Update XSOAR Incident via API - version issues

kbratt — Fri, 08 Aug 2025 19:00:11 GMT

I am trying to update XSOAR Incidents via API, but am having issues with the Optimistic lock and incident versions etc.

I can create incidents via API call and can also get the information from incidents via API.

When I create a new incident in our Dev env, the version for the incident is typically showing as "-1"
I have some incidents that show their version as "0" but I am not sure what changes them from -1 to 0.
When I try to update an incident that is currently at version 0 via API, I get an "error": "object has been modified (15)"
So I run a get on the incident again to get the correct version and it shows version : 0 still...
If I try to update the incident again, I get the same error. This is what I am using for my API Endpoint : /xsoar/public/v1/incident
This is what I have for my update test :

{

"id": "153354",

"version": 0,

"severity": 1

}

Can anyone shed some light on what I am doing wrong?

If I set the version to -1 , it successfully forces the update, but I don't really think that is the correct solution here.

Following docs here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-8-API/Create-or-update-an-incident

topic Update XSOAR Incident via API - version issues in Cortex XSOAR Discussions

Update XSOAR Incident via API - version issues