cURL
curl -X POST "https://app.cotool.ai/api/alerts/:alertId/status" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d 'null'import requests
url = "https://app.cotool.ai/api/alerts/{alertId}/status"
payload = {
"reason": "<string>",
"commentBodyMarkdown": "<string>",
"duplicateOfAlertId": "<string>",
"confirmedAlternativeExplanationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
reason: '<string>',
commentBodyMarkdown: '<string>',
duplicateOfAlertId: '<string>',
confirmedAlternativeExplanationId: '3c90c3cc-0d44-4b50-8888-8dd25736052a'
})
};
fetch('https://app.cotool.ai/api/alerts/{alertId}/status', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.post("https://app.cotool.ai/api/alerts/{alertId}/status")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"reason\": \"<string>\",\n \"commentBodyMarkdown\": \"<string>\",\n \"duplicateOfAlertId\": \"<string>\",\n \"confirmedAlternativeExplanationId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
.asString();package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/alerts/{alertId}/status"
payload := strings.NewReader("{\n \"reason\": \"<string>\",\n \"commentBodyMarkdown\": \"<string>\",\n \"duplicateOfAlertId\": \"<string>\",\n \"confirmedAlternativeExplanationId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"alert": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationName": "<string>",
"title": "<string>",
"description": "<string>",
"severity": "low",
"status": "open",
"duplicateCount": 1,
"source": {
"category": "detection",
"name": "cotool_detection",
"triggerType": "jira"
},
"detection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"kind": "cotool",
"codeDetectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"origin": "user"
},
"createdBy": "agent",
"originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"codeDetectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originCodeDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"externalProvider": "jira",
"externalRef": "<string>",
"externalUrl": "<string>",
"assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dedupeKey": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"firstTriagedAt": "<string>",
"resolvedAt": "<string>",
"duplicateOfAlertId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"entry": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"alertId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "<string>",
"actorType": "human",
"actorUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorUserName": "<string>",
"actorUserImageUrl": "<string>",
"kind": "created",
"bodyMarkdown": "<string>",
"beforeStatus": "open",
"afterStatus": "open",
"metadata": {
"source": {
"category": "detection",
"name": "cotool_detection",
"triggerType": "jira"
},
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"sourcePayloadId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"notifications": [
{
"destinationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destinationType": "webhook",
"destinationName": "<string>",
"label": "<string>",
"url": "<string>",
"externalId": "<string>",
"sentAt": "2023-11-07T05:31:56Z",
"threadTs": "<string>",
"routeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"routeName": "<string>"
}
]
},
"actorAgentName": "<string>"
},
"statusChanged": true,
"commentEntry": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"alertId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "<string>",
"actorType": "human",
"actorUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorUserName": "<string>",
"actorUserImageUrl": "<string>",
"kind": "created",
"bodyMarkdown": "<string>",
"beforeStatus": "open",
"afterStatus": "open",
"metadata": {
"source": {
"category": "detection",
"name": "cotool_detection",
"triggerType": "jira"
},
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"sourcePayloadId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"notifications": [
{
"destinationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destinationType": "webhook",
"destinationName": "<string>",
"label": "<string>",
"url": "<string>",
"externalId": "<string>",
"sentAt": "2023-11-07T05:31:56Z",
"threadTs": "<string>",
"routeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"routeName": "<string>"
}
]
},
"actorAgentName": "<string>"
},
"commentAdded": true
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>",
"code": "CODE_DETECTION_HIT_OPEN_CONFLICT"
}{
"error": "<string>"
}Alerts
Update alert status
Update an alert lifecycle status and append a status-change timeline entry when the status changes. Optional feedback is appended as a comment in the same transaction. Duplicate status requires a canonical alert target.
POST
/
api
/
alerts
/
{alertId}
/
status
cURL
curl -X POST "https://app.cotool.ai/api/alerts/:alertId/status" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d 'null'import requests
url = "https://app.cotool.ai/api/alerts/{alertId}/status"
payload = {
"reason": "<string>",
"commentBodyMarkdown": "<string>",
"duplicateOfAlertId": "<string>",
"confirmedAlternativeExplanationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
reason: '<string>',
commentBodyMarkdown: '<string>',
duplicateOfAlertId: '<string>',
confirmedAlternativeExplanationId: '3c90c3cc-0d44-4b50-8888-8dd25736052a'
})
};
fetch('https://app.cotool.ai/api/alerts/{alertId}/status', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.post("https://app.cotool.ai/api/alerts/{alertId}/status")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"reason\": \"<string>\",\n \"commentBodyMarkdown\": \"<string>\",\n \"duplicateOfAlertId\": \"<string>\",\n \"confirmedAlternativeExplanationId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
.asString();package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/alerts/{alertId}/status"
payload := strings.NewReader("{\n \"reason\": \"<string>\",\n \"commentBodyMarkdown\": \"<string>\",\n \"duplicateOfAlertId\": \"<string>\",\n \"confirmedAlternativeExplanationId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"alert": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"displayId": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationName": "<string>",
"title": "<string>",
"description": "<string>",
"severity": "low",
"status": "open",
"duplicateCount": 1,
"source": {
"category": "detection",
"name": "cotool_detection",
"triggerType": "jira"
},
"detection": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ruleId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"kind": "cotool",
"codeDetectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"origin": "user"
},
"createdBy": "agent",
"originAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"codeDetectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originCodeDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"externalProvider": "jira",
"externalRef": "<string>",
"externalUrl": "<string>",
"assignedAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triageRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"dedupeKey": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"firstTriagedAt": "<string>",
"resolvedAt": "<string>",
"duplicateOfAlertId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"entry": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"alertId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "<string>",
"actorType": "human",
"actorUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorUserName": "<string>",
"actorUserImageUrl": "<string>",
"kind": "created",
"bodyMarkdown": "<string>",
"beforeStatus": "open",
"afterStatus": "open",
"metadata": {
"source": {
"category": "detection",
"name": "cotool_detection",
"triggerType": "jira"
},
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"sourcePayloadId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"notifications": [
{
"destinationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destinationType": "webhook",
"destinationName": "<string>",
"label": "<string>",
"url": "<string>",
"externalId": "<string>",
"sentAt": "2023-11-07T05:31:56Z",
"threadTs": "<string>",
"routeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"routeName": "<string>"
}
]
},
"actorAgentName": "<string>"
},
"statusChanged": true,
"commentEntry": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"alertId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "<string>",
"actorType": "human",
"actorUserId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorAgentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorRunId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"actorUserName": "<string>",
"actorUserImageUrl": "<string>",
"kind": "created",
"bodyMarkdown": "<string>",
"beforeStatus": "open",
"afterStatus": "open",
"metadata": {
"source": {
"category": "detection",
"name": "cotool_detection",
"triggerType": "jira"
},
"originDetectionHitId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"originTriggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"sourcePayloadId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"notifications": [
{
"destinationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destinationType": "webhook",
"destinationName": "<string>",
"label": "<string>",
"url": "<string>",
"externalId": "<string>",
"sentAt": "2023-11-07T05:31:56Z",
"threadTs": "<string>",
"routeId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"routeName": "<string>"
}
]
},
"actorAgentName": "<string>"
},
"commentAdded": true
}{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>",
"code": "CODE_DETECTION_HIT_OPEN_CONFLICT"
}{
"error": "<string>"
}Authorizations
API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here
Path Parameters
Alert UUID or human-readable display ID
Body
application/json
New alert lifecycle status. expired is set only by the alert inactivity job and is rejected here.
Available options:
open, in_progress, escalated, closed_true_positive, closed_false_positive, closed_true_positive_benign, dismissed, duplicate Optional reason for the status change
Required string length:
1 - 2000Optional human feedback appended to the alert timeline as a comment
Required string length:
1 - 20000Required canonical alert identifier when marking an alert as duplicate. A target that is itself a duplicate resolves to its canonical alert, and any duplicates of the alert being marked move to that canonical alert.
Alternative explanation from the latest escalation that this close confirms. Only valid with closed_false_positive or closed_true_positive_benign; the explanation is recorded on the status change and, when no reason is given, becomes the reason.
Response
Successful response
Show child attributes
Show child attributes
Timeline entry created for a status transition, or null when the requested status was already set
- Option 1
- Option 2
- Option 3
- Option 4
- Option 5
- Option 6
- Option 7
- Option 8
- Option 9
- Option 10
- Option 11
Show child attributes
Show child attributes
Whether the alert status changed and a timeline entry was recorded
Optional feedback comment appended with the status transition
- Option 1
- Option 2
- Option 3
- Option 4
- Option 5
- Option 6
- Option 7
- Option 8
- Option 9
- Option 10
- Option 11
Show child attributes
Show child attributes
Whether optional feedback was appended as a comment with the status transition
Was this page helpful?
⌘I