# Isolate or de-isolate multiple devices in bulk

Performs bulk device isolation or de-isolation through the AI Tools API, and can return the server-OS devices targeted for isolation when administrator review is required.

## Endpoint

`POST /edr/api/ai/devices/bulkIsolation`

## Request URL

`https://{serverurl}/edr/api/ai/devices/bulkIsolation`

`{serverurl}`: [OAuth Authentication Endpoint Domain](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)

## Scope

`DesktopCentralCloud.EDR.CREATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** (`string`, Mandatory): `application/json`

### Request Body

`application/json`

- **isIsolation** (`boolean`, Mandatory): `true` to isolate devices; `false` to de-isolate (lift isolation).
- **componentIds** (`JSON Array`, Optional): List of device/component IDs to apply the isolation action on.
- **remarks** (`string`, Optional): Free-text reason or notes for the isolation action.
- **confirmed** (`boolean`, Mandatory): When `true`, performs the actual isolation.
  When `false` or absent, returns a list of server-grade devices for administrator review.

## Sample Request

```curl
curl --request POST \
  --url https://appdomains/edr/api/ai/devices/bulkIsolation \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"isIsolation":false,"confirmed":false}'
```

## Sample Request Body

### Pre-confirmation request (`confirmed = false`)

Returns server-OS device names that need extra acknowledgment before isolation proceeds.

```json
{
  "componentIds": [
    101
  ],
  "isIsolation": false,
  "confirmed": false,
  "remarks": "De-isolating after investigation closed"
}
```

### Confirmed bulk de-isolation (`confirmed = true`)

Re-authenticates and performs the de-isolation.

```json
{
  "componentIds": [
    101
  ],
  "isIsolation": false,
  "confirmed": true,
  "remarks": "De-isolating after investigation closed"
}
```

### Confirmed bulk isolation (`confirmed = true`)

```json
{
  "componentIds": [
    101,
    202,
    303
  ],
  "isIsolation": true,
  "confirmed": true,
  "remarks": "Isolating devices flagged during triage investigation"
}
```

## Response Parameters

### HTTP Code 200

Response body: `application/json`

- **status** (`string`): Outcome of the operation. `'success'` or `'failed'`.
- **message** (`string`): On success: when `'confirmed'` is `true`, an object whose `'status'` key is a map of componentId (string) to isolation result (boolean) — `true` means the command was sent successfully, `false` means the device could not be reached; when `'confirmed'` is `false` or absent, an object with `'serverOSResourceNames'` (array of server-OS device names requiring additional confirmation) and `'confirmed'` (boolean, always `true`). On failure, an error description string (for example, `'User Authentication Failed'` or `'Failed to perform bulk device isolation'`).

### HTTP Code 429

Response body: `application/json`

- **errorCode** (`string`): Rate limit error code.
  `IAM0019` — Returned when the API call threshold is exceeded within the allowed duration window.
- **errorMessage** (`string`): Rate limit exceeded message with guidance on when to retry.

## Possible Response Codes

- **200**: HTTP code
- **429**: HTTP code

## Sample Response: HTTP 200

### Isolation/de-isolation completed successfully (`confirmed = true`)

`message.status` is a map of componentId to boolean result.

```json
{
  "message": {
    "status": {
      "101": true
    }
  },
  "status": "success"
}
```

### Pre-confirmation response (`confirmed = false`)

`serverOSResourceNames` lists server-OS devices needing extra acknowledgment.

```json
{
  "message": {
    "serverOSResourceNames": [],
    "confirmed": true
  },
  "status": "success"
}
```

### Re-authentication failed for a `confirmed = true` request

```json
{
  "message": "User Authentication Failed",
  "status": "failed"
}
```

### Unexpected internal error while performing isolation

```json
{
  "message": "Failed to perform bulk device isolation",
  "status": "failed"
}
```

## Sample Response: HTTP 429

### API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ai/devices/bulkIsolation",
  "errorMsg": "The URL /edr/api/ai/devices/bulkIsolation was called too many times. Please retry after a while."
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.