---
title: Case notification payloads
url: https://www.tines.com/stories/docs/api/cases/case-notification-payloads/
updated: 2026-11-06T12:12:36+00:00
description: A [case notification webhook](/api/cases/webhooks/create) sends an HTTP `POST` request when a selected case event occurs. For webhooks triggered by case actions, see [Case action payloads](/api/cases/case-action-payloads).
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Tines API](https://www.tines.com/stories/docs/api/llms.txt) › [Cases](https://www.tines.com/llm/stories/docs/api/cases.md)*

# Case notification payloads

*[View on tines.com](https://www.tines.com/stories/docs/api/cases/case-notification-payloads/)*

A [case notification webhook](/api/cases/webhooks/create) sends an HTTP `POST` request when a selected case event occurs. For webhooks triggered by case actions, see [Case action payloads](/api/cases/case-action-payloads).

The examples on this page are abridged to highlight the fields relevant to each event. Actual requests include the full current `case` object. Optional values can be `null`, and collections can be empty.

Every version 2.0 notification uses this envelope:

```json
{
  "activity": {
    "id": 812,
    "activity_type": "commented",
    "value": "Investigating the source IP.",
    "created_at": "2026-09-03T14:10:22.000Z",
    "user": {
      "id": 27,
      "first_name": "Alex",
      "last_name": "Smith",
      "email": "alex.smith@example.com"
    }
  },
  "case": {
    "id": 42,
    "name": "Suspicious sign-in",
    "status": "open",
    "url": "https://tenant.tines.com/cases/42"
  },
  "version": 2.0
}
```

Most variation occurs inside `activity`. The supported notification types reuse the following shapes.

## Standard activities

Standard activities use the `activity` object shown in the envelope above. Only `activity_type` and `value` change.

| `activity_type`             | Example `value`                                         |
| --------------------------- | ------------------------------------------------------- |
| `created`                   | `"42"`                                                  |
| `assigned`                  | `"27,31"` (comma-separated user IDs)                    |
| `unassigned`                | `"27"` (comma-separated user IDs)                       |
| `commented`                 | `"Investigating the source IP."`                        |
| `deleted_comment`           | `"Investigating the source IP."`                        |
| `status_updated`            | `"closed"`                                              |
| `severity_updated`          | `"high"`                                                |
| `tags_added`                | `"Identity,Compromised"`                                |
| `tags_removed`              | `"Needs review"`                                        |
| `file_deleted`              | `null`                                                  |
| `file_pasted`               | `null`                                                  |
| `checklist_item_completed`  | `"Reset the user's password"`                           |
| `checklist_item_incomplete` | `"Reset the user's password"`                           |
| `linked_case_added`         | `"37"`                                                  |
| `linked_case_removed`       | `"37"`                                                  |
| `metadata_updated`          | `"{\"source\":\"identity-provider\"}"`                  |
| `sla_warning`               | `"response"`                                            |
| `sla_exceeded`              | `"resolution"`                                          |
| `team_updated`              | `"Security operations"`                                 |
| `field_updated`             | `"Account type: Corporate account"`                     |
| `description_updated`       | `"Investigate the source IP and reset the credentials"` |
| `title_updated`             | `"Confirmed account compromise"`                        |
| `task_converted_to_case`    | `"43"`                                                  |

The `metadata_updated` value is a JSON-encoded string, not a nested JSON object.

## Activities that reference another object

These activities add `value_id`. It identifies the related sub-status, record, comment, note, or task.

```json
{
  "id": 815,
  "activity_type": "task_completed",
  "value": "Reset the user's password",
  "value_id": 56,
  "created_at": "2026-09-03T14:18:03.000Z",
  "user": {
    "id": 27,
    "first_name": "Alex",
    "last_name": "Smith",
    "email": "alex.smith@example.com"
  }
}
```

| `activity_type`             | Example `value`                     | `value_id` identifies |
| --------------------------- | ----------------------------------- | --------------------- |
| `comment_updated`           | `"Updated investigation details"`   | Comment               |
| `sub_status_updated`        | `null`                              | Sub-status            |
| `record_result_set_added`   | `"alex@example.com,true"`           | Record                |
| `record_result_set_removed` | `"alex@example.com,true"`           | Record                |
| `note_added`                | `null`                              | Note                  |
| `note_updated`              | `null`                              | Note                  |
| `note_deleted`              | `null`                              | Note                  |
| `task_created`              | `"Reset the user's password"`       | Task                  |
| `task_deleted`              | `56`                                | Deleted task          |
| `task_completed`            | `"Reset the user's password"`       | Task                  |
| `task_incomplete`           | `"Reset the user's password"`       | Task                  |
| `task_updated`              | `"Reset the user's password today"` | Task                  |
| `task_assigned`             | `"Reset the user's password"`       | Task                  |
| `task_unassigned`           | `"Reset the user's password"`       | Task                  |

For task activities, `value` is the task description. If the task no longer exists, such as after deletion, `value` is its numeric ID.

## File activities

`file_attached` and `file_attached_and_commented` add a `file` object. The latter includes the comment text in `value`; `file_attached` uses `null`.

```json
{
  "id": 813,
  "activity_type": "file_attached_and_commented",
  "value": "Sign-in details from the identity provider.",
  "created_at": "2026-09-03T14:12:08.000Z",
  "user": {
    "id": 27,
    "first_name": "Alex",
    "last_name": "Smith",
    "email": "alex.smith@example.com"
  },
  "file": {
    "filename": "sign-in-details.txt",
    "url": "https://tenant.tines.com/api/v2/cases/42/files/813/download"
  }
}
```

## Comment sub-events

Comment reactions, removed reactions, and legacy comment edits add `comment_activity`, which contains the affected comment.

```json
{
  "id": 96,
  "activity_type": "reacted",
  "value": ":+1:",
  "created_at": "2026-09-03T14:14:37.000Z",
  "user": {
    "id": 31,
    "first_name": "Morgan",
    "last_name": "Lee",
    "email": "morgan.lee@example.com"
  },
  "comment_activity": {
    "id": 812,
    "activity_type": "commented",
    "value": "Investigating the source IP.",
    "created_at": "2026-09-03T14:10:22.000Z",
    "user": {
      "id": 27,
      "first_name": "Alex",
      "last_name": "Smith",
      "email": "alex.smith@example.com"
    }
  }
}
```

| `activity_type` | Example `value`                   |
| --------------- | --------------------------------- |
| `reacted`       | `":+1:"`                          |
| `unreacted`     | `":+1:"`                          |
| `edited`        | `"Updated investigation details"` |

These sub-events follow the notification setting for the affected comment. Consumers should also accept unknown `activity_type` values so that newly added case activities do not break webhook processing.

The full notification `case` object includes `id`, `team_id`, `name`, `description`, `status`, `sub_status`, `priority`, `tags`, `assignees`, `subscribers`, `author`, case timestamps, `opened_by`, `resolved_by`, `metadata`, `url`, `linked_cases`, `record_ids`, `fields`, `tasks`, and `blocks`.