# Isolate or de-isolate multiple devices in bulk

Performs bulk device isolation or de-isolation through the AI Tools API, and can return the server-OS devices targeted for isolation when administrator review is required.

## Endpoint

`POST /edr/api/ai/devices/bulkIsolation`

## Request

### Request URL

`https://{server-hostname}:8383/edr/api/ai/devices/bulkIsolation`

### Scope

`EDR.CREATE`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Content-Type** `string` — **Mandatory**
  - `application/json`

#### Request Body

`application/json`

- **isIsolation** `boolean` — **Mandatory**
  - `true` to isolate devices; `false` to de-isolate (lift isolation).
- **componentIds** `JSON Array` — Optional
  - List of device/component IDs to apply the isolation action on.
- **remarks** `string` — Optional
  - Free-text reason or notes for the isolation action.
- **confirmed** `boolean` — **Mandatory**
  - When `true`, performs the actual isolation.
  - When `false` or absent, returns a list of server-grade devices for administrator review.

## Sample Request

```curl
curl --request POST \
  --url https://appdomain/edr/api/ai/devices/bulkIsolation \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"componentIds":[101],"isIsolation":false,"confirmed":false,"remarks":"De-isolating after investigation closed"}'
```

### Sample Request Body

#### Pre-confirmation request (confirmed = false) — returns server-OS device names that need extra acknowledgment before isolation proceeds

```json
{
  "componentIds": [
    101
  ],
  "isIsolation": false,
  "confirmed": false,
  "remarks": "De-isolating after investigation closed"
}
```

#### Confirmed bulk de-isolation (confirmed = true) — re-authenticates and performs the de-isolation

```json
{
  "componentIds": [
    101
  ],
  "isIsolation": false,
  "confirmed": true,
  "remarks": "De-isolating after investigation closed"
}
```

#### Confirmed bulk isolation (confirmed = true)

```json
{
  "componentIds": [
    101,
    202,
    303
  ],
  "isIsolation": true,
  "confirmed": true,
  "remarks": "Isolating devices flagged during triage investigation"
}
```

## Response Parameters

### HTTP Code 200

#### Response Body

`application/json`

- **status** `string`
  - Outcome of the operation. `'success'` or `'failed'`.
- **message** `string`
  - On success: when `confirmed` is `true`, an object whose `status` key is a map of componentId (string) to isolation result (boolean) — `true` means the command was sent successfully, `false` means the device could not be reached.
  - When `confirmed` is `false` or absent, an object with `serverOSResourceNames` (array of server-OS device names requiring additional confirmation) and `confirmed` (boolean, always `true`).
  - On failure, an error description string, such as `'User Authentication Failed'` or `'Failed to perform bulk device isolation'`.

### HTTP Code 429

#### Response Body

`application/json`

- **errorCode** `string`
  - Rate limit error code.
  - `IAM0019` — Returned when the API call threshold is exceeded within the allowed duration window.
- **errorMessage** `string`
  - Rate limit exceeded message with guidance on when to retry.

## Sample Response: HTTP 200

### Isolation/de-isolation completed successfully (confirmed = true) — `message.status` is a map of componentId to boolean result

```json
{
  "message": {
    "status": {
      "101": true
    }
  },
  "status": "success"
}
```

### Pre-confirmation response (confirmed = false) — `serverOSResourceNames` lists server-OS devices needing extra acknowledgment

```json
{
  "message": {
    "serverOSResourceNames": [],
    "confirmed": true
  },
  "status": "success"
}
```

### Re-authentication failed for a confirmed = true request

```json
{
  "message": "User Authentication Failed",
  "status": "failed"
}
```

### Unexpected internal error while performing isolation

```json
{
  "message": "Failed to perform bulk device isolation",
  "status": "failed"
}
```

## Sample Response: HTTP 429

### API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ai/devices/bulkIsolation",
  "errorMsg": "The URL /edr/api/ai/devices/bulkIsolation was called too many times. Please retry after a while."
}
```

## Rate Limits

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.