---
title: "Close Alerts"
method: POST
path: "/api/v2/Alerts/{alertId}/close"
tags: ["Alerts"]
---

# Close Alerts

`POST /api/v2/Alerts/{alertId}/close`

Change the status of an alert to closed by invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/Alerts/{alertId}/close` 

 The body of the request should contain the reason for closing, from these options: 
 * Other 
 * False positive 
 * Not enough information 
 * Malicious and have resolution in place 
 * Expected because of routine testing 
 * Expected behavior 


 If you choose `Other`, the message field is required and should contain a brief explanation of why the alert is closed.

 Note that a closed alert cannot be reopened. 

 For details about alert statuses, see [Status](https://docs.fortinet.com/document/forticnapp/latest/administration-guide/772309/view-alerts#status).

## Path parameters

- `alertId` string, required

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- object
  - `reason` 0 | 1 | 2 | 3 | 4 | 5, required — 0 - Other 1 - False positive 2 - Not enough information 3 - Malicious and have resolution in place 4 - Expected because of routine testing 5 - Expected behavior
  - `comment` string — If you choose `0` (`Other`), the comment field is required and should contain a brief explanation of why the alert is closed.

## Response `204`

Success

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)