---
title: "POST /v1/{+parent}/securityIncidents:batchUpdate"
method: POST
path: "/v1/{+parent}/securityIncidents:batchUpdate"
tags: ["organizations"]
---

# POST /v1/{+parent}/securityIncidents:batchUpdate

`POST /v1/{+parent}/securityIncidents:batchUpdate`

BatchUpdateSecurityIncident updates multiple existing security incidents.

## Path parameters

- `parent` string, required

## Request body

- GoogleCloudApigeeV1BatchUpdateSecurityIncidentsRequest — Request for BatchUpdateSecurityIncident.
  - `requests` GoogleCloudApigeeV1UpdateSecurityIncidentRequest[] — Optional. Required. The request message specifying the resources to update. A maximum of 1000 can be modified in a batch.
    - `securityIncident` GoogleCloudApigeeV1SecurityIncident — Represents an SecurityIncident resource.
      - `name` string — Immutable. Name of the security incident resource. Format: organizations/{org}/environments/{environment}/securityIncidents/{incident} Example: organizations/apigee-org/environments/dev/securityIncidents/1234-5678-9101-1111
      - `displayName` string — Optional. Display name of the security incident.
      - `firstDetectedTime` string, google-datetime — Output only. The time when events associated with the incident were first detected.
      - `riskLevel` 'RISK_LEVEL_UNSPECIFIED' | 'LOW' | 'MODERATE' | 'SEVERE' — Output only. Risk level of the incident.
      - `observability` 'OBSERVABILITY_UNSPECIFIED' | 'ACTIVE' | 'ARCHIVED' — Optional. Indicates if the user archived this incident.
      - `trafficCount` string, int64 — Total traffic detected as part of the incident.
      - `lastObservabilityChangeTime` string, google-datetime — Output only. The time when the incident observability was last changed.
      - `lastDetectedTime` string, google-datetime — Output only. The time when events associated with the incident were last detected.
      - `detectionTypes` string[] — Output only. Detection types which are part of the incident. Examples: Flooder, OAuth Abuser, Static Content Scraper, Anomaly Detection.
    - `updateMask` string, google-fieldmask — Required. The list of fields to update. Allowed fields are: LINT.IfChange(allowed_update_fields_comment) - observability LINT.ThenChange()

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/apigee.md) · [All operations](https://skmtc.net/google/apis/apigee/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/apigee/versions/6e272fa448a7/schema)