team A",
    "status": "in_progress"
  }

• GET /api/projects/{project_id} Get project by id
• PUT /api/projects/{project_id} Replace/update project fields
• PATCH /api/projects/{project_id} Update project fields
  Request JSON Example

  {
    "description": "Restored operations.",
    "status": "green"
  }

• DELETE /api/projects/{project_id} Delete project
• GET /api/battle-rhythm List battle rhythm events (military-time sorted)
• POST /api/battle-rhythm Create battle rhythm event
  Request JSON Example

  {
    "event_time": "1430",
    "title": "Commander Update"
  }

• GET /api/battle-rhythm/{item_id} Get battle rhythm event by id
• PUT /api/battle-rhythm/{item_id} Replace/update battle rhythm event
• PATCH /api/battle-rhythm/{item_id} Update battle rhythm event
  Request JSON Example

  {
    "event_time": "1600",
    "title": "Commander Update"
  }

• DELETE /api/battle-rhythm/{item_id} Delete battle rhythm event
• GET /api/rfis List RFI items
• POST /api/rfis Create RFI item
  Request JSON Example

  {
    "status": "backlog",
    "subject": "Firewall log retention policy"
  }

• GET /api/rfis/{rfi_id} Get RFI by id
• PUT /api/rfis/{rfi_id} Replace/update RFI
• PATCH /api/rfis/{rfi_id} Update RFI (status change updates status_changed_at)
  Request JSON Example

  {
    "status": "in_progress"
  }

• DELETE /api/rfis/{rfi_id} Delete RFI
• GET /api/change-requests List change request items
• POST /api/change-requests Create change request
  Request JSON Example

  {
    "status": "backlog",
    "subject": "Open port 443 on segment DMZ-2"
  }

• GET /api/change-requests/{cr_id} Get change request by id
• PUT /api/change-requests/{cr_id} Replace/update change request
• PATCH /api/change-requests/{cr_id} Update change request
  Request JSON Example

  {
    "status": "in_progress"
  }

• DELETE /api/change-requests/{cr_id} Delete change request
• GET /api/incident-tracker-entries List incident tracker entries
  Response 200 Example

  [
    {
      "created_at": "2026-05-08T18:31:00",
      "details": "Containment in progress; MFA reset queued.",
      "id": 1,
      "incident_name": "Phishing \u2014 exec mailbox",
      "recorded_at": "2026-05-08T18:30:00",
      "status": "in_progress",
      "team_assigned": "IRT-Alpha",
      "updated_at": "2026-05-08T18:31:00"
    }
  ]

• POST /api/incident-tracker-entries Create incident tracker entry
  Request JSON Example

  {
    "details": "Isolated host; EDR sweep running.",
    "incident_name": "Ransomware precursors on DC-Auth",
    "recorded_at": "2026-05-08T18:30:00-04:00",
    "status": "in_progress",
    "team_assigned": "IRT-Bravo"
  }

  Response 201 Example

  {
    "created_at": "2026-05-08T22:31:00",
    "details": "Isolated host; EDR sweep running.",
    "id": 42,
    "incident_name": "Ransomware precursors on DC-Auth",
    "recorded_at": "2026-05-08T22:30:00",
    "status": "in_progress",
    "team_assigned": "IRT-Bravo",
    "updated_at": "2026-05-08T22:31:00"
  }

  Response 400 Example

  {
    "error": "incident_name and team_assigned are required"
  }

• GET /api/incident-tracker-entries/{entry_id}
• PUT /api/incident-tracker-entries/{entry_id} Update incident tracker entry (same semantics as PATCH)
• PATCH /api/incident-tracker-entries/{entry_id} Update incident tracker entry (partial)
  Request JSON Example

  {
    "details": "Containment verified.",
    "status": "completed"
  }

  Response 500 Example

  {
    "error": "failed to update entry"
  }

• DELETE /api/incident-tracker-entries/{entry_id} Delete incident tracker entry
  Response 500 Example

  {
    "error": "failed to delete entry"
  }

• GET /api/openapi.json Machine-readable OpenAPI 3.1 contract
  Response 200 Example

  {
    "info": {
      "title": "Incident Response COP API",
      "version": "1.0.0"
    },
    "openapi": "3.1.0"
  }