Create a new case linked to a reference alert (document-based) or signal alert (entity risk-based) for triage and investigation.
What this endpoint does
Creates a new case in Recorded Future's case management system, linked to an originating alert. The context.type discriminator selects the case type: reference_alert (document-based, requires references array of document IDs) or signal_alert (entity risk-based, requires entity ID and either risk_evidences or references). To construct a valid request, you need: an alert notification ID and alert rule ID from Alerts: Search, and your organization's uhash ID (available in alert owner_organisation_details or via Alerts: Search Rules in the rule's owner.id field). Status values: New, InProgress, Resolved, Dismissed. Priority values: Informational, Moderate, High.
Response data
Returns the new case's task identity (format task:<uuid>) — use this ID for all subsequent case operations including Cases: Lookup, Cases: Update, Cases: Search, and Cases: Delete.