cycase-gyq1usuwp-cengizhankoses-projects.vercel.app

take_response_action

Apply a real containment action to the simulated environment: revoke_sessions, reset_credentials, isolate_endpoint, block_indicator or close_case. These are consequential and are reflected immediately in the analyst dashboard. Supply a unique idempotencyKey per intended application; re-sending the same key replays the original result rather than applying twice. close_case is refused until decision D6 is submitted. The result carries `effects`: the exact before/after of every simulated source the action moved, diffed from the simulation rather than described, so an effect that is absent did not happen — a credential reset reports no session change because it revokes nothing. `stillOpen` names the gaps the action left behind. Explain the case from those two fields rather than from the action name.

Input schema

{
  "type": "object",
  "properties": {
    "actionId": {
      "type": "string",
      "enum": [
        "revoke_sessions",
        "reset_credentials",
        "isolate_endpoint",
        "block_indicator",
        "close_case"
      ],
      "description": "Consequential response action to apply to the simulated environment."
    },
    "stateVersion": {
      "type": "integer",
      "minimum": 0
    },
    "idempotencyKey": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128,
      "pattern": "^[A-Za-z0-9._:-]+$",
      "description": "Unique per intended application. Re-sending the same key replays the original result instead of applying twice."
    }
  },
  "required": [
    "actionId",
    "stateVersion",
    "idempotencyKey"
  ],
  "additionalProperties": false
}