---
title: "POST /mitigationactions/actions/{actionName}"
method: POST
path: "/mitigationactions/actions/{actionName}"
---

# POST /mitigationactions/actions/{actionName}

`POST /mitigationactions/actions/{actionName}`

Defines an action that can be applied to audit findings by using StartAuditMitigationActionsTask. Only certain types of mitigation actions can be applied to specific check names. For more information, see [Mitigation actions](https://docs.aws.amazon.com/iot/latest/developerguide/device-defender-mitigation-actions.html). Each mitigation action can apply only one type of change.

Requires permission to access the [CreateMitigationAction](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions) action.

## Path parameters

- `actionName` string, required

## Request body

- object
  - `roleArn` string, required — The ARN of the IAM role that is used to apply the mitigation action.
  - `actionParams` object, required — The set of parameters for this mitigation action. You can specify only one type of parameter (in other words, you can apply only one action for each defined mitigation action).
    - `updateDeviceCertificateParams` object — Parameters to define a mitigation action that changes the state of the device certificate to inactive.
      - `action` 'DEACTIVATE', required — The action that you want to apply to the device certificate. The only supported value is <code>DEACTIVATE</code>.
    - `updateCACertificateParams` object — Parameters to define a mitigation action that changes the state of the CA certificate to inactive.
      - `action` 'DEACTIVATE', required — The action that you want to apply to the CA certificate. The only supported value is <code>DEACTIVATE</code>.
    - `addThingsToThingGroupParams` object — Parameters to define a mitigation action that moves devices associated with a certificate to one or more specified thing groups, typically for quarantine.
      - `thingGroupNames` ThingGroupName[], required — The list of groups to which you want to add the things that triggered the mitigation action. You can add a thing to a maximum of 10 groups, but you can't add a thing to more than one group in the same hierarchy.
      - `overrideDynamicGroups` boolean — Specifies if this mitigation action can move the things that triggered the mitigation action even if they are part of one or more dynamic thing groups.
    - `replaceDefaultPolicyVersionParams` object — Parameters to define a mitigation action that adds a blank policy to restrict permissions.
      - `templateName` 'BLANK_POLICY', required — The name of the template to be applied. The only supported value is <code>BLANK_POLICY</code>.
    - `enableIoTLoggingParams` object — Parameters to define a mitigation action that enables Amazon Web Services IoT Core logging at a specified level of detail.
      - `roleArnForLogging` string, required — The Amazon Resource Name (ARN) of the IAM role used for logging.
      - `logLevel` 'DEBUG' | 'INFO' | 'ERROR' | 'WARN' | 'DISABLED', required — Specifies the type of information to be logged.
    - `publishFindingToSnsParams` object — Parameters to define a mitigation action that publishes findings to Amazon Simple Notification Service (Amazon SNS. You can implement your own custom actions in response to the Amazon SNS messages.
      - `topicArn` string, required — The ARN of the topic to which you want to publish the findings.
  - `tags` Tag[] — Metadata that can be used to manage the mitigation action.
    - `Key` string, required — The tag's key.
    - `Value` string — The tag's value.

## Response `200`

Success

- CreateMitigationActionResponse
  - `actionArn` string — The ARN for the new mitigation action.
  - `actionId` string — A unique identifier for the new mitigation action.

## Other responses

- `480` — InvalidRequestException
- `481` — ResourceAlreadyExistsException
- `482` — LimitExceededException
- `483` — ThrottlingException
- `484` — InternalFailureException

---

[API](https://skmtc.net/aws/apis/iot.md) · [All operations](https://skmtc.net/aws/apis/iot/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/iot/versions/deef5c4b09f0/schema)