---
title: "# Rerun Detection"
method: POST
path: "/v1/simulations/{Id}/run/{RunId}/rerun-detection"
tags: ["Simulation-Result"]
---

# # Rerun Detection

`POST /v1/simulations/{Id}/run/{RunId}/rerun-detection`

Re-analyses the detection results of the given simulation run against SIEM/EDR integrations.
The rerun is asynchronous: a successful response means the re-analysis has started, and its
outcome is observable through GET /v1/simulations/{Id}/run/{RunId}.
integrations is required and must list at least one integration id — there is no default-to-all.
Every listed integration must be eligible for rerun: configured, currently healthy, and reachable
through a live connected agent. Any ineligible integration rejects the whole rerun, since a rerun
against an unreachable integration yields no usable analysis. When update_assessment is true, the
simulation is also updated so future runs inherit the given integrations.

Error codes: 1149 the run cannot be re-analysed (not finished yet, analysis in progress,
quick-threat run or no completed prevention result), 1109 run not found, 1108 simulation not
found, 1111 no licensed integration device available. A 422 is returned when integrations is
missing or empty. A 400 with no error code is returned when a requested integration is not
eligible (unknown, not configured, unhealthy, or its connected agent is not alive). A 423 response
means another operation holds the account lock; retry after it completes.

## Path parameters

- `Id` integer, required
- `RunId` integer, required

## Request body

- RerunDetectionBody
  - `integrations` integer[], required — Integration ids to re-analyse the run against. Required — at least one id must be supplied (there is no default-to-all). Every listed integration must be eligible: configured, currently healthy, and reachable through a live connected agent. Any ineligible integration rejects the whole rerun. At most 64 array elements may be submitted (the limit is checked before de-duplication); duplicate ids are then ignored.
  - `update_assessment` boolean — When true, the simulation is also updated so future runs inherit the given integrations.

## Response `200`

RerunDetectionReturnSwagger

- object
  - `success` boolean

## Other responses

- `422` — validationErrorSwagger is represents the erroneous cases
- `default` — genericErrorSwagger is represents the erroneous cases

---

[API](https://skmtc.net/picussecurity/apis/picus-rest-api.md) · [All operations](https://skmtc.net/picussecurity/apis/picus-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/picussecurity/picus-rest-api/revisions/20b3cf15d9b2/schema)