# Retrieve the list of devices affected by a specific grouped threat

Returns the list of devices affected by a specific grouped alerts. This is the drill-down API for Get EDR Grouped Alerts — it returns all individual devices impacted by a threat cluster, along with the alert count and latest detection time per device. Supports filtering by device name and domain name.

## Endpoint

`GET /edr/api/view/grouped_alert_devices`

## Request

### Request URL

`https://`[*{serverurl}*](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)`/edr/api/view/grouped_alert_devices`

### Scope

`DesktopCentralCloud.EDR.READ`

### Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Accept** `string` **Mandatory**: `application/json`

#### Query Parameters

- **deviceName** `string` *Optional*: Filter devices within the group by hostname (partial match supported, e.g., 'example-hostname'). Fetch device hostnames from [Get EDR Devices](https://www.manageengine.com/products/desktop-central/help/api/cloud/edrview-devices-get-edrdevices.html).
- **domainName** `string` *Optional*: Filter devices within the group by domain name (partial match supported, e.g., 'example.com').
- **page** `string` *Optional*: Page number for pagination. Defaults to 1.
- **pageLimit** `string` *Optional*: Number of records per page. Default is 25, maximum is 1000.

### Sample Request

#### Curl

```curl
curl --request GET \
  --url https://appdomains/edr/api/view/grouped_alert_devices \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'
```

## Response Parameters

### HTTP Code 200

#### Response Body — `application/json`

`JSON Object`

- **status** `string`: Response status. 'success' if the request completed successfully, 'failure' if an error occurred.
- **totalRecords** `string`: Total number of records matching the applied filters.
- **totalPages** `string`: Total number of pages available based on the current page limit.
- **metadata** `JSON Object`: Pagination metadata containing the current page number and page limit.
- **Links** `JSON Object`: Navigation links to the next and previous pages of results.
- **messageResponse** `JSON Object`: Actual grouped alert device item response.

#### Sample Response

Paginated list of devices affected by a specific threat group

```json
{
  "metadata": {
    "limit": 25,
    "page": 3
  },
  "totalRecords": "51",
  "messageResponse": [
    {
      "resource_name_transform": "DESKTOP-EXAMPLE",
      "component_id": "3000000000000001",
      "managed_status": "61",
      "managedcomputer_resource_id": "2000000000000001",
      "component_status_transform": "1",
      "nearest_recovery": "0",
      "last_sync_time": null,
      "resource_resource_id": "2000000000000001",
      "is_suspended": "false",
      "managededrcomponenttoerrcode_component_id": null,
      "recovery_status": "0",
      "agent_uninstalled_on": "-1",
      "agent_version": "11.x.xxxx.xx.W",
      "process_started_time_transform": "Jan 15, 2025 10:29 AM",
      "isolation_status": null,
      "name": null,
      "resource_id": "2000000000000001",
      "alert_count_transform": "10",
      "error_code": null,
      "customer_id": "1000000000000001",
      "domain_netbios_name_transform": "CORP",
      "alert_raised_time_transform": "Jan 15, 2025 10:30 AM",
      "status_update_time": "1700012700000",
      "status": "2"
    }
  ],
  "totalPages": 3,
  "Links": {
    "next": "null",
    "prev": "/edr/api/view/grouped_alert_devices?page=2&pageLimit=25"
  },
  "status": "success"
}
```

### HTTP Code 400

#### Response Body — `application/json`

`JSON Object`

- **errorCode** `string`: EDRCOMMON001 — Internal server error occurred while retrieving devices for the specified alert group.
- **errorMessage** `string`: General internal error message.

#### Sample Response

Unexpected server-side error

```json
{
  "errorMessage": "Exception while retrieving devices for the specified alert group",
  "errorCode": "EDRCOMMON001"
}
```

### HTTP Code 429

#### Response Body — `application/json`

`JSON Object`

- **errorCode** `string`: Rate limit error code.
  IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.
- **errorMessage** `string`: Rate limit exceeded message with guidance on when to retry.

#### Sample Response

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/view/grouped_alert_devices",
  "errorMsg": "The URL /edr/api/view/grouped_alert_devices was called too many times. Please retry after a while."
}
```

## Possible Response Codes

- **200**: HTTP code
- **400**: HTTP code
- **429**: HTTP code

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.