Add incident link
POST/api/security/incidents/:incident_id/links
Link evidence (finding / shadow candidate / agent / event / execution / policy decision / simulation run) that exists in THIS tenant,
with an optional short note. Idempotent: re-linking returns the existing link with created: false and writes no second timeline/audit
entry. The response carries the link row id, the target ref_id, title, href (a real UI route or null) and note.
Request
Responses
- 200
- 401
- 403
- 422
Successful Response
The token is missing, invalid or expired. Refresh it, or sign in again.
Your role does not allow this. The detail names the missing permission or role.
Validation Error