Case notification payloads

A case notification webhook sends an HTTP POST request when a selected case event occurs. For webhooks triggered by case actions, see Case action payloads.

The examples on this page are abridged to highlight the fields relevant to each event. Actual requests include the full current case object. Optional values can be null, and collections can be empty.

Every version 2.0 notification uses this envelope:

{
  "activity": {
    "id": 812,
    "activity_type": "commented",
    "value": "Investigating the source IP.",
    "created_at": "2026-09-03T14:10:22.000Z",
    "user": {
      "id": 27,
      "first_name": "Alex",
      "last_name": "Smith",
      "email": "alex.smith@example.com"
    }
  },
  "case": {
    "id": 42,
    "name": "Suspicious sign-in",
    "status": "open",
    "url": "https://tenant.tines.com/cases/42"
  },
  "version": 2.0
}

Most variation occurs inside activity. The supported notification types reuse the following shapes.

Standard activities

Standard activities use the activity object shown in the envelope above. Only activity_type and value change.

activity_type	Example value
created	"42"
assigned	"27,31" (comma-separated user IDs)
unassigned	"27" (comma-separated user IDs)
commented	"Investigating the source IP."
deleted_comment	"Investigating the source IP."
status_updated	"closed"
severity_updated	"high"
tags_added	"Identity,Compromised"
tags_removed	"Needs review"
file_deleted	null
file_pasted	null
checklist_item_completed	"Reset the user's password"
checklist_item_incomplete	"Reset the user's password"
linked_case_added	"37"
linked_case_removed	"37"
metadata_updated	"{\"source\":\"identity-provider\"}"
sla_warning	"response"
sla_exceeded	"resolution"
team_updated	"Security operations"
field_updated	"Account type: Corporate account"
description_updated	"Investigate the source IP and reset the credentials"
title_updated	"Confirmed account compromise"
task_converted_to_case	"43"

The metadata_updated value is a JSON-encoded string, not a nested JSON object.

Activities that reference another object

These activities add value_id. It identifies the related sub-status, record, comment, note, or task.

{
  "id": 815,
  "activity_type": "task_completed",
  "value": "Reset the user's password",
  "value_id": 56,
  "created_at": "2026-09-03T14:18:03.000Z",
  "user": {
    "id": 27,
    "first_name": "Alex",
    "last_name": "Smith",
    "email": "alex.smith@example.com"
  }
}

activity_type	Example value	value_id identifies
comment_updated	"Updated investigation details"	Comment
sub_status_updated	null	Sub-status
record_result_set_added	"alex@example.com,true"	Record
record_result_set_removed	"alex@example.com,true"	Record
note_added	null	Note
note_updated	null	Note
note_deleted	null	Note
task_created	"Reset the user's password"	Task
task_deleted	56	Deleted task
task_completed	"Reset the user's password"	Task
task_incomplete	"Reset the user's password"	Task
task_updated	"Reset the user's password today"	Task
task_assigned	"Reset the user's password"	Task
task_unassigned	"Reset the user's password"	Task

For task activities, value is the task description. If the task no longer exists, such as after deletion, value is its numeric ID.

File activities

file_attached and file_attached_and_commented add a file object. The latter includes the comment text in value; file_attached uses null.

{
  "id": 813,
  "activity_type": "file_attached_and_commented",
  "value": "Sign-in details from the identity provider.",
  "created_at": "2026-09-03T14:12:08.000Z",
  "user": {
    "id": 27,
    "first_name": "Alex",
    "last_name": "Smith",
    "email": "alex.smith@example.com"
  },
  "file": {
    "filename": "sign-in-details.txt",
    "url": "https://tenant.tines.com/api/v2/cases/42/files/813/download"
  }
}

Comment sub-events

Comment reactions, removed reactions, and legacy comment edits add comment_activity, which contains the affected comment.

{
  "id": 96,
  "activity_type": "reacted",
  "value": ":+1:",
  "created_at": "2026-09-03T14:14:37.000Z",
  "user": {
    "id": 31,
    "first_name": "Morgan",
    "last_name": "Lee",
    "email": "morgan.lee@example.com"
  },
  "comment_activity": {
    "id": 812,
    "activity_type": "commented",
    "value": "Investigating the source IP.",
    "created_at": "2026-09-03T14:10:22.000Z",
    "user": {
      "id": 27,
      "first_name": "Alex",
      "last_name": "Smith",
      "email": "alex.smith@example.com"
    }
  }
}

activity_type	Example value
reacted	":+1:"
unreacted	":+1:"
edited	"Updated investigation details"

These sub-events follow the notification setting for the affected comment. Consumers should also accept unknown activity_type values so that newly added case activities do not break webhook processing.

The full notification case object includes id, team_id, name, description, status, sub_status, priority, tags, assignees, subscribers, author, case timestamps, opened_by, resolved_by, metadata, url, linked_cases, record_ids, fields, tasks, and blocks.