# Update analyst notes for a specific suspicious event or alert

Updates the analyst notes associated with a specific suspicious event or alert. Unlike other AI Tools APIs.

## Endpoint

`PUT /edr/api/ai/alert/{alertId}/notes`

## Request URL

https://*{serverurl}*/edr/api/ai/alert/{alertId}/notes

## Scope

`DesktopCentralCloud.EDR.CREATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** `string` **Mandatory**: `application/json`

### Path Parameters

- **alertId** `long` **Mandatory**

  Unique identifier of the suspicious event or alert whose notes are being updated. Fetch alert_id from [Get EDR Alerts](https://www.manageengine.com/products/desktop-central/help/api/cloud/edrview-alerts-get-alerts.html).

### Request Body

`application/json`

- **notes** `string` **Mandatory**

  Analyst notes to associate with the alert. Send an empty string to clear existing notes.

## Sample Request

```curl
curl --request PUT \
  --url https://appdomains/edr/api/ai/alert/{alertId}/notes \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"notes":"Confirmed benign — approved test script from IT team"}'
```

## Sample Request Body

### Update analyst notes for an alert

```json
{
  "notes": "Confirmed benign — approved test script from IT team"
}
```

### Clear existing notes

```json
{
  "notes": ""
}
```

## Response Parameters

### HTTP Code 400

Response Body — `application/json`

- **errorCode** `string`

  `EDRCOMMON001` — Internal server error occurred while updating the alert notes.

- **errorMessage** `string`

  General internal error message.

### HTTP Code 429

Response Body — `application/json`

- **errorCode** `string`

  Rate limit error code.

  `IAM0019` — Returned when the API call threshold is exceeded within the allowed duration window.

- **errorMessage** `string`

  Rate limit exceeded message with guidance on when to retry.

## Possible Response Codes

- **204** HTTP code
- **400** HTTP code
- **429** HTTP code

## Sample Response: HTTP 204

```text
204 No Content
```

## Sample Response: HTTP 400

### Unexpected server-side error while updating notes

```json
{
  "errorMessage": "Exception while updating alert notes",
  "errorCode": "EDRCOMMON001"
}
```

## Sample Response: HTTP 429

### API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ai/alert/{alertId}/notes",
  "errorMsg": "The URL /edr/api/ai/alert/{alertId}/notes was called too many times. Please retry after a while."
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.