Documentation Index

Fetch the complete documentation index at: https://developers.torq.io/llms.txt

Use this file to discover all available pages before exploring further.

Retrieve verdict actions

  • Published on Jul 30, 2026
  • 1 minute(s) read
Prev Next
Get
/v1/triage/verdict-actions/{integration_id}

Returns the verdict-based action configuration for a specific alert source. Enumerate alert sources via the Integrations API; this endpoint returns the configuration for one of them.

Security
HTTP
Type bearer
Path parameters
integration_id
stringRequired

The alert source ID. This property is required.

Responses
200

A successful response.

Expand All
object
config
object (torq.public.triage.v1.VerdictActionConfig)

The verdict-based action configuration for an alert source.

integration_id
string

The alert source identifier.

verdict_actions
Array of object (torq.public.triage.v1.VerdictActionMapping)

The verdict-to-action mappings, one entry per verdict.

object

A single mapping from a verdict to its post-triage action.

verdict
string

The verdict. Accepted values: "True Positive - Malicious", "True Positive - Benign", "False Positive".

Valid values[ "True Positive - Malicious", "True Positive - Benign", "False Positive" ]
action
string

The post-triage action for this verdict. Accepted values: "open_case", "trigger_workflow", "do_nothing".

Valid values[ "do_nothing", "trigger_workflow", "open_case" ]
updated_at
string (date-time)

The timestamp when the configuration was last updated.

401

Invalid bearer token. If you receive this message more than once try creating a new Client ID/Client Secret or generating a new bearer token.

object
403

You don't have permission to access this resource.

object