Skip to main content
POST
Bulk contain multiple assets

Authorizations

Authorization
string
header
required

Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.

Body

application/json
caseId
string

Case ID for containment context

detectionId
string

Detection ID for containment context

integrationId
string

Ignored. Identify the asset in the request; the server binds the executing integration from that asset. For files, binding uses detection or case context. This field does not select a provider.

userContainActions
enum<string>[]

User containment actions to perform

Available options:
disable,
reset_mfa,
reset_password,
revoke_sessions
endpointContainActions
enum<string>[]

Endpoint containment actions to perform

Available options:
isolate,
lock
userUncontainActions
enum<string>[]

User uncontainment actions to perform

Available options:
enable
endpointUncontainActions
enum<string>[]

Endpoint uncontainment actions to perform

Available options:
unisolate,
unlock
fileContainActions
enum<string>[]

File containment actions to perform

Available options:
delete,
quarantine
fileUncontainActions
enum<string>[]

File uncontainment actions to perform

Available options:
unquarantine
endpointIds
string[]

Array of endpoint IDs to contain

Maximum array length: 500
directoryIds
string[]

Array of directory user IDs to contain

Maximum array length: 500
fileIds
string[]

Array of file IDs to contain

Maximum array length: 500

Response

operationId
string<uuid>
required
immediateDispatchDeferred
boolean

True when the operation was accepted but immediate dispatch enqueue did not run on this process.

operationIds
string<uuid>[]

All accepted operation ids when the request fans out to multiple detections