Skip to main content
POST
cURL

Authorizations

Authorization
string
header
required

API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here

Path Parameters

alertId
string
required

Alert UUID or human-readable display ID

Body

application/json
status
enum<string>
required

New alert lifecycle status. expired is set only by the alert inactivity job and is rejected here.

Available options:
open,
in_progress,
escalated,
closed_true_positive,
closed_false_positive,
closed_true_positive_benign,
dismissed,
duplicate
reason
string

Optional reason for the status change

Required string length: 1 - 2000
commentBodyMarkdown
string

Optional human feedback appended to the alert timeline as a comment

Required string length: 1 - 20000
duplicateOfAlertId
string

Required canonical alert identifier when marking an alert as duplicate

Response

Successful response

alert
object
required
entry
object
required

Timeline entry created for a status transition, or null when the requested status was already set

statusChanged
boolean
required

Whether the alert status changed and a timeline entry was recorded

commentEntry
object

Optional feedback comment appended with the status transition

commentAdded
boolean

Whether optional feedback was appended as a comment with the status transition