Update team information

curl --request PATCH \
  --url https://api.wirespeed.co/v1/team \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "supportEmail": "<string>",
  "address": "<string>",
  "platformName": "<string>",
  "useChatOpsOnboardingGroup": true,
  "managerChatOps": true,
  "escalationEmails": [
    "<string>"
  ],
  "escalationSubjectLine": "<string>",
  "testMode": true,
  "refreshable": true,
  "chatOpsAccountLockedMessage": "<string>",
  "identityAutoContainment": true,
  "endpointAutoContainment": true,
  "fileAutoContainment": true,
  "chatOpsWelcomeMessage": "<string>",
  "chatOpsSecondFactor": true,
  "maxChatOpsPerDay": 123,
  "maxAutoContainmentsPerDay": 123,
  "chatOpsEscalationDelayMinutes": 123,
  "disableMaxChatOps": true,
  "emailSignature": "<string>",
  "chatOpsSubjectLine": "<string>",
  "richCaseNotifications": true,
  "operatingTeam": true,
  "skuStartDate": "<string>",
  "skuEndDate": "<string>",
  "isTrial": true,
  "skipThirdPartyManagedSourceUpdates": true
}
'

{
  "id": "<string>",
  "name": "<string>",
  "demo": true,
  "refreshable": true,
  "testMode": true,
  "chatOpsEscalationDelayMinutes": 123,
  "monitorHours": 123,
  "identityAutoContainment": true,
  "endpointAutoContainment": true,
  "fileAutoContainment": true,
  "escalationEmails": [
    "<string>"
  ],
  "escalationSubscriptionEmails": [
    "<string>"
  ],
  "logoUrl": "<string>",
  "chatOpsSecondFactor": true,
  "chatOpsAccountLockedMessage": "<string>",
  "createdAt": "<string>",
  "richCaseNotifications": true,
  "managerChatOps": true,
  "emailSignature": "<string>",
  "chatOpsSubjectLine": "<string>",
  "autoSubscribeServiceProviderUsers": true,
  "addOns": [
    "data"
  ],
  "isTrial": true,
  "skipThirdPartyManagedSourceUpdates": true,
  "onboardingChecklistCompleted": true,
  "chatOpsWelcomeMessage": "<string>",
  "platformName": "<string>",
  "maxChatOpsPerDay": 123,
  "maxAutoContainmentsPerDay": 123,
  "escalationSubjectLine": "<string>",
  "chatOpsWelcomeMessageInherited": true,
  "emailSignatureInherited": true,
  "chatOpsSubjectLineInherited": true,
  "chatOpsAccountLockedMessageInherited": true,
  "serviceProvider": true,
  "parentTeamName": "<string>",
  "parentTeamId": "<string>",
  "parentServiceProvider": true,
  "operatingTeam": true,
  "useChatOpsOnboardingGroup": true,
  "chatOpsAllowBulkSmsInvite": true,
  "billableUsers": 123,
  "billableEndpoints": 123,
  "teamMembers": 123,
  "supportEmail": "<string>",
  "address": "<string>",
  "skuStartDate": "<string>",
  "skuEndDate": "<string>",
  "billingUserLicenseId": "<string>",
  "billingEndpointLicenseId": "<string>"
}

PATCH

team

curl --request PATCH \
  --url https://api.wirespeed.co/v1/team \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "supportEmail": "<string>",
  "address": "<string>",
  "platformName": "<string>",
  "useChatOpsOnboardingGroup": true,
  "managerChatOps": true,
  "escalationEmails": [
    "<string>"
  ],
  "escalationSubjectLine": "<string>",
  "testMode": true,
  "refreshable": true,
  "chatOpsAccountLockedMessage": "<string>",
  "identityAutoContainment": true,
  "endpointAutoContainment": true,
  "fileAutoContainment": true,
  "chatOpsWelcomeMessage": "<string>",
  "chatOpsSecondFactor": true,
  "maxChatOpsPerDay": 123,
  "maxAutoContainmentsPerDay": 123,
  "chatOpsEscalationDelayMinutes": 123,
  "disableMaxChatOps": true,
  "emailSignature": "<string>",
  "chatOpsSubjectLine": "<string>",
  "richCaseNotifications": true,
  "operatingTeam": true,
  "skuStartDate": "<string>",
  "skuEndDate": "<string>",
  "isTrial": true,
  "skipThirdPartyManagedSourceUpdates": true
}
'

{
  "id": "<string>",
  "name": "<string>",
  "demo": true,
  "refreshable": true,
  "testMode": true,
  "chatOpsEscalationDelayMinutes": 123,
  "monitorHours": 123,
  "identityAutoContainment": true,
  "endpointAutoContainment": true,
  "fileAutoContainment": true,
  "escalationEmails": [
    "<string>"
  ],
  "escalationSubscriptionEmails": [
    "<string>"
  ],
  "logoUrl": "<string>",
  "chatOpsSecondFactor": true,
  "chatOpsAccountLockedMessage": "<string>",
  "createdAt": "<string>",
  "richCaseNotifications": true,
  "managerChatOps": true,
  "emailSignature": "<string>",
  "chatOpsSubjectLine": "<string>",
  "autoSubscribeServiceProviderUsers": true,
  "addOns": [
    "data"
  ],
  "isTrial": true,
  "skipThirdPartyManagedSourceUpdates": true,
  "onboardingChecklistCompleted": true,
  "chatOpsWelcomeMessage": "<string>",
  "platformName": "<string>",
  "maxChatOpsPerDay": 123,
  "maxAutoContainmentsPerDay": 123,
  "escalationSubjectLine": "<string>",
  "chatOpsWelcomeMessageInherited": true,
  "emailSignatureInherited": true,
  "chatOpsSubjectLineInherited": true,
  "chatOpsAccountLockedMessageInherited": true,
  "serviceProvider": true,
  "parentTeamName": "<string>",
  "parentTeamId": "<string>",
  "parentServiceProvider": true,
  "operatingTeam": true,
  "useChatOpsOnboardingGroup": true,
  "chatOpsAllowBulkSmsInvite": true,
  "billableUsers": 123,
  "billableEndpoints": 123,
  "teamMembers": 123,
  "supportEmail": "<string>",
  "address": "<string>",
  "skuStartDate": "<string>",
  "skuEndDate": "<string>",
  "billingUserLicenseId": "<string>",
  "billingEndpointLicenseId": "<string>"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

name

string

Updated name for the team (1-512 characters)

supportEmail

string | null

Support email for service provider customers to use

address

string | null

Address for the team, typically used in email footers

platformName

string | null

Platform name to use for service provider clients

useChatOpsOnboardingGroup

boolean

Whether to use the ChatOps onboarding group

managerChatOps

boolean

Whether to enable manager ChatOps

escalationEmails

string[]

deprecated

Deprecated — values sent here are silently ignored. Use PUT /notification/subscription/team-channel to manage escalation inboxes.

escalationSubjectLine

string | null

deprecated

Deprecated — values sent here are still written to the legacy column AND mirrored onto the team's notification_subscription escalation rows (which the send path reads). Teams without escalation recipients cannot store an override and fall back to the per-type default. Prefer managing escalation settings via notification_subscription.

testMode

boolean

Whether to enable test mode

refreshable

boolean

Whether this demo team should be automatically deleted and recreated weekly

chatOpsAccountLockedMessage

string

Message to display when ChatOps account is locked (max 25,000 characters)

identityAutoContainment

boolean

Whether to enable automatic identity containment

endpointAutoContainment

boolean

Whether to enable automatic endpoint containment

fileAutoContainment

boolean

Whether to enable automatic file containment

chatOpsWelcomeMessage

string | null

Welcome message for ChatOps workflows (max 25,000 characters)

chatOpsSecondFactor

boolean

Whether ChatOps requires second factor authentication

maxChatOpsPerDay

number

Maximum ChatOps operations allowed per day (minimum 0)

maxAutoContainmentsPerDay

number | null

Maximum automatic containments allowed per day (minimum 0)

chatOpsEscalationDelayMinutes

number

Delay in minutes before escalating ChatOps failures (1-60 minutes)

disableMaxChatOps

boolean

Whether to disable the maximum ChatOps limit

emailSignature

string | null

Signature for ChatOps communications (max 1,200 characters)

chatOpsSubjectLine

string

Subject line for ChatOps communications (max 1,200 characters)

richCaseNotifications

boolean

deprecated

Deprecated — values sent here are still written to the legacy column AND mirrored onto the team's notification_subscription escalation rows (which the send path reads). Teams without escalation recipients fall back to rich-formatting on by default. Prefer managing escalation settings via notification_subscription.

operatingTeam

boolean

When managed by a service provider, denotes the team that is used for internal operations across their clients

sku

enum<string>

Subscription SKU tier for the team

Available options:

identity,

adr

skuStartDate

string

Contract/subscription start date (ISO string)

skuEndDate

string

Contract/subscription end date (ISO string)

isTrial

boolean

Whether this team is a proof-of-value trial

skipThirdPartyManagedSourceUpdates

boolean

When true, source system updates are skipped for detections managed by a third party (e.g. Falcon Complete)

Response

string

required

Unique identifier for the team

name

string

required

Name of the team

demo

boolean

required

Whether this is a demo team

refreshable

boolean

required

Whether this demo team is automatically deleted and recreated weekly

testMode

boolean

required

Whether the team is in test mode

chatOpsEscalationDelayMinutes

number

required

Delay in minutes before escalating ChatOps failures

monitorHours

number

required

How long monitors run for this team, in hours

identityAutoContainment

boolean

required

Whether automatic identity containment is enabled

endpointAutoContainment

boolean

required

Whether automatic endpoint containment is enabled

fileAutoContainment

boolean

required

Whether automatic file containment is enabled

escalationEmails

string[]

required

deprecated

Deprecated — escalation emails are now stored in notification_subscription. Use GET /notification/subscription/team-channel?type=NEW_CASE_ESCALATION instead.

escalationSubscriptionEmails

string[]

required

Lists new case escalation subscription emails for this team: the team's own emails plus any emails inherited from the parent Service Provider.

logoUrl

string

required

URL of the team logo

chatOpsSecondFactor

boolean

required

Whether ChatOps requires second factor authentication

chatOpsAccountLockedMessage

string

required

Message to display when ChatOps account is locked

createdAt

string

required

Timestamp when the team was created

richCaseNotifications

boolean

required

deprecated

Deprecated — escalation rich-formatting is now stored per recipient in notification_subscription.

managerChatOps

boolean

required

Whether manager ChatOps is enabled

emailSignature

string

required

Signature for ChatOps communications

chatOpsSubjectLine

string

required

Subject line for ChatOps communications

Whether to auto-subscribe service provider users to notifications for this team

sku

enum<string>

required

Subscription SKU tier for the team

Available options:

identity,

adr

addOns

enum<string>[]

required

Active add-on SKUs for the team

Available options:

data

isTrial

boolean

required

Whether this team is a proof-of-value trial

skipThirdPartyManagedSourceUpdates

boolean

required

Whether to skip source system updates for detections managed by a third party (e.g. Falcon Complete)

onboardingChecklistCompleted

boolean

required

Whether the team has completed the onboarding checklist

chatOpsWelcomeMessage

string

Welcome message for ChatOps workflows

platformName

string

Platform name to use for service provider clients

maxChatOpsPerDay

number

Maximum ChatOps operations allowed per day

maxAutoContainmentsPerDay

number

Maximum automatic containments allowed per day

escalationSubjectLine

string

deprecated

Deprecated — the escalation subject is now stored per recipient in notification_subscription (null → scope-aware per-type default).

chatOpsWelcomeMessageInherited

boolean

emailSignatureInherited

boolean

chatOpsSubjectLineInherited

boolean

chatOpsAccountLockedMessageInherited

boolean

serviceProvider

boolean

Whether this team is a service provider

parentTeamName

string

Name of the parent team if this is a sub-team

parentTeamId

string

ID of the parent team if this is a sub-team

parentServiceProvider

boolean

Whether the parent team is a service provider (null when no parent)

operatingTeam

boolean

Whether this is an operating team for service providers

useChatOpsOnboardingGroup

boolean

Whether to use the ChatOps onboarding group

chatOpsAllowBulkSmsInvite

boolean

Whether to allow bulk SMS invites without limit checks

billableUsers

number

The number of billable users for the team

billableEndpoints

number

The number of billable endpoints for the team

teamMembers

number

The number of team members where the team is their parent team (excluding external members)

supportEmail

string

Support email for service provider customers to use

address

string

Address for the team, typically used in email footers

skuStartDate

string

Contract/subscription start date

skuEndDate

string

Contract/subscription end date

billingUserLicenseId

string | null

License ID used for billing user counts (null = derived counting)

billingEndpointLicenseId

string | null

License ID used for billing endpoint counts (null = derived counting)

Delete the current team and all associated data Queue cross-integration canonical_id reconciliation (Wirespeed internal only)