Skip to content

Manage Case Comments๐Ÿ”—

Add, update, search, and delete comments on cases. Comments support @mentions to notify users.

Add Comment๐Ÿ”—

Add a new comment to a case. Comments can include @mentions, which trigger notifications to the mentioned users.

Mutation๐Ÿ”—

mutation addCaseComment($input: AddCaseComment!) {
    addCaseComment(input: $input) {
        id
        comment
        createdAt
        authorId
        mentionsIds
    }
}

Variables๐Ÿ”—

{
    "input": {
        "caseId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
        "comment": "Found additional indicators of compromise. @sophos please review."
    }
}

Response Example๐Ÿ”—

{
    "data": {
        "addCaseComment": {
            "id": "550e8400-e29b-41d4-a716-446655440300",
            "comment": "Found additional indicators of compromise. @sophos please review.",
            "createdAt": "2024-08-14T16:00:00Z",
            "authorId": "550e8400-e29b-41d4-a716-446655440010",
            "mentionsIds": ["550e8400-e29b-41d4-a716-446655440020"]
        }
    }
}

Update Comment๐Ÿ”—

Update an existing comment. Only the comment author can update a comment.

Mutation๐Ÿ”—

mutation updateCaseComment($input: UpdateCaseCommentInput!) {
    updateCaseComment(input: $input) {
        id
        comment
        updatedAt
        authorId
        mentionsIds
    }
}

Variables๐Ÿ”—

{
    "input": {
        "commentId": "550e8400-e29b-41d4-a716-446655440300",
        "comment": "Found additional indicators of compromise and verified malware signatures. @sophos please review.",
        "markAsRead": false
    }
}

Response Example๐Ÿ”—

{
    "data": {
        "updateCaseComment": {
            "id": "550e8400-e29b-41d4-a716-446655440300",
            "comment": "Found additional indicators of compromise and verified malware signatures. @sophos please review.",
            "updatedAt": "2024-08-14T16:15:00Z",
            "authorId": "550e8400-e29b-41d4-a716-446655440010",
            "mentionsIds": ["550e8400-e29b-41d4-a716-446655440020"]
        }
    }
}

Notes๐Ÿ”—

  • Only the comment author can update a comment.
  • markAsRead marks the comment as read for the current user when set to true.
  • Updating a comment with new @mentions will trigger new notifications but won't re-notify users already mentioned.

Delete Comment๐Ÿ”—

Delete an existing comment. Only the comment author can delete a comment.

Mutation๐Ÿ”—

mutation deleteCaseComment($input: DeleteCaseCommentInput!) {
    deleteCaseComment(input: $input) {
        id
        deletedAt
    }
}

Variables๐Ÿ”—

{
    "input": {
        "commentId": "550e8400-e29b-41d4-a716-446655440300"
    }
}

Response Example๐Ÿ”—

{
    "data": {
        "deleteCaseComment": {
            "id": "550e8400-e29b-41d4-a716-446655440300",
            "deletedAt": "2024-08-14T16:20:00Z"
        }
    }
}

Notes๐Ÿ”—

  • This is a hard delete. Data will not be recoverable.
  • Only the comment author can delete a comment.

Search and Filter Comments๐Ÿ”—

Retrieve comments for a case with pagination.

Query๐Ÿ”—

query caseComments($arguments: CaseCommentsArguments!) {
    caseComments(arguments: $arguments) {
        comments {
            id
            authorId
            createdAt
            updatedAt
            comment
            mentionsIds
            readByIds
        }
        totalCount
        totalUnreadCount
    }
}

Variables๐Ÿ”—

{
    "arguments": {
        "caseId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
        "orderBy": "DESCENDING",
        "page": 1,
        "perPage": 20
    }
}

Response Example๐Ÿ”—

{
    "data": {
        "caseComments": {
            "comments": [
                {
                    "id": "550e8400-e29b-41d4-a716-446655440300",
                    "authorId": "550e8400-e29b-41d4-a716-446655440010",
                    "createdAt": "2024-08-14T16:00:00Z",
                    "updatedAt": "2024-08-14T16:15:00Z",
                    "comment": "Found additional indicators of compromise and verified malware signatures.",
                    "mentionsIds": ["550e8400-e29b-41d4-a716-446655440020"],
                    "readByIds": [
                        "550e8400-e29b-41d4-a716-446655440010",
                        "550e8400-e29b-41d4-a716-446655440020"
                    ]
                },
                {
                    "id": "550e8400-e29b-41d4-a716-446655440301",
                    "authorId": "550e8400-e29b-41d4-a716-446655440020",
                    "createdAt": "2024-08-14T16:05:00Z",
                    "updatedAt": "2024-08-14T16:05:00Z",
                    "comment": "Confirmed. Escalating to SOC team.",
                    "mentionsIds": [],
                    "readByIds": ["550e8400-e29b-41d4-a716-446655440020"]
                }
            ],
            "totalCount": 2,
            "totalUnreadCount": 0
        }
    }
}

Notes๐Ÿ”—

  • caseComments only returns non-internal comments. Internal, partner-only comments are never returned to customer callers.
  • totalUnreadCount is not affected by pagination or the orderBy filter โ€” it always reflects the case's total unread count for the current user.

Pagination๐Ÿ”—

Offset-based pagination is supported for comments.

{
    "arguments": {
        "caseId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
        "page": 1,
        "perPage": 20
    }
}
  • page: 1-indexed page number (default: 1)
  • perPage: Results per page, max 100 (default: 25)

Comment Mentions๐Ÿ”—

Mentions in comments notify specific users or groups. Include @mentions in the comment text to trigger notifications.

User and Group IDs๐Ÿ”—

Mentions accept several formats:

  • User ID: UUID of a specific user prefixed with @ (e.g., @550e8400-e29b-41d4-a716-446655440010)
  • Username: @username format (resolved from your tenant)
  • Group ID: UUID of a team or group prefixed with @
  • Group Name: @groupname format (resolved from your tenant)

Special Mentions๐Ÿ”—

Comments support special mentions that route notifications to specific roles or teams. Availability depends on your tenant type and service level:

Mention When Available Use
@customer Non-XDR tenants only Notify your organization
@admin XDR tenants with Cases API Notify administrators
@authorized_contacts Taegis MDR tenants only Notify authorized Taegis MDR contacts
@sophos All tenants (partner-restricted) Notify Sophos team

Partner-restricted mentions (@sophos) may not be available depending on your service agreement.

Your service partner may define custom mentions specific to your agreement. Contact your partner or account team for available mention options.

Finding User IDs๐Ÿ”—

To find user IDs for your tenant, use the Users API to query available users.

Example with Mentions๐Ÿ”—

{
    "input": {
        "caseId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
        "comment": "@550e8400-e29b-41d4-a716-446655440020 please review. @customer this is for your information."
    }
}

Notes๐Ÿ”—

  • Mentions trigger notifications to the mentioned users or groups.
  • @mentions are extracted from the comment text and added to mentionsIds in the response.
  • Updating a comment with new @mentions triggers notifications to newly mentioned users.
  • Users already mentioned in the previous version of the comment will not be re-notified.
  • Special mentions may be restricted by tenant type and service agreement.

Sorting Comments๐Ÿ”—

Sort comments by creation timestamp:

{
    "arguments": {
        "caseId": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
        "orderBy": "DESCENDING"
    }
}

Sort options:

  • ASCENDING - Oldest first (default if orderBy is omitted)
  • DESCENDING - Newest first