Identifiers and vocabulary cheat sheet
Most integration bugs come from mixing up identifier types or getting enum casing wrong. This page is the reference to keep open while you build.
Identifier and value map
| Concept | Value to use | Where it comes from |
|---|---|---|
| Incident identifier | Display ID, XVA-1234 | incident_details.incident_id on alerts, incidentDisplayId on snapshot rows, entityId on changelog rows |
| Event identifier | base64 event_record_identifier | event_details.event_id on alerts, eventId on snapshot rows |
| Priority | P0, P1, P2 (uniform on reads, filters, and writes) | any surface; values round-trip without mapping |
| Status (writes and filters) | Open, Acknowledged, Reopen, InProgress, ClosedFalsePositive, ClosedIrrelevant, ClosedResolved, ClosedInformational | write enum; alert payloads render status lowercase and changelog currentState uses internal labels |
| Module (filters, rows, write echoes) | canonical keys: CompromisedComputers, FakeMobileApps, DocumentsandOpenBuckets, and more. One key per request on module_name filters | changelog and snapshot rows, write responses, all module_name filter enums |
| Module (alert payload display) | module_name = category ("Brand Risk Monitoring"), sub_module = module ("Fake Mobile Apps") | display fields only; canonical key = sub_module with the spaces removed |
Three rules that prevent most bugs
- Enum inputs are exact-match and case-sensitive.
P1, notp1.Open, notopen. A wrong-case value gets400 VALIDATION_ERROR. - Machine values round-trip; display values do not. Anything read from changelog rows, snapshot rows, or write responses can be fed into any filter. The alert payload's
module_nameandsub_moduleare for humans; derive the key by stripping spaces fromsub_module. org_idis optional everywhere. Tenancy is inferred from the token and the target identifier. Pass it only to disambiguate a sub-org under a parent-org token.