Remediate an event (Closed* transition + closure narrative)
POST/v2/events/:id/remediate
Triggers the event's remediation flow: a transition to a Closed* status combined with a
comment (client-supplied or auto-generated). Includes the same rescan-redirect handling as
PATCH /v2/events/{id}.
The closure comment is always written. Remediation is a status change plus a comment, and
the comment is created even when the event already sits in the requested Closed* status. In
that case the response reports No field changes required - comment created and returns the
new comment_id. Unlike the PATCH routes, this route has no pure no-op path.
Retries are still safe. An identical remediation, meaning the same status and the same
comment text from the same integration, returns the prior operation_id and creates no second
comment. Vary the comment text between retries only when you intend an additional comment
each time.
Request
Responses
- 200
- 400
- 401
- 403
- 404
- 429
- 503
Remediation applied.
Validation failure. See error.code (VALIDATION_ERROR, INVALID_STATUS_TRANSITION, COMMENT_REQUIRED, USER_NOT_FOUND, INVALID_DISPLAY_ID, BULK_ACTION_FIELD_MISMATCH, BULK_LIMIT_EXCEEDED).
UNAUTHORIZED: missing or invalid bearer token, or wrong token type for a write route.
Access denied. Possible codes are ACCESS_DENIED, TWO_WAY_DISABLED, MODULE_ACCESS_DENIED, INCIDENT_ARCHIVED, org/user inactive, or integration configuration inactive.
Target entity (or job) not found in the token's org tree.
RATE_LIMIT_EXCEEDED: the per-token budget is exhausted. Back off per the Retry-After header.
Response Headers
Seconds to wait before retrying.
INTEGRATION_PLATFORM_UNAVAILABLE or INTEGRATION_AUTH_UNAVAILABLE: transient upstream failure, safe to retry.