API Reference

API Reference

All new IRIS-NG features are exposed under /api/v2/. The legacy API (/case/..., /manage/...) remains for backwards compatibility with existing n8n workflows and clients.

Response shape: /api/v2/ returns the payload directly as the JSON body — no {status, message, data} wrapper. Read it as-is.

Authentication: API key via Authorization: Bearer <key>, or session cookie.

CSRF: POST/PUT/DELETE requires X-CSRFToken header (read from <input id="csrf_token">), or csrf_token form field for multipart/form-data requests.

---

Cases

Method	Path	Description
POST	/api/v2/cases/<cid>/export	Export case as AES-256-GCM encrypted .iris-case (password in body)
POST	/api/v2/cases/import	Import encrypted .iris-case (multipart: file + password)

AI surfaces (cases)

Method	Path	Description
POST	/api/v2/cases/<cid>/ai/summary	Executive case summary (async, returns 202 + task_id)
POST	/api/v2/cases/<cid>/ai/ask	Case-scoped chat (async, returns 202 + task_id)
POST	/api/v2/cases/<cid>/ai/timeline-analysis	Running timeline narrative
POST	/api/v2/cases/<cid>/ai/timeline/events/<eid>/analysis	Per-event analysis drawer
POST	/api/v2/cases/<cid>/ai/ioc-extraction	Extract IOCs from note text
POST	/api/v2/cases/<cid>/ai/attack-suggestion	MITRE ATT&CK + UKC suggestion
POST	/api/v2/cases/<cid>/ai/tag-suggestion	Tag suggestion (MISP taxonomies + galaxies)
POST	/api/v2/cases/<cid>/ai/evidence-type-suggestion	Evidence type suggestion
PUT	/api/v2/cases/<cid>/ai/summary/edit	Save an analyst correction to the summary (body: content)
DELETE	/api/v2/cases/<cid>/ai/summary/edit	Discard the correction, restore the AI original

POST .../ai/summary returns 409 (reason: manual_edit_present) when the stored summary has been manually edited; pass ?discard_edit=true to regenerate anyway. See AI Features → Manual override.

Notifications

Method	Path	Description
GET	/api/v2/cases/<cid>/notifications	Unread activity for this case, plus counts and watermark
GET	/api/v2/cases/<cid>/notifications/count	Badge number only
POST	/api/v2/cases/<cid>/notifications/ack	Move the read watermark (body: up_to)

Scoped to the case in the URL and to the calling user. Read access is sufficient to acknowledge. Pass up_to as the latest_at returned by the list call so activity arriving mid-read is not swallowed; a malformed timestamp returns 400. See Case Notifications.

AI job queue

Method	Path	Description
GET	/api/v2/ai/jobs/<task_id>	Poll job status
DELETE	/api/v2/ai/jobs/<task_id>	Cancel queued job
GET	/api/v2/ai/jobs	List jobs (query: case_id, state)

Task linking

Method	Path	Description
GET	/api/v2/cases/<cid>/tasks/<tid>/links	Get links for a task
POST	/api/v2/cases/<cid>/tasks/<tid>/links	Create a link (body: to_task_id, link_type, direction)
DELETE	/api/v2/cases/<cid>/tasks/<tid>/links/<link_id>	Remove a link
GET	/api/v2/cases/<cid>/tasks/links	Bulk — all links for a case (one round-trip)

Link types: blocks / depends_on. Direction: forward or inverse (stored in canonical forward form; inverse views computed at read time).

IOC ↔ Note provenance

Method	Path	Description
GET	/api/v2/cases/<cid>/iocs/<iid>/source-notes	List notes linked to an IOC
POST	/api/v2/cases/<cid>/iocs/<iid>/source-notes	Link a note to an IOC

Working timeline

Method	Path	Description
POST	/api/v2/cases/<cid>/working-timeline/import/hayabusa	Import Hayabusa JSONL
POST	/api/v2/cases/<cid>/working-timeline/import/eztools	Import EZ Tools/KAPE CSV
POST	/api/v2/cases/<cid>/working-timeline/import/master-csv	Import master-timeline CSV
GET	/api/v2/cases/<cid>/working-timeline/events	List working events
POST	/api/v2/cases/<cid>/working-timeline/events/<eid>/promote	Promote to master timeline
POST	/api/v2/cases/<cid>/working-timeline/events/<eid>/reject	Reject event
POST	/api/v2/cases/<cid>/working-timeline/events/<eid>/reset	Reset to pending
GET	/api/v2/cases/<cid>/working-timeline/events/<eid>/explain	Get AI explanation
DELETE (batch)	/api/v2/cases/<cid>/working-timeline/events	Batch delete

All import endpoints accept optional begin_date and end_date (YYYY-MM-DD).

Time tracking

Method	Path	Description
GET	/api/v2/cases/<cid>/time-entries	List time entries for a case
POST	/api/v2/cases/<cid>/time-entries	Log time (body: minutes must be multiple of 15, date, optional task_id/note_id)
PUT	/api/v2/cases/<cid>/time-entries/<eid>	Update entry (case must be open)
DELETE	/api/v2/cases/<cid>/time-entries/<eid>	Delete entry (case must be open)
GET	/api/v2/cases/time-nudge	"You haven't logged time" nudge check

Per-case team

Method	Path	Description
GET	/api/v2/cases/<cid>/team	Get assigned analysts + lead
PUT	/api/v2/cases/<cid>/team	Set assigned analysts
GET	/api/v2/cases/<cid>/team/skills	Get required skills for the case
PUT	/api/v2/cases/<cid>/team/skills	Set required skills
GET	/api/v2/cases/<cid>/team/suggest	Greedy set-cover analyst suggestion
GET	/api/v2/cases/<cid>/team/skills/derive	Auto-derive required skills from classification + tags

---

Alerts

Method	Path	Description
POST	/api/v2/alerts/<alert_id>/ai/case-template-suggestion	Suggest case template for an alert

---

Correlation

Method	Path	Description
GET	/api/v2/correlation/report	Full correlation report (query: start_date, end_date, min_shared)
GET	/api/v2/correlation/ioc-context	Cross-case context for a single IOC (query: ioc_value, ioc_type_id)
POST	/api/v2/correlation/apply-campaign-tag	Apply campaign tag to cluster cases + IOCs
POST	/api/v2/correlation/cluster-narrative	AI cluster narrative (body: cluster, case_meta, force, discard_edit). Returns 409 if manually edited
PUT	/api/v2/correlation/cluster-narrative/edit	Save an analyst correction (body: cluster_id, case_ids, suggested_name, narrative)
DELETE	/api/v2/correlation/cluster-narrative/edit	Discard the correction, restore the AI original
POST	/api/v2/correlation/clusters/<id>/misp-push	Publish a cluster to MISP as a campaign event (body: min_shared, start_date, end_date, force). Returns 409 if already published

---

Dashboard

Metrics

Method	Path	Description
GET	/api/v2/dashboard/metrics	Metrics summary (query: start, end, ci_year, tag_year)
GET	/api/v2/dashboard/metrics/bar-data	Multi-year grouped bar data (query: section, years)

Inventory (evidence drives)

Method	Path	Description
GET	/api/v2/dashboard/inventory/drives	List drives
POST	/api/v2/dashboard/inventory/drives	Create drive
PUT	/api/v2/dashboard/inventory/drives/<id>	Update drive (sparse — only fields in body are touched)
DELETE	/api/v2/dashboard/inventory/drives/<id>	Delete drive
POST	/api/v2/dashboard/inventory/drives/<id>/wipe	Wipe drive (unlinks evidence, keeps rows)
GET	/api/v2/dashboard/inventory/lookup	Lookup drive by barcode (query: barcode)

---

Teams

Method	Path	Description
GET	/api/v2/teams/analyst-skills	All active non-service-account users + their skill IDs (read-only)

---

MISP tags

Method	Path	Description
GET	/api/v2/misp-tags/search	Search bundled MISP catalog (query: q, limit)

---

Auth / context

Method	Path	Description
GET	/api/v2/auth/...	Authentication endpoints
GET	/api/v2/context/...	Case context for templates

---

Legacy API (backwards-compatible, not recommended for new clients)

The legacy API is documented in the upstream DFIR-IRIS API reference. Key endpoints used by n8n workflows and the upstream documentation:

Path	Notes
GET /manage/cases/list	Case list (used by n8n)
GET /case/export?cid=<id>	Full case JSON export (LLM input)
POST /case/summary/update?cid=<id>	Update case summary
GET /case/timeline/advanced-filter?cid=<id>	Master timeline list (feeds current_timeline in the UI)
POST /case/timeline/events/flag/<id>?cid=<id>	Toggle event flag (v1 only)

Note: the cid parameter is always a query-string parameter in the legacy API, not a body field. Putting it in the body silently fails ACL checks.