---
title: "Create an Escalation Resolution"
method: POST
path: "/v1/escalations/{id}/resolution"
tags: ["Escalations"]
---

# Create an Escalation Resolution

`POST /v1/escalations/{id}/resolution`

Allows you to resolve an Escalation. Creating a resolution updates the Escalation's status
to resolved. This endpoint requires an API key with permissions to write to Escalations. **Note that the default account API key is read-only, so you'll need to create a user-based API key with the appropriate permissions to access this endpoint**.
The behavior of this endpoint varies by Escalation type so your request should be crafted based on the specific Escalation you are interacting with.

#### Simple Resolution

For most types of Escalations, a POST to the resolution endpoint with only the Escalation's ID is sufficient. This action resolves the Escalation directly without requiring any additional parameters.

#### Complex Resolution

For Escalations that have many entities which all require action, a call to this endpoint will **bulk resolve all associated entities at once**. The determination provided will be **applied to every single entity attached to the Escalation.** 
Note that these kinds of Escalation resolutions require extra parameters in their requests. 

Escalation types that can resolve multiple associated entities at once are:
  - Unwanted Country Access
  - Unwanted VPN Access

 **NOTE:** Ommitting both `determination` and `scope` params will temporarily resolve the Unwanted Access Escalations.
  The escalation will reopen upon the next occurrence of the event that created the escalation.
  This is equivalent to using the "dismiss" option in the portal.

## Path parameters

- `id` integer, required

## Request body

- EscalationResolutionParameters — Create an Escalation Resolution
  - `determination` 'expected' | 'unauthorized' — Determination is only used for Unwanted Country Access and Unwanted VPN Access Escalations. This field determines whether **all** the associated identities are expected or unauthorized.
  - `scope` 'account' | 'organization' | 'identity' — Scope is used only for Unwanted Access Escalations. This determines what kinds of access rules are created in response to the Escalation. This parameter is better explained using an example: In the scenario when `email123@example.com` logs in from Russia and the determination is `unauthorized`: When the scope is `identity`: Rules created based on the resolution will only apply to the identities associated with the Escalation. In this case a rule will be created specifically preventing `email123@example.com` from logging in from Russia. When the scope is `organization`: Rules created based on the resolution will apply to all identities in the organization. In this case all logins from Russia will be prevented across the organization. When the scope is `account`: Rules created based on the resolution will apply to all identities on the account. In this case all logins from Russia will be prevented across the account.

## Response `201`

Create an Escalation Resolution

- EscalationResolution — EscalationResolution model
  - `escalation` EscalationWithEntities, required — EscalationWithEntities model
    - `id` integer — A Huntress-unique identifier for the escalation.
    - `account` unknown
    - `organizations` string[] — An array of Organizations this escalation pertains to
    - `created_at` string, date-time — ISO-8601 formatted timestamp for when this escalation was created.
    - `resolved_at` string, date-time — ISO-8601 formatted timestamp for when this escalation was resolved.
    - `severity` 'low' | 'high' | 'critical' — The severity of the escalation.
    - `status` 'open' | 'sent' | 'resolved' — The status of the Escalation
    - `subject` string — The subject of the Escalation
    - `subtype` string — An additional classifier for the escalation. The interpretation depends on the escalation type (e.g. an ISO country code for Unexpected Country Access escalations).
    - `type` string — The type of the Escalation
    - `updated_at` string, date-time — ISO-8601 formatted timestamp for when this escalation was last updated.
    - `entities` unknown, required
  - `resolution_method` 'rule' | 'dismiss' | 'direct', required — The code path the server took to resolve the Escalation. `rule` indicates a bulk resolution that created attribute rules from the supplied `determination` and `scope` parameters. `dismiss` indicates a temporary resolution from omitting both parameters on an Unwanted Access Escalation. `direct` indicates a simple resolution on an Escalation type that does not accept resolution parameters.

## Other responses

- `400` — Invalid resolution parameters
- `403` — There was an issue with your API credential or permissions.
- `409` — Escalation has already been resolved
- `422` — Escalation cannot be resolved through the API

---

[API](https://skmtc.net/huntress/apis/huntress-api-reference.md) · [All operations](https://skmtc.net/huntress/apis/huntress-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/huntress/huntress-api-reference/revisions/94acb422c07d/schema)