---
title: "Asynchronously bulk update alerts using query params to target the alerts"
method: POST
path: "/alerts/bulk/apply"
tags: ["DTM Alerts"]
---

# Asynchronously bulk update alerts using query params to target the alerts

`POST /alerts/bulk/apply`

## Query parameters

- `buckets` boolean
- `monitor_id` string
- `has_analysis` boolean
- `since` string, date-time
- `until` string, date-time
- `status` 'new' | 'read' | 'escalated' | 'in_progress' | 'closed' | 'no_action_required' | 'duplicate' | 'not_relevant' | 'tracked_external'
- `alert_type` 'Compromised Credentials' | 'Domain Discovery' | 'Forum Post' | 'Message' | 'Paste' | 'Shop Listing' | 'Tweet' | 'Web Content'
- `search` string
- `match_value` string
- `tags` string
- `search_encoding` 'base64'
- `severity` 'high' | 'medium' | 'low'
- `mscore_gte` integer

## Headers

- `x-apikey` string, required
- `Content-Type` 'application/json', required

## Request body

- AlertBulkApplyOp — The changes to apply to alerts meeting the query criteria.
  - `add_tags` string[] — Tags to add on any alerts updated. Duplicate tags will not be created on any alert.
  - `exlcude_ids` string[] — If provided, an array of alert IDs that should be explictly skipped during the update operation.
  - `remove_tags` string[] — Tags to remove on any alerts updated.
  - `status` 'new' | 'read' | 'escalated' | 'in_progress' | 'closed' | 'no_action_required' | 'duplicate' | 'not_relevant' | 'tracked_external' — The status to apply to the alerts.

## Response `202`

Accepted and will be processed in the background.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error

---

[API](https://skmtc.net/virustotal/apis/threat-landscape.md) · [All operations](https://skmtc.net/virustotal/apis/threat-landscape/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/virustotal/threat-landscape/versions/d61b85e6a6b3/schema)