# Retrieve a comprehensive EDR dashboard summary

Returns a comprehensive dashboard summary of the EDR product's current state including device scan coverage, incident statistics, device status classifications, and agent version distribution. In MSP environments, omitting the CUSTOMERID header aggregates data across all tenant customers.

## Endpoint

`GET /edr/api/ext/over_all_summary`

## Request

### Request URL

`https://{server-hostname}:8383/edr/api/ext/over_all_summary`

### Scope

`EDR.READ`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Content-Type** (`string`, Mandatory): `application/json`

#### Query Parameters

- **pageLimit** (`integer`, Optional)
- **page** (`integer`, Optional)
- **searchColumn** (`string`, Optional)
- **searchValue** (`string`, Optional)

### Sample Request

```curl
curl --request GET \
  --url 'https://appdomain/edr/api/ext/over_all_summary?pageLimit=SOME_INTEGER_VALUE&page=SOME_INTEGER_VALUE&searchColumn=SOME_STRING_VALUE&searchValue=SOME_STRING_VALUE' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json'
```

## Response Parameters

### HTTP Code 200

Response Body: `application/json`

**JSON Object**

- **scanned_devices** (`long`): Number of managed devices that have been scanned by the EDR agent.
- **not_scanned_devices** (`long`): Number of managed devices that have not yet been scanned.
- **unresolved_alerts_count** (`string`): Total number of open (unresolved) security incidents.
- **mitigated_alerts_count** (`string`): Total number of resolved or mitigated incidents (total minus unresolved).
- **devices_with_unresolved_alerts** (`string`): Number of unique devices that have at least one unresolved security incident.
- **alerts_last_24h** (`string`): Number of new security incidents raised in the last 24 hours.
- **managed_components** (`string`): Total number of managed endpoints or components enrolled in EDR.
- **total_affected_devices** (`string`): Total number of devices that have been affected by any detected threat.
- **total_affected_users** (`string`): Total number of users whose devices have been affected by any detected threat.
- **device_status_summary** (`JSON Object`): Breakdown of managed devices by their current EDR agent status.
- **device_version_summary** (`JSON Object`): Breakdown of managed devices by their EDR agent version status.

#### Sample Response

Overall EDR summary for a single-tenant deployment

```json
{
  "not_scanned_devices": 20,
  "managed_components": 500,
  "unresolved_alerts_count": 15,
  "device_version_summary": {
    "latest_version": 420,
    "yet_to_contact": 30,
    "outdated_version": 50
  },
  "devices_with_unresolved_alerts": 8,
  "alerts_last_24h": 5,
  "device_status_summary": {
    "yet_to_enable": 12,
    "inactive": 23,
    "active": 460,
    "quarantined": 5
  },
  "mitigated_alerts_count": 142,
  "total_affected_devices": 23,
  "scanned_devices": 480,
  "total_affected_users": 11
}
```

### HTTP Code 400

Response Body: `application/json`

**JSON Object**

- **errorCode** (`string`): `EDRCOMMON001` — Internal server error occurred while retrieving the EDR overall summary.
- **errorMessage** (`string`): General internal error message.

#### Sample Response

Unexpected server-side error

```json
{
  "errorMessage": "Exception while getting dashboard summary through API Explorer",
  "errorCode": "EDRCOMMON001"
}
```

### HTTP Code 429

Response Body: `application/json`

**JSON Object**

- **errorCode** (`string`): Rate limit error code. `IAM0019` — Returned when the API call threshold is exceeded within the defined duration window.
- **errorMessage** (`string`): Rate limit exceeded message with guidance on when to retry.

#### Sample Response

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ext/over_all_summary",
  "errorMsg": "The URL /edr/api/ext/over_all_summary was called too many times. Please retry after a while."
}
```

## Rate Limit

![Help icon](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.