Skip to main content
PATCH
Update team information

Authorizations

Authorization
string
header
required

Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.

Body

application/json
name
string

Updated name for the team (1-512 characters)

supportEmail
string | null

Support email for service provider customers to use

address
string | null

Address for the team, typically used in email footers

platformName
string | null

Platform name to use for service provider clients

useChatOpsOnboardingGroup
boolean

Whether to use the ChatOps onboarding group

escalationEmails
string[]
deprecated

Deprecated — values sent here are ignored. Use PUT /notification/subscription/team-channel to manage escalation inboxes. Removal scheduled for 2026-09-20.

escalationSubjectLine
string | null
deprecated

Deprecated — values sent here are ignored. Use PUT /notification/subscription/team-channel to manage escalation settings. Removal scheduled for 2026-09-20.

testMode
boolean

Whether to enable test mode

refreshable
boolean

Whether this demo team should be automatically deleted and recreated weekly

chatOpsAccountLockedMessage
string

Message to display when ChatOps account is locked (max 25,000 characters)

identityAutoContainment
boolean

Whether to enable automatic identity containment

endpointAutoContainment
boolean

Whether to enable automatic endpoint containment

fileAutoContainment
boolean

Whether to enable automatic file containment

chatOpsWelcomeMessage
string | null

Welcome message for ChatOps workflows (max 25,000 characters)

chatOpsSecondFactor
boolean

Whether ChatOps requires second factor authentication

chatOpsAutoExclusion
boolean

Whether benign ChatOps confirmations automatically create exclusions

maxChatOpsPerDay
number

Maximum ChatOps operations allowed per day (minimum 0)

maxAutoContainmentsPerDay
number | null

Maximum automatic containments allowed per day (minimum 0)

chatOpsEscalationDelayMinutes
number

Delay in minutes before escalating ChatOps failures (1-60 minutes)

disableMaxChatOps
boolean

Whether to disable the maximum ChatOps limit

emailSignature
string | null

Signature for ChatOps communications (max 1,200 characters)

chatOpsSubjectLine
string

Subject line for ChatOps communications (max 1,200 characters)

richCaseNotifications
boolean
deprecated

Deprecated — values sent here are ignored. Use PUT /notification/subscription/team-channel to manage escalation settings. Removal scheduled for 2026-09-20.

operatingTeam
boolean

When managed by a service provider, denotes the team that is used for internal operations across their clients

sku
enum<string>

Subscription SKU tier for the team

Available options:
identity,
adr
skuStartDate
string

Contract/subscription start date (ISO string)

skuEndDate
string

Contract/subscription end date (ISO string)

isTrial
boolean

Whether this team is a proof-of-value trial

skipThirdPartyManagedSourceUpdates
boolean

When true, source system updates are skipped for detections managed by a third party (e.g. Falcon Complete)

domain
string

Canonical customer DNS domain without a scheme or path

Example:

"example.com"

Response

id
string
required

Unique identifier for the team

name
string
required

Name of the team

enabled
boolean
required

Whether the team is operational

demo
boolean
required

Whether this is a demo team

refreshable
boolean
required

Whether this demo team is automatically deleted and recreated weekly

testMode
boolean
required

Whether the team is in test mode

chatOpsEscalationDelayMinutes
number
required

Delay in minutes before escalating ChatOps failures

monitorHours
number
required

How long monitors run for this team, in hours

identityAutoContainment
boolean
required

Whether automatic identity containment is enabled

endpointAutoContainment
boolean
required

Whether automatic endpoint containment is enabled

fileAutoContainment
boolean
required

Whether automatic file containment is enabled

escalationEmails
string[]
required
deprecated

Deprecated — escalation emails are now stored in notification_subscription. Use GET /notification/subscription/team-channel?type=NEW_CASE_ESCALATION instead. Removal scheduled for 2026-09-20.

escalationSubscriptionEmails
string[]
required

Lists new case escalation subscription emails for this team: the team's own emails plus any emails inherited from the parent Service Provider.

logoUrl
string
required

URL of the team logo

chatOpsSecondFactor
boolean
required

Whether ChatOps requires second factor authentication

chatOpsAutoExclusion
boolean
required

Whether benign ChatOps confirmations automatically create exclusions

chatOpsAccountLockedMessage
string
required

Message to display when ChatOps account is locked

createdAt
string
required

Timestamp when the team was created

richCaseNotifications
boolean
required
deprecated

Deprecated — escalation rich-formatting is now stored per recipient in notification_subscription. Removal scheduled for 2026-09-20.

emailSignature
string
required

Signature for ChatOps communications

chatOpsSubjectLine
string
required

Subject line for ChatOps communications

autoSubscribeServiceProviderUsers
boolean
default:true
required

Whether to auto-subscribe service provider users to notifications for this team

sku
enum<string>
required

Subscription SKU tier for the team

Available options:
identity,
adr
addOns
enum<string>[]
required

Active add-on SKUs for the team

Available options:
data
isTrial
boolean
required

Whether this team is a proof-of-value trial

skipThirdPartyManagedSourceUpdates
boolean
required

Whether to skip source system updates for detections managed by a third party (e.g. Falcon Complete)

onboardingChecklistCompleted
boolean
required

Whether the team has completed the onboarding checklist

onboardingChecklistDismissed
boolean
required

Whether the team has dismissed the onboarding checklist from the homepage

askForG2Review
boolean
required

Whether to prompt for a G2 review after a happy case close. Cleared when anyone on the team writes or dismisses the prompt.

remediationManualUiEnabled
boolean
required

Whether manual remediation preview/create UI is enabled for this environment

chatOpsWelcomeMessage
string

Welcome message for ChatOps workflows

platformName
string

Platform name to use for service provider clients

maxChatOpsPerDay
number

Maximum ChatOps operations allowed per day

maxAutoContainmentsPerDay
number

Maximum automatic containments allowed per day

escalationSubjectLine
string
deprecated

Deprecated — the escalation subject is now stored per recipient in notification_subscription (null → scope-aware per-type default). Removal scheduled for 2026-09-20.

chatOpsWelcomeMessageInherited
boolean
emailSignatureInherited
boolean
chatOpsSubjectLineInherited
boolean
chatOpsAccountLockedMessageInherited
boolean
domain
string | null

Canonical customer DNS domain used for branding and team identification

serviceProvider
boolean

Whether this team is a service provider

parentTeamName
string

Name of the parent team if this is a sub-team

parentTeamId
string

ID of the parent team if this is a sub-team

parentServiceProvider
boolean

Whether the parent team is a service provider (null when no parent)

operatingTeam
boolean

Whether this is an operating team for service providers

useChatOpsOnboardingGroup
boolean

Whether to use the ChatOps onboarding group

chatOpsAllowBulkSmsInvite
boolean

Whether to allow bulk SMS invites without limit checks

billableUsers
number

The number of billable users for the team

billableEndpoints
number

The number of billable endpoints for the team

dataStorageGb
number | null

Current stored data usage in decimal gigabytes

teamMembers
number

The number of team members where the team is their parent team (excluding external members)

supportEmail
string

Support email for service provider customers to use

address
string

Address for the team, typically used in email footers

skuStartDate
string

Contract/subscription start date

skuEndDate
string

Contract/subscription end date