# Cache or update the AI triage analysis result for a suspicious event

Caches or updates the AI triage analysis result for a specific suspicious event. The full triage result payload (as produced by the AI triage pipeline) is accepted as raw JSON and stored against the alertId for later retrieval.

## Endpoints

`PUT /edr/api/ai/triage/{alertId}`

## Request URL

https://[{serverurl}](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)/edr/api/ai/triage/{alertId}

## Scope

`DesktopCentralCloud.EDR.CREATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** (`string`, Mandatory): `application/json`

### Path Parameters

- **alertId** (`long`, Mandatory): Unique identifier of the suspicious event whose triage result is being updated. Get alertId from [Get Alerts details](https://www.manageengine.com/products/desktop-central/help/api/cloud/edrview-alerts-get-alerts.html).

### Request Body

`application/json`

- **JSON Object**
  - **ui** (`JSON Object`, Optional): UI-facing metadata surfaced alongside the triage result.
  - **message** (`JSON Object`, Optional): Core AI-generated triage analysis result for the suspicious event.

### Sample Request

```curl
curl --request PUT \
  --url https://appdomains/edr/api/ai/triage/{alertId} \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{}'
```

### Sample Request Body

Update triage result for a suspicious event

```json
{
  "ui": {
    "suspicious_hash": "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2"
  },
  "message": {
    "triage_score": 71,
    "verdict": "TRUE_POSITIVE",
    "alert_summary": "Suspicious PowerShell execution detected"
  }
}
```

## Response Parameters

### HTTP Code 200

Response Body — `application/json`

- **JSON Object**
  - **status** (`string`): Outcome of the operation. `'success'` if the request completed successfully, `'failed'` if an error occurred. All AI Tools APIs always return HTTP 200; inspect this field to determine success or failure.
  - **message** (`string`): On success, a confirmation string or the requested data object. On failure, an error description string such as `'Request body is required'` or `'Something went wrong'`.

### HTTP Code 429

Response Body — `application/json`

- **JSON Object**
  - **errorCode** (`string`): Rate limit error code.  
    IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.
  - **errorMessage** (`string`): Rate limit exceeded message with guidance on when to retry.

## Possible Response Codes

- **200**: HTTP code
- **429**: HTTP code

## Sample Response: HTTP 200

Triage result stored successfully

```json
{
  "message": "Triage updated successfully",
  "status": "success"
}
```

Request body was missing or an internal error occurred

```json
{
  "message": "Request body is required",
  "status": "failed"
}
```

## Sample Response: HTTP 429

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ai/triage/{alertId}",
  "errorMsg": "The URL /edr/api/ai/triage/{alertId} was called too many times. Please retry after a while."
}
```

**Duration:** 1 minute | **Threshold:** 10 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.