> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reconifyhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Reconify's API reference is read-only for customer data. Do not invent endpoints or authentication behavior beyond the OpenAPI contract.
> The public OpenAPI document contains only the external /v1 contract. Dashboard business routes are intentionally excluded.

# Investigate an issue

> Read evidence, assign an issue, and record the next action.

## Goal

Use the public API to move from an open finding to a documented investigation.

## Prerequisites

* A `read` or `admin` key for reads.
* A `write` or `admin` key for assignment and notes.
* An issue ID from `GET /v1/issues`.

## List open issues

```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -sS "https://api.reconifyhq.com/v1/issues?status=open&limit=20" \
  -H "Authorization: Bearer $RECONIFY_READ_KEY"
```

The public API supports `open`, `resolved`, and `resolved_late`. It does not support `acknowledged` or `investigating`.

## Inspect one issue

```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -sS "https://api.reconifyhq.com/v1/issues/$ISSUE_ID" \
  -H "Authorization: Bearer $RECONIFY_READ_KEY"
```

Read the category, message, opened time, resolved time, and current assignee.

## Read linked evidence

```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -sS "https://api.reconifyhq.com/v1/issues/$ISSUE_ID/events" \
  -H "Authorization: Bearer $RECONIFY_READ_KEY"
```

Compare event time, received time, type, amount, and reference. The received time helps you tell a late event from a missing event.

## Find an assignee

```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -sS "https://api.reconifyhq.com/v1/organization/members" \
  -H "Authorization: Bearer $RECONIFY_READ_KEY"
```

Use the returned member ID. The response does not include email addresses.

## Assign the issue

```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -sS -X PATCH "https://api.reconifyhq.com/v1/issues/$ISSUE_ID" \
  -H "Authorization: Bearer $RECONIFY_WRITE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"assigned_to":"00000000-0000-7000-8000-000000000002"}'
```

Send `{"assigned_to":null}` to remove the assignment. Assignment is a set-to-value operation, so you do not need an idempotency header.

## Add a note safely

```bash cURL theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -sS -X POST "https://api.reconifyhq.com/v1/issues/$ISSUE_ID/notes" \
  -H "Authorization: Bearer $RECONIFY_WRITE_KEY" \
  -H "Idempotency-Key: investigation-$ISSUE_ID-provider-late" \
  -H "Content-Type: application/json" \
  -d '{"body":"Provider evidence arrived after the expected deadline."}'
```

The header is optional. Use it when a client may retry after a timeout. The same key and request replay the original note. The same key with a different issue or body returns `409 idempotency_conflict`.

## Handle resolved-late findings

`resolved_late` means the expected evidence arrived after the deadline. Keep the issue in your audit workflow even though the evidence eventually arrived.

## Protect sensitive data

Do not log bearer tokens, full event payloads, note bodies, amounts, or customer identifiers. Store only the request ID and a redacted error when you need support.

See the [generated issue operations](/reference/api/welcome) for exact request and response fields.