Far as I know the /incident doesn't accept the rawJSON, you gotta build the body and send in the fields you want, example below.
Better option is to use /incident/json endpoint as this will accept a raw json body, and you and then add a Classifier and Mapper to it via Settings -> Objects Setup -> Incidents -> Classifiers and Mappers -> API Endpoints (3 dots on right side) -> Incident API.
/incident/json body example:
body = {
"name": "json incident",
"type":"xsoar incident type",
"key1":"ready key one",
"key2":"ready key two"
}
/incident API body example
# body of the Incident, with all the fields we want to map.
# createInvestigation = True is required to have the playbook run automatically
body = {
"severity":1,
"owner":"admin",
"CustomFields": {
"eventtype":"Test API"
},
"type":"Unclassified",
"name":"Test Incident API",
"details":"This is a test",
"dbotcreated":"2012-10-27T15:41:55Z",
"createInvestigation": True
}
... View more