Skip to main content
POST
/
cases
/
bulk-close
Bulk close cases
curl --request POST \
  --url https://api.wirespeed.co/cases/bulk-close \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "verdict": "MALICIOUS",
  "caseIds": [
    "<string>"
  ],
  "filter": {
    "filter": "<string>",
    "search": "<string>",
    "statuses": [
      "NEW"
    ],
    "verdict": "MALICIOUS",
    "severity": "INFORMATIONAL",
    "onlyWasEscalated": true,
    "onlyWasContained": true,
    "onlyWasMobile": true,
    "onlyChatOps": true,
    "integrationPlatform": "aws",
    "categoryClass": "ENDPOINT",
    "category": "OTHER__DIAGNOSTIC",
    "createdAt": {
      "gt": "<string>",
      "gte": "<string>",
      "lt": "<string>",
      "lte": "<string>"
    }
  },
  "excludedCaseIds": [
    "<string>"
  ]
}
'
{
  "jobId": "<string>",
  "totalCount": 123
}

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
verdict
enum<string>
required

Verdict to apply to all cases

Available options:
MALICIOUS,
SUSPICIOUS,
BENIGN
caseIds
string[]

Explicit list of case IDs to close

filter
object

Filter to match cases (alternative to caseIds)

excludedCaseIds
string[]

Case IDs to exclude when using filter mode

Response

jobId
string
required

Bulk job ID for polling

totalCount
number
required

Total number of cases to close