Skip to main content
PATCH
Update team information

Authorizations

Authorization
string
header
required

Team API key sent as a Bearer token. Create a key in Wirespeed under Settings → Team. See https://docs.wirespeed.co/api-reference/authentication.

Body

application/json
language
enum<string> | null

Default language for team members without their own choice, and for messages to people outside Wirespeed. Send null to clear it.

Available options:
en,
fr,
de
region
enum<string> | null

Default formatting region (ISO 3166-1 alpha-2) for team members without their own choice. Blocked and uninhabited countries are rejected. Send null to clear it.

Available options:
AD,
AE,
AF,
AG,
AI,
AL,
AM,
AO,
AQ,
AR,
AS,
AT,
AU,
AW,
AX,
AZ,
BA,
BB,
BD,
BE,
BF,
BG,
BH,
BI,
BJ,
BL,
BM,
BN,
BO,
BQ,
BR,
BS,
BT,
BV,
BW,
BY,
BZ,
CA,
CC,
CD,
CF,
CG,
CH,
CI,
CK,
CL,
CM,
CN,
CO,
CR,
CU,
CV,
CW,
CX,
CY,
CZ,
DE,
DJ,
DK,
DM,
DO,
DZ,
EC,
EE,
EG,
EH,
ER,
ES,
ET,
FI,
FJ,
FK,
FM,
FO,
FR,
GA,
GB,
GD,
GE,
GF,
GG,
GH,
GI,
GL,
GM,
GN,
GP,
GQ,
GR,
GS,
GT,
GU,
GW,
GY,
HK,
HM,
HN,
HR,
HT,
HU,
ID,
IE,
IL,
IM,
IN,
IO,
IQ,
IR,
IS,
IT,
JE,
JM,
JO,
JP,
KE,
KG,
KH,
KI,
KM,
KN,
KP,
KR,
KW,
KY,
KZ,
LA,
LB,
LC,
LI,
LK,
LR,
LS,
LT,
LU,
LV,
LY,
MA,
MC,
MD,
ME,
MF,
MG,
MH,
MK,
ML,
MM,
MN,
MO,
MP,
MQ,
MR,
MS,
MT,
MU,
MV,
MW,
MX,
MY,
MZ,
NA,
NC,
NE,
NF,
NG,
NI,
NL,
NO,
NP,
NR,
NU,
NZ,
OM,
PA,
PE,
PF,
PG,
PH,
PK,
PL,
PM,
PN,
PR,
PS,
PT,
PW,
PY,
QA,
RE,
RO,
RS,
RU,
RW,
SA,
SB,
SC,
SD,
SE,
SG,
SH,
SI,
SJ,
SK,
SL,
SM,
SN,
SO,
SR,
SS,
ST,
SV,
SX,
SY,
SZ,
TC,
TD,
TF,
TG,
TH,
TJ,
TK,
TL,
TM,
TN,
TO,
TR,
TT,
TV,
TW,
TZ,
UA,
UG,
UM,
US,
UY,
UZ,
VA,
VC,
VE,
VG,
VI,
VN,
VU,
WF,
WS,
YE,
YT,
ZA,
ZM,
ZW
name
string

Updated name for the team (1-512 characters)

supportEmail
string | null

Support email for service provider customers to use

address
string | null

Address for the team, typically used in email footers

platformName
string | null

Platform name to use for service provider clients

useChatOpsOnboardingGroup
boolean

Whether to use the ChatOps onboarding group

escalationEmails
string[]
deprecated

Deprecated — values sent here are ignored. Use PUT /notification/subscription/team-channel to manage escalation inboxes. Removal scheduled for 2026-09-20.

escalationSubjectLine
string | null
deprecated

Deprecated — values sent here are ignored. Use PUT /notification/subscription/team-channel to manage escalation settings. Removal scheduled for 2026-09-20.

testMode
boolean
deprecated

Deprecated — use chatOpsEnabled, remediationEnabled, and sourceSystemUpdatesEnabled. true turns all three off; false turns all three on. Explicit switch fields take precedence. Removal scheduled for 2027-01-06.

chatOpsEnabled
boolean

Master switch allowing Chat Ops to contact users to confirm activity

remediationEnabled
boolean

Master switch allowing Wirespeed to automatically remediate threats

sourceSystemUpdatesEnabled
boolean

Master switch allowing Wirespeed to sync verdicts, statuses, and comments back to source integrations

refreshable
boolean

Whether this demo team should be automatically deleted and recreated weekly

chatOpsAccountLockedMessage
string

Message to display when ChatOps account is locked (max 25,000 characters)

identityAutoContainment
boolean

Whether to enable automatic identity containment

endpointAutoContainment
boolean

Whether to enable automatic endpoint containment

fileAutoContainment
boolean

Whether to enable automatic file containment

ephemeralAutoContainment
object

Automatic containment switches per ephemeral resource type. Only the types sent are changed.

fileAutoRelease
boolean

Whether to enable automatic benign file release

timezone
string | null

IANA time zone identifier, e.g. America/New_York. Null clears it so notifications fall back to UTC.

chatOpsWelcomeMessage
string | null

Welcome message for ChatOps workflows (max 25,000 characters)

chatOpsSecondFactor
boolean

Whether ChatOps requires second factor authentication

chatOpsAutoExclusion
boolean

Whether benign ChatOps confirmations automatically create exclusions

maxChatOpsPerDay
number

Maximum ChatOps operations allowed per day (minimum 0)

chatOpsEscalationDelayMinutes
number

Delay in minutes before escalating ChatOps failures (1-60 minutes)

disableMaxChatOps
boolean

Whether to disable the maximum ChatOps limit

emailSignature
string | null

Signature for ChatOps communications (max 1,200 characters)

chatOpsSubjectLine
string

Subject line for ChatOps communications (max 1,200 characters)

localizedCopy
object

French and German versions of the ChatOps subject line, welcome message, account locked message, and signature. Merged into the stored values: omitted fields are unchanged, and null resets a field to the default for that language. Requires the language settings to be available.

richCaseNotifications
boolean
deprecated

Deprecated — values sent here are ignored. Use PUT /notification/subscription/team-channel to manage escalation settings. Removal scheduled for 2026-09-20.

operatingTeam
boolean

When managed by a service provider, denotes the team that is used for internal operations across their clients

sku
enum<string>

Subscription SKU tier for the team

Available options:
identity,
adr
skuStartDate
string

Contract/subscription start date (ISO string)

skuEndDate
string

Contract/subscription end date (ISO string)

isTrial
boolean

Whether this team is a proof-of-value trial

skipThirdPartyManagedSourceUpdates
boolean

When true, source system updates are skipped for detections managed by a third party (e.g. Falcon Complete)

domain
string

Canonical customer DNS domain without a scheme or path

Example:

"example.com"

Response

id
string
required

Unique identifier for the team

name
string
required

Name of the team

enabled
boolean
required

Whether the team is operational

demo
boolean
required

Whether this is a demo team

refreshable
boolean
required

Whether this demo team is automatically deleted and recreated weekly

testMode
boolean
required
deprecated

Deprecated — true when chatOpsEnabled, remediationEnabled, and sourceSystemUpdatesEnabled are all false. Read those fields instead. Removal scheduled for 2027-01-06.

chatOpsEnabled
boolean
required

Master switch allowing Chat Ops to contact users to confirm activity

remediationEnabled
boolean
required

Master switch allowing Wirespeed to automatically remediate threats

sourceSystemUpdatesEnabled
boolean
required

Master switch allowing Wirespeed to sync verdicts, statuses, and comments back to source integrations

chatOpsEscalationDelayMinutes
number
required

Delay in minutes before escalating ChatOps failures

monitorHours
number
required

How long monitors run for this team, in hours

language
enum<string> | null
required

Default language for team members without their own choice, and for messages to people outside Wirespeed. Null means English.

Available options:
en,
fr,
de
region
enum<string> | null
required

Default formatting region (ISO 3166-1 alpha-2) for team members without their own choice, and for messages to people outside Wirespeed. Null means the language's default region.

Available options:
AD,
AE,
AF,
AG,
AI,
AL,
AM,
AO,
AQ,
AR,
AS,
AT,
AU,
AW,
AX,
AZ,
BA,
BB,
BD,
BE,
BF,
BG,
BH,
BI,
BJ,
BL,
BM,
BN,
BO,
BQ,
BR,
BS,
BT,
BV,
BW,
BY,
BZ,
CA,
CC,
CD,
CF,
CG,
CH,
CI,
CK,
CL,
CM,
CN,
CO,
CR,
CU,
CV,
CW,
CX,
CY,
CZ,
DE,
DJ,
DK,
DM,
DO,
DZ,
EC,
EE,
EG,
EH,
ER,
ES,
ET,
FI,
FJ,
FK,
FM,
FO,
FR,
GA,
GB,
GD,
GE,
GF,
GG,
GH,
GI,
GL,
GM,
GN,
GP,
GQ,
GR,
GS,
GT,
GU,
GW,
GY,
HK,
HM,
HN,
HR,
HT,
HU,
ID,
IE,
IL,
IM,
IN,
IO,
IQ,
IR,
IS,
IT,
JE,
JM,
JO,
JP,
KE,
KG,
KH,
KI,
KM,
KN,
KP,
KR,
KW,
KY,
KZ,
LA,
LB,
LC,
LI,
LK,
LR,
LS,
LT,
LU,
LV,
LY,
MA,
MC,
MD,
ME,
MF,
MG,
MH,
MK,
ML,
MM,
MN,
MO,
MP,
MQ,
MR,
MS,
MT,
MU,
MV,
MW,
MX,
MY,
MZ,
NA,
NC,
NE,
NF,
NG,
NI,
NL,
NO,
NP,
NR,
NU,
NZ,
OM,
PA,
PE,
PF,
PG,
PH,
PK,
PL,
PM,
PN,
PR,
PS,
PT,
PW,
PY,
QA,
RE,
RO,
RS,
RU,
RW,
SA,
SB,
SC,
SD,
SE,
SG,
SH,
SI,
SJ,
SK,
SL,
SM,
SN,
SO,
SR,
SS,
ST,
SV,
SX,
SY,
SZ,
TC,
TD,
TF,
TG,
TH,
TJ,
TK,
TL,
TM,
TN,
TO,
TR,
TT,
TV,
TW,
TZ,
UA,
UG,
UM,
US,
UY,
UZ,
VA,
VC,
VE,
VG,
VI,
VN,
VU,
WF,
WS,
YE,
YT,
ZA,
ZM,
ZW
identityAutoContainment
boolean
required

Whether automatic identity containment is enabled

endpointAutoContainment
boolean
required

Whether automatic endpoint containment is enabled

fileAutoContainment
boolean
required

Whether automatic file containment is enabled

ephemeralAutoContainment
object
required

Whether automatic containment is enabled, per ephemeral resource type

fileAutoRelease
boolean
required

Whether automatic benign file release is enabled

timezone
string | null
required

IANA time zone for team-owned notifications and the fallback for members without their own. Null means UTC.

escalationEmails
string[]
required
deprecated

Deprecated — escalation emails are now stored in notification_subscription. Use GET /notification/subscription/team-channel?type=NEW_CASE_ESCALATION instead. Removal scheduled for 2026-09-20.

escalationSubscriptionEmails
string[]
required

Lists new case escalation subscription emails for this team: the team's own emails plus any emails inherited from the parent Service Provider.

logoUrl
string
required

URL of the team logo

chatOpsSecondFactor
boolean
required

Whether ChatOps requires second factor authentication

chatOpsAutoExclusion
boolean
required

Whether benign ChatOps confirmations automatically create exclusions

chatOpsAccountLockedMessage
string
required

Message to display when ChatOps account is locked

createdAt
string
required

Timestamp when the team was created

richCaseNotifications
boolean
required
deprecated

Deprecated — escalation rich-formatting is now stored per recipient in notification_subscription. Removal scheduled for 2026-09-20.

emailSignature
string
required

Signature for ChatOps communications

chatOpsSubjectLine
string
required

Subject line for ChatOps communications

localizedCopy
object
required

This team's French and German versions of the customizable copy. Empty entries use the service provider's version, then the Wirespeed default for that language.

autoSubscribeServiceProviderUsers
boolean
default:true
required

Whether to auto-subscribe service provider users to notifications for this team

sku
enum<string>
required

Subscription SKU tier for the team

Available options:
identity,
adr
addOns
enum<string>[]
required

Active add-on SKUs for the team

Available options:
data
premiumRetentionType
enum<string> | null
required

Default retention for premium integration data without a per-integration override. Set only when the team has the Data add-on.

Available options:
THIRTY_DAYS,
NINETY_DAYS,
ONE_YEAR,
THIRTEEN_MONTHS
isTrial
boolean
required

Whether this team is a proof-of-value trial

skipThirdPartyManagedSourceUpdates
boolean
required

Whether to skip source system updates for detections managed by a third party (e.g. Falcon Complete)

onboardingChecklistCompleted
boolean
required

Whether the team has completed the onboarding checklist

onboardingChecklistDismissed
boolean
required

Whether the team has dismissed the onboarding checklist from the homepage

askForG2Review
boolean
required

Whether to prompt for a G2 review after a happy case close. Cleared when anyone on the team writes or dismisses the prompt.

remediationManualUiEnabled
boolean
required
deprecated

Deprecated. Always true: remediation reporting and manual remediation UI are enabled for every team. Retained so existing public API clients keep receiving this required field. Removal scheduled for 2027-01-06.

chatOpsWelcomeMessage
string

Welcome message for ChatOps workflows

platformName
string

Platform name to use for service provider clients

maxChatOpsPerDay
number

Maximum ChatOps operations allowed per day

escalationSubjectLine
string
deprecated

Deprecated — the escalation subject is now stored per recipient in notification_subscription (null → scope-aware per-type default). Removal scheduled for 2026-09-20.

chatOpsWelcomeMessageInherited
boolean
emailSignatureInherited
boolean
chatOpsSubjectLineInherited
boolean
chatOpsAccountLockedMessageInherited
boolean
parentLocalizedCopy
object

The service provider's French and German versions, which apply where this team has none of its own

domain
string | null

Canonical customer DNS domain used for branding and team identification

serviceProvider
boolean

Whether this team is a service provider

parentTeamName
string

Name of the parent team if this is a sub-team

parentTeamId
string

ID of the parent team if this is a sub-team

parentServiceProvider
boolean

Whether the parent team is a service provider (null when no parent)

operatingTeam
boolean

Whether this is an operating team for service providers

useChatOpsOnboardingGroup
boolean

Whether to use the ChatOps onboarding group

chatOpsAllowBulkSmsInvite
boolean

Whether to allow bulk SMS invites without limit checks

billableUsers
number

The number of billable users for the team

billableEndpoints
number

The number of billable endpoints for the team

dataStorageGb
number | null

Current stored data usage in decimal gigabytes

teamMembers
number

The number of team members where the team is their parent team (excluding external members)

supportEmail
string

Support email for service provider customers to use

address
string

Address for the team, typically used in email footers

skuStartDate
string

Contract/subscription start date

skuEndDate
string

Contract/subscription end date