Isolate or de-isolate multiple devices in bulk

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Performs bulk device isolation or de-isolation through the AI Tools API, and can return the server-OS devices targeted for isolation when administrator review is required.

Request URL

https://{serverurl}/edr/api/ai/devices/bulkIsolation

Scope

DesktopCentralCloud.EDR.CREATECopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory
application/jsonapplication/jsonCopied!

- Request Body

application/json
JSON Object
Hide Sub-Attributes
isIsolationbooleanMandatory

true to isolate devices; false to de-isolate (lift isolation).

componentIdsJSON ArrayOptional

List of device/component IDs to apply the isolation action on.

Show Sub-Attributes
JSON Object
Show Sub-Attributes
componentIdlongMandatory

Unique component (device) ID to isolate or de-isolate. get ComponentId from Get Devices details .

remarksstringOptional

Free-text reason or notes for the isolation action.

confirmedbooleanMandatory

When true, performs the actual isolation.
When false or absent, returns a list of server-grade devices for administrator review.

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request POST \
  --url https://appdomains/edr/api/ai/devices/bulkIsolation \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"isIsolation":false,"confirmed":false}'

Sample Request Body

Pre-confirmation request (confirmed = false) — returns server-OS device names that need extra acknowledgment before isolation proceeds

Copied!
  {
    "componentIds": [
      101
    ],
    "isIsolation": false,
    "confirmed": false,
    "remarks": "De-isolating after investigation closed"
  }
                
Show full

Confirmed bulk de-isolation (confirmed = true) — re-authenticates and performs the de-isolation

Copied!
  {
    "componentIds": [
      101
    ],
    "isIsolation": false,
    "confirmed": true,
    "remarks": "De-isolating after investigation closed"
  }
                
Show full

Confirmed bulk isolation (confirmed = true)

Copied!
  {
    "componentIds": [
      101,
      202,
      303
    ],
    "isIsolation": true,
    "confirmed": true,
    "remarks": "Isolating devices flagged during triage investigation"
  }
                
Show full

Response Parameters

- HTTP code 200

Response Body - application/json
JSON Object
Hide Sub-Attributes
statusstring

Outcome of the operation. 'success' or 'failed'.

messagestring

On success: when 'confirmed' is true, an object whose 'status' key is a map of componentId (string) to isolation result (boolean) — true means the command was sent successfully, false means the device could not be reached; when 'confirmed' is false or absent, an object with 'serverOSResourceNames' (array of server-OS device names requiring additional confirmation) and 'confirmed' (boolean, always true). On failure, an error description string (e.g., 'User Authentication Failed', 'Failed to perform bulk device isolation').

- HTTP code 429

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code
429HTTP code

Sample Response: HTTP 200

Isolation/de-isolation completed successfully (confirmed = true) — 'message.status' is a map of componentId to boolean result

Copied!
  {
    "message": {
      "status": {
        "101": true
      }
    },
    "status": "success"
  }
                
Show full

Pre-confirmation response (confirmed = false) — 'serverOSResourceNames' lists server-OS devices needing extra acknowledgment

Copied!
  {
    "message": {
      "serverOSResourceNames": [],
      "confirmed": true
    },
    "status": "success"
  }
                
Show full

Re-authentication failed for a confirmed = true request

Copied!
  {
    "message": "User Authentication Failed",
    "status": "failed"
  }
                
Show full

Unexpected internal error while performing isolation

Copied!
  {
    "message": "Failed to perform bulk device isolation",
    "status": "failed"
  }
                
Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!
  {
    "errorCode": "IAM0019",
    "url": "/edr/api/ai/devices/bulkIsolation",
    "errorMsg": "The URL /edr/api/ai/devices/bulkIsolation was called too many times. Please retry after a while."
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.