Sign in
latestSwagger 2.02026-08-109450223.9 KB

94acb422c07d

Escalations

Create an Escalation Resolution

Allows you to resolve an Escalation. Creating a resolution updates the Escalation's status to resolved. This endpoint requires an API key with permissions to write to Escalations. Note that the default account API key is read-only, so you'll need to create a user-based API key with the appropriate permissions to access this endpoint. The behavior of this endpoint varies by Escalation type so your request should be crafted based on the specific Escalation you are interacting with.

Simple Resolution

For most types of Escalations, a POST to the resolution endpoint with only the Escalation's ID is sufficient. This action resolves the Escalation directly without requiring any additional parameters.

Complex Resolution

For Escalations that have many entities which all require action, a call to this endpoint will bulk resolve all associated entities at once. The determination provided will be applied to every single entity attached to the Escalation. Note that these kinds of Escalation resolutions require extra parameters in their requests.

Escalation types that can resolve multiple associated entities at once are:

  • Unwanted Country Access
  • Unwanted VPN Access

NOTE: Ommitting both determination and scope params will temporarily resolve the Unwanted Access Escalations. The escalation will reopen upon the next occurrence of the event that created the escalation. This is equivalent to using the "dismiss" option in the portal.

post/v1/escalations/{id}/resolution

Path parameters

idinteger required

Request body

determination'expected' | 'unauthorized'

Determination is only used for Unwanted Country Access and Unwanted VPN Access Escalations. This field determines whether all the associated identities are expected or unauthorized.

scope'account' | 'organization' | 'identity'

Scope is used only for Unwanted Access Escalations. This determines what kinds of access rules are created in response to the Escalation. This parameter is better explained using an example: In the scenario when email123@example.com logs in from Russia and the determination is unauthorized:

When the scope is identity:

Rules created based on the resolution will only apply to the identities associated with the Escalation. In this case a rule will be created specifically preventing email123@example.com from logging in from Russia.

When the scope is organization:

Rules created based on the resolution will apply to all identities in the organization. In this case all logins from Russia will be prevented across the organization.

When the scope is account:

Rules created based on the resolution will apply to all identities on the account. In this case all logins from Russia will be prevented across the account.

Response

Create an Escalation Resolution

resolution_method'rule' | 'dismiss' | 'direct' required

The code path the server took to resolve the Escalation. rule indicates a bulk resolution that created attribute rules from the supplied determination and scope parameters. dismiss indicates a temporary resolution from omitting both parameters on an Unwanted Access Escalation. direct indicates a simple resolution on an Escalation type that does not accept resolution parameters.

Example response

{
  "escalation": {
    "id": 84938,
    "account": {
      "id": 1,
      "name": "Your Account Name"
    },
    "organizations": [
      {
        "id": 1234,
        "name": "ExampleCo"
      }
    ],
    "created_at": "2025-09-05T18:20:34Z",
    "resolved_at": "2025-09-05T18:20:34Z",
    "severity": "low",
    "status": "resolved",
    "subject": "Defender Disabled",
    "subtype": "US",
    "type": "Environmental Issue",
    "updated_at": "2025-09-05T18:20:34Z",
    "entities": {
      "total_count": 1,
      "has_more": false,
      "items": [
        {
          "id": 1,
          "type": "Agent",
          "details": {
            "hostname": "laptop01",
            "platform": "windows",
            "os": "Windows 8 Pro",
            "last_callback_at": "2025-09-05T18:20:35Z"
          }
        }
      ]
    }
  },
  "resolution_method": "rule"
}