> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Override Alert Checklist Closure

> Record a privileged, reasoned override when checklist policy permits it.

Requires the dedicated `alerts:close-override` scope. The effective policy must permit privileged overrides, at least one required item must remain unresolved, and the request must contain a meaningful reason.

This endpoint records the override. Send the subsequent alert status update separately. Reopening the alert or changing a checklist item clears the active override, so a later closure requires a new authorization and reason.


## OpenAPI

````yaml POST /alerts/{id}/checklist/closure-override
openapi: 3.0.3
info:
  title: Casebender API
  description: >-

    # Casebender Security Case Management Platform API


    Welcome to the Casebender REST API. This API provides comprehensive access
    to all platform functions

    for security case management, alert handling, and automation.


    ## Authentication


    All API requests require authentication using an API key:


    ```

    Authorization: Bearer cbr_live_your_api_key_here

    ```


    Alternative: `X-Api-Key: cbr_live_your_api_key_here`


    ## Rate Limiting


    Rate limits are enforced per API key. Response headers include:

    - `X-RateLimit-Limit`: Maximum requests allowed

    - `X-RateLimit-Remaining`: Remaining requests in window

    - `X-RateLimit-Reset`: Unix timestamp when limit resets


    ## Versioning


    This API uses URL-based versioning. Current version: `v1`
            
  version: 1.0.0
  contact:
    name: Casebender Support
    email: support@casebender.com
servers:
  - url: https://demo.casebender.com/api/v1
    description: API v1
security:
  - bearerAuth: []
  - apiKey: []
tags:
  - name: Cases
    description: Case management operations
  - name: Alerts
    description: Alert management operations
  - name: Alert Checklists
    description: Enterprise alert checklist and closure control operations
  - name: Tasks
    description: Task management operations
  - name: Observables
    description: Observable/IOC management
  - name: Evidence
    description: Evidence management
  - name: Comments
    description: Comment operations
  - name: Users
    description: User management
  - name: Teams
    description: Team management
  - name: Organizations
    description: Organization management
  - name: Playbooks
    description: Playbook automation
  - name: Workflows
    description: Workflow management
  - name: Integrations
    description: Integration management
  - name: Webhooks
    description: Webhook subscriptions
  - name: API Keys
    description: API key management
  - name: Templates
    description: Template management
  - name: Custom Fields
    description: Custom field definitions
  - name: SLA
    description: SLA configuration and monitoring
  - name: Audit
    description: Audit log access
  - name: Metrics
    description: Platform metrics
  - name: Health
    description: Service health checks
paths:
  /alerts/{id}/checklist/closure-override:
    post:
      tags:
        - Alert Checklists
      summary: Override alert checklist closure controls
      description: Record a privileged, reasoned override when checklist policy permits it.
      parameters:
        - schema:
            type: string
            minLength: 1
          in: path
          name: id
          required: true
      requestBody:
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              required:
                - reason
                - acknowledgeIncomplete
              properties:
                reason:
                  type: string
                  minLength: 10
                  maxLength: 4000
                acknowledgeIncomplete:
                  type: boolean
                  enum:
                    - true
        required: true
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/def-2'
        '409':
          description: Default Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/def-3'
      security:
        - bearerAuth: []
        - apiKey: []
components:
  schemas:
    def-2:
      type: object
      additionalProperties: false
      required:
        - id
        - alertId
        - policyVersionIds
        - policyFingerprint
        - policySnapshot
        - selectionTrace
        - alertCategoryValueAtInstantiation
        - enforcementMode
        - overrideMode
        - allowAlertSpecificItems
        - requiredCount
        - completedCount
        - waivedCount
        - items
        - instantiatedAt
        - createdAt
        - updatedAt
      properties:
        id:
          type: string
        alertId:
          type: string
        policyVersionIds:
          type: array
          items:
            type: string
        policyFingerprint:
          type: string
        policySnapshot:
          type: object
          additionalProperties: true
        selectionTrace:
          type: array
          items:
            type: object
            additionalProperties: false
            required:
              - policyId
              - policyName
              - policyVersionId
              - scopeKey
              - reasons
            properties:
              policyId:
                type: string
              policyName:
                type: string
              policyVersionId:
                type: string
              scopeKey:
                type: string
              reasons:
                type: array
                items:
                  type: string
        alertCategoryValueAtInstantiation:
          type: string
        enforcementMode:
          type: string
          enum:
            - 'OFF'
            - WARN
            - BLOCK
        overrideMode:
          type: string
          enum:
            - DISALLOWED
            - PRIVILEGED_WITH_REASON
        allowAlertSpecificItems:
          type: boolean
        requiredCount:
          type: integer
          minimum: 0
        completedCount:
          type: integer
          minimum: 0
        waivedCount:
          type: integer
          minimum: 0
        items:
          type: array
          items:
            $ref: '#/components/schemas/def-1'
        closureOverriddenAt:
          type: string
          nullable: true
          format: date-time
        closureOverriddenById:
          type: string
          nullable: true
        closureOverriddenBy:
          allOf:
            - $ref: '#/components/schemas/def-0'
          nullable: true
        closureOverrideReason:
          type: string
          nullable: true
        instantiatedAt:
          type: string
          format: date-time
        completedAt:
          type: string
          nullable: true
          format: date-time
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
      title: AlertChecklist
    def-3:
      type: object
      additionalProperties: false
      required:
        - error
        - message
        - statusCode
      properties:
        error:
          type: string
          enum:
            - STALE_CHECKLIST_ITEM
            - CHECKLIST_DEPENDENCY_INCOMPLETE
            - CHECKLIST_ITEM_ALREADY_RESOLVED
            - CHECKLIST_ITEM_NOT_RESOLVED
            - CHECKLIST_COMMENT_REQUIRED
            - CHECKLIST_ATTACHMENT_REQUIRED
            - CHECKLIST_AUTOMATION_EVIDENCE_REQUIRED
            - CHECKLIST_EVIDENCE_REQUIRED
            - CHECKLIST_OVERRIDE_DISALLOWED
            - CHECKLIST_NOT_CONFIGURED
            - ALERT_SPECIFIC_ITEMS_DISABLED
            - ALERT_SPECIFIC_REQUIRED_FORBIDDEN
            - POLICY_CHECKLIST_ITEM_PROTECTED
            - ALERT_CLOSED
            - CHECKLIST_ITEM_LIMIT_REACHED
            - CHECKLIST_ITEM_HAS_DEPENDENTS
        message:
          type: string
        statusCode:
          type: integer
          enum:
            - 409
        currentRevision:
          type: integer
          minimum: 1
      title: AlertChecklistPreconditionError
    def-1:
      type: object
      additionalProperties: false
      required:
        - id
        - checklistId
        - source
        - sourcePolicyVersionId
        - stableKey
        - title
        - order
        - required
        - requiresComment
        - evidenceRequirement
        - state
        - revision
        - createdAt
        - updatedAt
      properties:
        id:
          type: string
        alertId:
          type: string
        checklistId:
          type: string
        source:
          type: string
          enum:
            - POLICY
            - ALERT_SPECIFIC
        sourcePolicyVersionId:
          type: string
          nullable: true
        stableKey:
          type: string
        groupName:
          type: string
          nullable: true
        title:
          type: string
        description:
          type: string
          nullable: true
        order:
          type: integer
        required:
          type: boolean
        requiresComment:
          type: boolean
        evidenceRequirement:
          type: string
          enum:
            - NONE
            - COMMENT
            - ATTACHMENT
            - AUTOMATION
            - ANY
        dependsOnStableKey:
          type: string
          nullable: true
        conditions:
          type: object
          nullable: true
          additionalProperties: true
        state:
          type: string
          enum:
            - PENDING
            - IN_PROGRESS
            - COMPLETED
            - WAIVED
        completedById:
          type: string
          nullable: true
        completedBy:
          allOf:
            - $ref: '#/components/schemas/def-0'
          nullable: true
        completedAt:
          type: string
          nullable: true
          format: date-time
        waivedById:
          type: string
          nullable: true
        waivedBy:
          allOf:
            - $ref: '#/components/schemas/def-0'
          nullable: true
        waivedAt:
          type: string
          nullable: true
          format: date-time
        waiverReason:
          type: string
          nullable: true
        revision:
          type: integer
          minimum: 1
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
      title: AlertChecklistItem
    def-0:
      type: object
      additionalProperties: false
      required:
        - id
      properties:
        id:
          type: string
        firstName:
          type: string
          nullable: true
        lastName:
          type: string
          nullable: true
        image:
          type: string
          nullable: true
      title: AlertChecklistUser
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: 'API key authentication. Use format: Bearer cbr_live_your_key'
    apiKey:
      type: apiKey
      in: header
      name: X-Api-Key
      description: 'Alternative: API key in X-Api-Key header'

````