> ## Documentation Index > Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt > Use this file to discover all available pages before exploring further. # Add Evidence > Adds a piece of evidence to an investigation. ## OpenAPI ````yaml /documentation/api-reference/v3.yaml post /investigations/{investigationId}/evidence openapi: 3.0.0 info: title: USM Anywhere Investigations API version: '3' description: >- This document contains the API specification for the Investigations microservice. You can use this API to build, delete, modify, or list the Investigation objects, which may contain attachments, evidence, or notes. contact: url: http://www.levelblue.com servers: - url: http://investigations.{region}.alienvault.cloud/investigations/v3 security: - JWT: [] tags: - name: Attachments - name: Evidence - name: History - name: Investigations - name: Notes paths: /investigations/{investigationId}/evidence: parameters: - $ref: '#/components/parameters/investigationId' post: tags: - Evidence summary: Add Evidence description: Adds a piece of evidence to an investigation. operationId: post-investigations-investigationId-evidence requestBody: content: application/json: schema: $ref: '#/components/schemas/pEvidence' description: |- The POST body is information about the evidence to associate with the investigation. responses: '201': description: CREATED headers: X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' content: application/json: schema: $ref: '#/components/schemas/gEvidence' '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': $ref: '#/components/responses/404' '406': $ref: '#/components/responses/406' '411': $ref: '#/components/responses/411' '415': $ref: '#/components/responses/415' '429': $ref: '#/components/responses/429' '500': $ref: '#/components/responses/500' '503': $ref: '#/components/responses/503' components: parameters: investigationId: name: investigationId description: The unique identifier of an investigation. in: path schema: type: string format: uuid required: true schemas: pEvidence: title: createEvidence type: object description: 'Adds an Evidence object. ' properties: urn: $ref: '#/components/schemas/urn' summary: $ref: '#/components/schemas/summary' required: - urn gEvidence: title: getEvidence type: object properties: _links: $ref: '#/components/schemas/linksSelf' id: $ref: '#/components/schemas/id' urn: $ref: '#/components/schemas/urn' summary: $ref: '#/components/schemas/summary' created: $ref: '#/components/schemas/created' description: Returns an evidence. urn: title: urn type: string description: >- Uniform Resource Name (URN) of the evidence. It may contain an alarm, event, user, asset, or other information as edidence for the investigation. summary: title: summary type: string description: >- Summary information from the source object providing the evidence. Such information is not subject to change or modified by a user. linksSelf: type: object properties: self: allOf: - $ref: '#/components/schemas/selfLink' id: type: string title: id format: uuid description: Unique identifier of the resource. created: allOf: - $ref: '#/components/schemas/_modOnBy' description: 'Specifies when the resource was created and by whom. ' errorBody: title: errorBody type: object properties: errorId: type: string description: |- Unique errorId in the context of an API. Recommendation: two hyphen-delimited subfields: * Domain: identifies the API, application, service or general category to which the error belongs. * Code: provides a unique numeric code within the domain. Examples: General-0001, DataDict-0001 message: type: string description: Message text variables: type: array description: >- List of zero or more strings that represent the contents of the variables used by the message text. items: type: string errorUrl: type: string format: uri description: >- Hyperlink to more information about the error, including causes and solutions. required: - errorId - message x-examples: full error body: errorId: addressbook-0003 message: 'Invalid input value for property %1. Valid values are: %2.' variables: - addressType - Home, Work, Other errorUrl: http://dev.att.com/apis/errors?code=addressbook-0003 minimal error body: errorId: addressbook-0001 message: Daily TPS limit exceeded. selfLink: type: object description: References the returned resource allOf: - $ref: '#/components/schemas/href' _modOnBy: title: _mod_on_by type: object description: 'Specifies when the change was made and by whom. ' properties: by: type: string format: email description: 'Email of the user who made the change. ' 'on': type: string format: date-time description: >- Date and time when the change was made. Accepted format is ISO-8601 YYYY-MM-DDThh:mm:ss.sTZD. required: - by - 'on' href: type: object description: An absolute URI [RFC3986] format: uri properties: href: type: string format: uri description: An absolute URI [RFC3986] headers: X-ATT-MessageId: description: |- A client-provided value that uniquely identifies a client generated message sent to the service. This header will be present in the response if the client provided one in the request. schema: type: string required: false X-ATT-TransactionId: description: |- A service provided value that uniquely identifies a message returned by the service. schema: type: string format: uuid required: true X-ATT-ServiceVersion: description: |- Identifies the version number of the service that processed the request. schema: type: string required: true Date: schema: type: string format: date-time required: true responses: '400': description: |- Bad Request - Many possible reasons associated with the request (form, content, etc.). Do not resubmit this request unchanged. headers: Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' content: application/json: schema: $ref: '#/components/schemas/errorBody' '401': description: |- Unauthorized - Authentication failed or was not provided in the Authorization header. headers: WWW-Authenticate: schema: type: string enum: - Bearer Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' '403': description: |- Forbidden - The client has insufficient permissions to access the resource headers: Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' '404': description: |- Not Found - The server has not found anything matching the Request-URI. No indication is given of whether the condition is temporary or permanent. headers: Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' '406': description: >- Not Acceptable - The value specified for the Accept header in the request is not supported. Acceptable value is "application/json". headers: Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' '411': description: Length Required - The Content-Length header was not specified. headers: Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' '415': description: >- Unsupported Media Type - The value specified for the Content-Type header in the request is not supported. Acceptable value is "application/json". headers: Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' '429': description: Too Many Requests headers: Date: $ref: '#/components/headers/Date' Retry-After: schema: type: integer description: |- Tells the user how long to wait in seconds before making another request in seconds. X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' '500': description: |- Internal Sever Error - The server encountered an internal error or timed out. Please try again later. headers: Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' '503': description: |- Service Unavailable - The server is currently unable to receive requests. Please try again later. headers: Date: $ref: '#/components/headers/Date' X-ATT-TransactionId: $ref: '#/components/headers/X-ATT-TransactionId' X-ATT-ServiceVersion: $ref: '#/components/headers/X-ATT-ServiceVersion' X-ATT-MessageId: $ref: '#/components/headers/X-ATT-MessageId' securitySchemes: JWT: type: http scheme: bearer ````