Returns a comprehensive dashboard summary of the EDR product's current state including device scan coverage, incident statistics, device status classifications, and agent version distribution. In MSP environments, omitting the CUSTOMERID header aggregates data across all tenant customers.
get /edr/api/ext/over_all_summary
https://{serverurl}/edr/api/ext/over_all_summary
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
curl --request GET \
--url https://appdomains/edr/api/ext/over_all_summary \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json'Number of managed devices that have been scanned by the EDR agent.
Number of managed devices that have not yet been scanned.
Total number of open (unresolved) security incidents.
Total number of resolved or mitigated incidents (total minus unresolved).
Number of unique devices that have at least one unresolved security incident.
Number of new security incidents raised in the last 24 hours.
Total number of managed endpoints or components enrolled in EDR.
Total number of devices that have been affected by any detected threat.
Total number of users whose devices have been affected by any detected threat.
Breakdown of managed devices by their current EDR agent status.
Number of devices where the EDR agent is installed but not yet activated.
Number of devices with an active and communicating EDR agent.
Number of devices currently quarantined by the EDR system.
Number of devices where the EDR agent is installed but not communicating.
Breakdown of managed devices by their EDR agent version status.
Number of devices running the latest available EDR agent version.
Number of devices that have not yet checked in with the EDR server.
Number of devices running an older, outdated EDR agent version.
EDRCOMMON001 — Internal server error occurred while retrieving the EDR overall summary.
General internal error message.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
Rate limit exceeded message with guidance on when to retry.
Overall EDR summary for a single-tenant deployment
{
"not_scanned_devices": 20,
"managed_components": 500,
"unresolved_alerts_count": 15,
"device_version_summary": {
"latest_version": 420,
"yet_to_contact": 30,
"outdated_version": 50
},
"devices_with_unresolved_alerts": 8,
"alerts_last_24h": 5,
"device_status_summary": {
"yet_to_enable": 12,
"inactive": 23,
"active": 460,
"quarantined": 5
},
"mitigated_alerts_count": 142,
"total_affected_devices": 23,
"scanned_devices": 480,
"total_affected_users": 11
}
Unexpected server-side error
{
"errorMessage": "Exception while getting dashboard summary through API Explorer",
"errorCode": "EDRCOMMON001"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/ext/over_all_summary",
"errorMsg": "The URL /edr/api/ext/over_all_summary was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.