Updates the ticket status of one or more hash-based grouped alerts in bulk. Allows external integrations and ticketing systems to mark EDR grouped alerts as True Positive or False Positive, and optionally trigger file restoration for ARW-licensed customers. Grouped alerts that are already resolved are skipped automatically. An event log entry is automatically created for every ticket status change.
post /edr/api/ext/hash/ticket_status
https://{serverurl}/edr/api/ext/hash/ticket_status
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
List of incident IDs whose ticket status is to be updated. Fetch incident_id from Get EDR Grouped Alerts .
Unique identifier of a security incident. Fetch from Get EDR Grouped Alerts .
Ticket status code string.
True Positive - 3,
False Positive - 2.
Optional remediation actions to trigger when marking the incident(s) as True Positive.
When true, terminates the process associated with the incident or alert on the affected device(s).
When true, removes the malicious file(s) associated with the incident or alert from the affected device(s).
When true, restores files quarantined by Anti-Ransomware (ARW). Requires ARW license on the customer account.
Optional free-text notes describing the reason for the ticket status change, recorded for audit purposes.
curl --request POST \
--url https://appdomains/edr/api/ext/hash/ticket_status \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"ticketStatus":"2","incidentIds":[4001,4002,4003]}'Mark multiple incidents as False Positive
{
"notes": "Benign files",
"ticketStatus": "2",
"incidentIds": [
4001,
4002,
4003
]
}
Mark as True Positive, restore ARW-quarantined files, and record notes
{
"notes": "Confirmed ransomware - restoring encrypted files",
"ticketStatus": "3",
"action": {
"restore": false,
"cleanUp": false,
"kill": true
},
"incidentIds": [
"9502000000078291"
]
}
Error code.
EDRCOMMON004 — incidentIds/incidentId is missing or empty, or all supplied incidents are already resolved.
EDRCOMMON001 — Internal server error occurred while updating the incident ticket status.
Detailed message explaining the specific validation or internal failure.
EDRSETTING003 — Restore action was requested but the customer does not have an eligible Anti-Ransomware (ARW) license.
Unauthorized access message indicating the ARW license requirement.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
Rate limit exceeded message with guidance on when to retry.
200 OKincidentIds/incidentId not supplied
{
"errorMessage": "incidentIds is required",
"errorCode": "EDRCOMMON004"
}
All supplied incidents are already resolved
{
"errorMessage": "All selected incidents are already resolved",
"errorCode": "EDRCOMMON004"
}
Unexpected server-side error
{
"errorMessage": "Exception while updating incident ticket status",
"errorCode": "EDRCOMMON001"
}
Restore action requires ARW license
{
"errorMessage": "Unauthorized",
"errorCode": "EDRSETTING003"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/ext/hash/ticket_status",
"errorMsg": "The URL /edr/api/ext/hash/ticket_status was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.