Returns the list of devices affected by a specific grouped alerts. This is the drill-down API for Get EDR Grouped Alerts — it returns all individual devices impacted by a threat cluster, along with the alert count and latest detection time per device. Supports filtering by device name and domain name.
get /edr/api/view/grouped_alert_devices
https://{serverurl}/edr/api/view/grouped_alert_devices
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
Filter devices within the group by hostname (partial match supported, e.g., 'example-hostname'). Fetch device hostnames from Get EDR Devices.
Filter devices within the group by domain name (partial match supported, e.g., 'example.com').
Page number for pagination. Defaults to 1.
Number of records per page. Default is 25, maximum is 1000.
curl --request GET \
--url https://appdomains/edr/api/view/grouped_alert_devices \
--header 'Accept: application/json' \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52'Response status. 'success' if the request completed successfully, 'failure' if an error occurred.
Total number of records matching the applied filters.
Total number of pages available based on the current page limit.
Pagination metadata containing the current page number and page limit.
Number of records returned per page.
Current page number (1-based).
Navigation links to the next and previous pages of results.
URL to the next page of results, in the form '{api_url}?page=
URL to the previous page of results, in the form '{api_url}?page=
Actual grouped alert device item response.
Human-readable display version of the resource_name field.
Unique resource identifier of the device.
Duplicate reference field for the resource identifier.
EDR component ID of the affected device.
Human-readable display version of the component_status field.
0 = Not enabled,
1 = Active,
8 = Inactive,
11 = Quarantined.
Resource ID as referenced in the managed computer record.
Component ID linked to the error code mapping table. null if no error.
Human-readable display version of the domain_netbios_name field.
Human-readable display version of the alert_count field.
Human-readable display version of the alert_raised_time field (e.g., 'Jan 15, 2025 10:30 AM').
Human-readable display version of the process_started_time field (e.g., 'Jan 15, 2025 10:29 AM').
Unix timestamp (ms) of the last status change on this device.
Device or alert resolution status code.
Managed status code of the device.
Whether the device is suspended. 'true' or 'false'.
Current network isolation status of the device. null if not isolated.
Recovery proximity indicator for the device.
Recovery status code of the device.
Error code on the device. null if no error.
Unix timestamp (ms) of the last sync with the EDR server. null if not synced.
Version of the endpoint management agent on this device.
Timestamp of agent uninstall. '-1' if the agent is still installed.
Display name of the device, if set. null if not configured.
Customer or tenant identifier.
EDRCOMMON001 — Internal server error occurred while retrieving devices for the specified alert group.
General internal error message.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.
Rate limit exceeded message with guidance on when to retry.
Paginated list of devices affected by a specific threat group
{
"metadata": {
"limit": 25,
"page": 3
},
"totalRecords": "51",
"messageResponse": [
{
"resource_name_transform": "DESKTOP-EXAMPLE",
"component_id": "3000000000000001",
"managed_status": "61",
"managedcomputer_resource_id": "2000000000000001",
"component_status_transform": "1",
"nearest_recovery": "0",
"last_sync_time": null,
"resource_resource_id": "2000000000000001",
"is_suspended": "false",
"managededrcomponenttoerrcode_component_id": null,
"recovery_status": "0",
"agent_uninstalled_on": "-1",
"agent_version": "11.x.xxxx.xx.W",
"process_started_time_transform": "Jan 15, 2025 10:29 AM",
"isolation_status": null,
"name": null,
"resource_id": "2000000000000001",
"alert_count_transform": "10",
"error_code": null,
"customer_id": "1000000000000001",
"domain_netbios_name_transform": "CORP",
"alert_raised_time_transform": "Jan 15, 2025 10:30 AM",
"status_update_time": "1700012700000",
"status": "2"
}
],
"totalPages": 3,
"Links": {
"next": "null",
"prev": "/edr/api/view/grouped_alert_devices?page=2&pageLimit=25"
},
"status": "success"
}
Unexpected server-side error
{
"errorMessage": "Exception while retrieving devices for the specified alert group",
"errorCode": "EDRCOMMON001"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/view/grouped_alert_devices",
"errorMsg": "The URL /edr/api/view/grouped_alert_devices was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.