curl --request POST \
--url https://api.wirespeed.co/v1/asset/bulk/contain \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"caseId": "<string>",
"detectionId": "<string>",
"integrationId": "<string>",
"userContainActions": [],
"endpointContainActions": [],
"userUncontainActions": [
"enable"
],
"endpointUncontainActions": [],
"fileContainActions": [],
"fileUncontainActions": [
"unquarantine"
],
"endpointIds": [
"<string>"
],
"directoryIds": [
"<string>"
],
"fileIds": [
"<string>"
]
}
'import requests
url = "https://api.wirespeed.co/v1/asset/bulk/contain"
payload = {
"caseId": "<string>",
"detectionId": "<string>",
"integrationId": "<string>",
"userContainActions": [],
"endpointContainActions": [],
"userUncontainActions": ["enable"],
"endpointUncontainActions": [],
"fileContainActions": [],
"fileUncontainActions": ["unquarantine"],
"endpointIds": ["<string>"],
"directoryIds": ["<string>"],
"fileIds": ["<string>"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
caseId: '<string>',
detectionId: '<string>',
integrationId: '<string>',
userContainActions: [],
endpointContainActions: [],
userUncontainActions: ['enable'],
endpointUncontainActions: [],
fileContainActions: [],
fileUncontainActions: ['unquarantine'],
endpointIds: ['<string>'],
directoryIds: ['<string>'],
fileIds: ['<string>']
})
};
fetch('https://api.wirespeed.co/v1/asset/bulk/contain', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/asset/bulk/contain",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'caseId' => '<string>',
'detectionId' => '<string>',
'integrationId' => '<string>',
'userContainActions' => [
],
'endpointContainActions' => [
],
'userUncontainActions' => [
'enable'
],
'endpointUncontainActions' => [
],
'fileContainActions' => [
],
'fileUncontainActions' => [
'unquarantine'
],
'endpointIds' => [
'<string>'
],
'directoryIds' => [
'<string>'
],
'fileIds' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/asset/bulk/contain"
payload := strings.NewReader("{\n \"caseId\": \"<string>\",\n \"detectionId\": \"<string>\",\n \"integrationId\": \"<string>\",\n \"userContainActions\": [],\n \"endpointContainActions\": [],\n \"userUncontainActions\": [\n \"enable\"\n ],\n \"endpointUncontainActions\": [],\n \"fileContainActions\": [],\n \"fileUncontainActions\": [\n \"unquarantine\"\n ],\n \"endpointIds\": [\n \"<string>\"\n ],\n \"directoryIds\": [\n \"<string>\"\n ],\n \"fileIds\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.wirespeed.co/v1/asset/bulk/contain")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"caseId\": \"<string>\",\n \"detectionId\": \"<string>\",\n \"integrationId\": \"<string>\",\n \"userContainActions\": [],\n \"endpointContainActions\": [],\n \"userUncontainActions\": [\n \"enable\"\n ],\n \"endpointUncontainActions\": [],\n \"fileContainActions\": [],\n \"fileUncontainActions\": [\n \"unquarantine\"\n ],\n \"endpointIds\": [\n \"<string>\"\n ],\n \"directoryIds\": [\n \"<string>\"\n ],\n \"fileIds\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/asset/bulk/contain")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"caseId\": \"<string>\",\n \"detectionId\": \"<string>\",\n \"integrationId\": \"<string>\",\n \"userContainActions\": [],\n \"endpointContainActions\": [],\n \"userUncontainActions\": [\n \"enable\"\n ],\n \"endpointUncontainActions\": [],\n \"fileContainActions\": [],\n \"fileUncontainActions\": [\n \"unquarantine\"\n ],\n \"endpointIds\": [\n \"<string>\"\n ],\n \"directoryIds\": [\n \"<string>\"\n ],\n \"fileIds\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"operationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"immediateDispatchDeferred": true,
"operationIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
]
}{
"message": "<string>",
"statusCode": 123
}Bulk contain multiple assets
Accepts remediation for each selected asset and returns the accepted operation ids to poll until provider remediation completes.
curl --request POST \
--url https://api.wirespeed.co/v1/asset/bulk/contain \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"caseId": "<string>",
"detectionId": "<string>",
"integrationId": "<string>",
"userContainActions": [],
"endpointContainActions": [],
"userUncontainActions": [
"enable"
],
"endpointUncontainActions": [],
"fileContainActions": [],
"fileUncontainActions": [
"unquarantine"
],
"endpointIds": [
"<string>"
],
"directoryIds": [
"<string>"
],
"fileIds": [
"<string>"
]
}
'import requests
url = "https://api.wirespeed.co/v1/asset/bulk/contain"
payload = {
"caseId": "<string>",
"detectionId": "<string>",
"integrationId": "<string>",
"userContainActions": [],
"endpointContainActions": [],
"userUncontainActions": ["enable"],
"endpointUncontainActions": [],
"fileContainActions": [],
"fileUncontainActions": ["unquarantine"],
"endpointIds": ["<string>"],
"directoryIds": ["<string>"],
"fileIds": ["<string>"]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
caseId: '<string>',
detectionId: '<string>',
integrationId: '<string>',
userContainActions: [],
endpointContainActions: [],
userUncontainActions: ['enable'],
endpointUncontainActions: [],
fileContainActions: [],
fileUncontainActions: ['unquarantine'],
endpointIds: ['<string>'],
directoryIds: ['<string>'],
fileIds: ['<string>']
})
};
fetch('https://api.wirespeed.co/v1/asset/bulk/contain', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.wirespeed.co/v1/asset/bulk/contain",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'caseId' => '<string>',
'detectionId' => '<string>',
'integrationId' => '<string>',
'userContainActions' => [
],
'endpointContainActions' => [
],
'userUncontainActions' => [
'enable'
],
'endpointUncontainActions' => [
],
'fileContainActions' => [
],
'fileUncontainActions' => [
'unquarantine'
],
'endpointIds' => [
'<string>'
],
'directoryIds' => [
'<string>'
],
'fileIds' => [
'<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.wirespeed.co/v1/asset/bulk/contain"
payload := strings.NewReader("{\n \"caseId\": \"<string>\",\n \"detectionId\": \"<string>\",\n \"integrationId\": \"<string>\",\n \"userContainActions\": [],\n \"endpointContainActions\": [],\n \"userUncontainActions\": [\n \"enable\"\n ],\n \"endpointUncontainActions\": [],\n \"fileContainActions\": [],\n \"fileUncontainActions\": [\n \"unquarantine\"\n ],\n \"endpointIds\": [\n \"<string>\"\n ],\n \"directoryIds\": [\n \"<string>\"\n ],\n \"fileIds\": [\n \"<string>\"\n ]\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.wirespeed.co/v1/asset/bulk/contain")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"caseId\": \"<string>\",\n \"detectionId\": \"<string>\",\n \"integrationId\": \"<string>\",\n \"userContainActions\": [],\n \"endpointContainActions\": [],\n \"userUncontainActions\": [\n \"enable\"\n ],\n \"endpointUncontainActions\": [],\n \"fileContainActions\": [],\n \"fileUncontainActions\": [\n \"unquarantine\"\n ],\n \"endpointIds\": [\n \"<string>\"\n ],\n \"directoryIds\": [\n \"<string>\"\n ],\n \"fileIds\": [\n \"<string>\"\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.wirespeed.co/v1/asset/bulk/contain")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"caseId\": \"<string>\",\n \"detectionId\": \"<string>\",\n \"integrationId\": \"<string>\",\n \"userContainActions\": [],\n \"endpointContainActions\": [],\n \"userUncontainActions\": [\n \"enable\"\n ],\n \"endpointUncontainActions\": [],\n \"fileContainActions\": [],\n \"fileUncontainActions\": [\n \"unquarantine\"\n ],\n \"endpointIds\": [\n \"<string>\"\n ],\n \"directoryIds\": [\n \"<string>\"\n ],\n \"fileIds\": [\n \"<string>\"\n ]\n}"
response = http.request(request)
puts response.read_body{
"operationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"immediateDispatchDeferred": true,
"operationIds": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
]
}{
"message": "<string>",
"statusCode": 123
}Authorizations
Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.
Body
Case ID for containment context
Detection ID for containment context
Ignored. Identify the asset in the request; the server binds the executing integration from that asset. For files, binding uses detection or case context. This field does not select a provider.
User containment actions to perform
disable, reset_mfa, reset_password, revoke_sessions Endpoint containment actions to perform
isolate, lock User uncontainment actions to perform
enable Endpoint uncontainment actions to perform
unisolate, unlock File containment actions to perform
delete, quarantine File uncontainment actions to perform
unquarantine Array of endpoint IDs to contain
500Array of directory user IDs to contain
500Array of file IDs to contain
500
