Skip to main content
POST
/
api
/
alerts
/
{alertId}
/
status
cURL
curl -X POST "https://app.cotool.ai/api/alerts/:alertId/status" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status":"open","reason":"string"}'
{
  "alert": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "displayId": "<string>",
    "organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "organizationName": "<string>",
    "title": "<string>",
    "description": "<string>",
    "source": {},
    "detection": {
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "name": "<string>"
    },
    "originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "externalRef": "<string>",
    "externalUrl": "<string>",
    "assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "dedupeKey": "<string>",
    "createdAt": "<string>",
    "updatedAt": "<string>",
    "firstTriagedAt": "<string>",
    "resolvedAt": "<string>"
  },
  "entry": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "alertId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "createdAt": "<string>",
    "actorUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "actorAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "actorRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "actorUserName": "<string>",
    "actorUserImageUrl": "<string>",
    "kind": "<string>",
    "bodyMarkdown": "<string>",
    "metadata": {
      "source": {},
      "originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "sourcePayloadId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
    },
    "actorAgentName": "<string>"
  },
  "statusChanged": true
}

Authorizations

​
Authorization
string
header
required

API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here

Path Parameters

​
alertId
string
required

Alert UUID or human-readable display ID

Body

application/json
​
status
enum<string>
required

New alert lifecycle status

Available options:
open,
in_progress,
escalated,
closed_true_positive,
closed_false_positive,
closed_true_positive_benign
​
reason
string

Optional reason for the status change

Required string length: 1 - 2000

Response

Successful response

​
alert
object
required
​
entry
object
required

Timeline entry created for a status transition, or null when the requested status was already set

​
statusChanged
boolean
required

Whether the alert status changed and a timeline entry was recorded