Performs bulk device isolation or de-isolation through the AI Tools API, and can return the server-OS devices targeted for isolation when administrator review is required.
post /edr/api/ai/devices/bulkIsolation
https://{serverurl}/edr/api/ai/devices/bulkIsolation
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
true to isolate devices; false to de-isolate (lift isolation).
List of device/component IDs to apply the isolation action on.
Unique component (device) ID to isolate or de-isolate. get ComponentId from Get Devices details .
Free-text reason or notes for the isolation action.
When true, performs the actual isolation.
When false or absent, returns a list of server-grade devices for administrator review.
curl --request POST \
--url https://appdomains/edr/api/ai/devices/bulkIsolation \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"isIsolation":false,"confirmed":false}'Pre-confirmation request (confirmed = false) — returns server-OS device names that need extra acknowledgment before isolation proceeds
{
"componentIds": [
101
],
"isIsolation": false,
"confirmed": false,
"remarks": "De-isolating after investigation closed"
}
Confirmed bulk de-isolation (confirmed = true) — re-authenticates and performs the de-isolation
{
"componentIds": [
101
],
"isIsolation": false,
"confirmed": true,
"remarks": "De-isolating after investigation closed"
}
Confirmed bulk isolation (confirmed = true)
{
"componentIds": [
101,
202,
303
],
"isIsolation": true,
"confirmed": true,
"remarks": "Isolating devices flagged during triage investigation"
}
Outcome of the operation. 'success' or 'failed'.
On success: when 'confirmed' is true, an object whose 'status' key is a map of componentId (string) to isolation result (boolean) — true means the command was sent successfully, false means the device could not be reached; when 'confirmed' is false or absent, an object with 'serverOSResourceNames' (array of server-OS device names requiring additional confirmation) and 'confirmed' (boolean, always true). On failure, an error description string (e.g., 'User Authentication Failed', 'Failed to perform bulk device isolation').
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.
Rate limit exceeded message with guidance on when to retry.
Isolation/de-isolation completed successfully (confirmed = true) — 'message.status' is a map of componentId to boolean result
{
"message": {
"status": {
"101": true
}
},
"status": "success"
}
Pre-confirmation response (confirmed = false) — 'serverOSResourceNames' lists server-OS devices needing extra acknowledgment
{
"message": {
"serverOSResourceNames": [],
"confirmed": true
},
"status": "success"
}
Re-authentication failed for a confirmed = true request
{
"message": "User Authentication Failed",
"status": "failed"
}
Unexpected internal error while performing isolation
{
"message": "Failed to perform bulk device isolation",
"status": "failed"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/ai/devices/bulkIsolation",
"errorMsg": "The URL /edr/api/ai/devices/bulkIsolation was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.