Skip to main content
POST
/
asset
/
bulk
/
contain
Bulk contain multiple assets
curl --request POST \
  --url https://api.wirespeed.co/asset/bulk/contain \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "caseId": "<string>",
  "detectionId": "<string>",
  "integrationId": "<string>",
  "userContainActions": [
    "disable"
  ],
  "endpointContainActions": [
    "isolate"
  ],
  "userUncontainActions": [
    "enable"
  ],
  "endpointUncontainActions": [
    "unisolate"
  ],
  "fileContainActions": [
    "delete"
  ],
  "fileUncontainActions": [
    "unquarantine"
  ],
  "endpointIds": [
    "<string>"
  ],
  "directoryIds": [
    "<string>"
  ],
  "fileIds": [
    "<string>"
  ]
}
'
{
  "message": "<string>",
  "statusCode": 123
}

Documentation Index

Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
​
caseId
string

Case ID for containment context

​
detectionId
string

Detection ID for containment context

​
integrationId
string

Integration ID to use for containment. Required for files; optional for endpoints/users (falls back to asset integration).

​
userContainActions
enum<string>[]

User containment actions to perform

Available options:
disable,
reset_password,
revoke_sessions
​
endpointContainActions
enum<string>[]

Endpoint containment actions to perform

Available options:
isolate,
lock
​
userUncontainActions
enum<string>[]

User uncontainment actions to perform

Available options:
enable
​
endpointUncontainActions
enum<string>[]

Endpoint uncontainment actions to perform

Available options:
unisolate
​
fileContainActions
enum<string>[]

File containment actions to perform

Available options:
delete,
quarantine
​
fileUncontainActions
enum<string>[]

File uncontainment actions to perform

Available options:
unquarantine
​
endpointIds
string[]

Array of endpoint IDs to contain

​
directoryIds
string[]

Array of directory user IDs to contain

​
fileIds
string[]

Array of file IDs to contain

Response