Updates the analyst notes associated with a specific suspicious event or alert. Unlike other AI Tools APIs.
put /edr/api/ai/alert/{alertId}/notes
https://{serverurl}/edr/api/ai/alert/{alertId}/notes
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
Unique identifier of the suspicious event or alert whose notes are being updated. Fetch alert_id from Get EDR Alerts.
Analyst notes to associate with the alert. Send an empty string to clear existing notes.
curl --request PUT \
--url https://appdomains/edr/api/ai/alert/{alertId}/notes \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"notes":"Confirmed benign — approved test script from IT team"}'Update analyst notes for an alert
{
"notes": "Confirmed benign — approved test script from IT team"
}
Clear existing notes
{
"notes": ""
}
EDRCOMMON001 — Internal server error occurred while updating the alert notes.
General internal error message.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.
Rate limit exceeded message with guidance on when to retry.
204 No ContentUnexpected server-side error while updating notes
{
"errorMessage": "Exception while updating alert notes",
"errorCode": "EDRCOMMON001"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/ai/alert/{alertId}/notes",
"errorMsg": "The URL /edr/api/ai/alert/{alertId}/notes was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.