Skip to main content
POST
Uncontain directory

Authorizations

Authorization
string
header
required

Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.

Path Parameters

id
string
required

Directory identifier

Body

application/json
clientRequestId
string

Stable client request id for idempotent retries of the same manual containment

caseId
string

Case ID for containment context

detectionId
string

Detection ID for containment context

integrationId
string

Ignored. Identify the asset in the request; the server binds the executing integration from that asset. For files, binding uses detection or case context. This field does not select a provider.

userContainActions
enum<string>[]

User containment actions to perform

Available options:
disable,
reset_mfa,
reset_password,
revoke_sessions
endpointContainActions
enum<string>[]

Endpoint containment actions to perform

Available options:
isolate,
lock
userUncontainActions
enum<string>[]

User uncontainment actions to perform

Available options:
enable
endpointUncontainActions
enum<string>[]

Endpoint uncontainment actions to perform

Available options:
unisolate,
unlock
fileContainActions
enum<string>[]

File containment actions to perform

Available options:
delete,
quarantine
fileUncontainActions
enum<string>[]

File uncontainment actions to perform

Available options:
unquarantine

Response

operationId
string<uuid>
required
immediateDispatchDeferred
boolean

True when the operation was accepted but immediate dispatch enqueue did not run on this process.

operationIds
string<uuid>[]

All accepted operation ids when the request fans out to multiple detections