Updates the ticket status of one or more suspicious event alerts in bulk. Allows external integrations and ticketing systems to mark EDR alerts as True Positive or False Positive, and optionally trigger file restoration for ARW-licensed customers. Alerts that already carry the requested ticket status are rejected to prevent redundant True Positive → True Positive or False Positive → False Positive transitions. Processing is asynchronous — the update is queued, and DB updates, agent commands, event log entries, and timeline entries are generated per alert.
post /edr/api/ext/alert/ticket_status
https://{serverurl}/edr/api/ext/alert/ticket_status
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
List of suspicious event alert IDs whose ticket status is to be updated. Fetch alert_id from Get EDR Alerts .
Unique identifier of a suspicious event alert. Fetch from Get EDR Alerts .
Ticket status code string. '2' = False Positive, '3' = True Positive.
Optional remediation actions to trigger when marking the alert(s) as True Positive.
When true, terminates the process associated with the incident or alert on the affected device(s).
When true, removes the malicious file(s) associated with the incident or alert from the affected device(s).
When true, restores files quarantined by Anti-Ransomware (ARW). Requires ARW license on the customer account.
Optional free-text notes describing the reason for the ticket status change, recorded for audit purposes.
curl --request POST \
--url https://appdomains/edr/api/ext/alert/ticket_status \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json' \
--data '{"alertIds":[7001,7002],"ticketStatus":"2"}'Mark multiple alerts as False Positive
{
"notes": "Benign files",
"alertIds": [
7001,
7002
],
"ticketStatus": "2"
}
Mark as True Positive, restore ARW-quarantined files, and record notes
{
"notes": "Confirmed malicious script - restoring quarantined files",
"alertIds": [
9502000000078064
],
"ticketStatus": "3",
"action": {
"restore": false,
"cleanUp": false,
"kill": true
}
}
Error code.
EDRCOMMON004 — alertIds is missing or empty, or one or more alerts already carry the requested ticket status (True Positive → True Positive or False Positive → False Positive transitions are rejected).
EDRCOMMON001 — Internal server error occurred while updating the alert ticket status.
Detailed message explaining the specific validation or internal failure.
EDRSETTING003 — Restore action was requested but the customer does not have an eligible Anti-Ransomware (ARW) license.
Unauthorized access message indicating the ARW license requirement.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
Rate limit exceeded message with guidance on when to retry.
200 OKalertIds not supplied
{
"errorMessage": "alertIds is required",
"errorCode": "EDRCOMMON004"
}
Alert already marked with the requested ticket status
{
"errorMessage": "Alert 7001 is already marked as False Positive",
"errorCode": "EDRCOMMON004"
}
Unexpected server-side error
{
"errorMessage": "Exception while updating alert ticket status",
"errorCode": "EDRCOMMON001"
}
Restore action requires ARW license
{
"errorMessage": "Unauthorized",
"errorCode": "EDRSETTING003"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/ext/alert/ticket_status",
"errorMsg": "The URL /edr/api/ext/alert/ticket_status was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.