Bulk triage with async jobs

Update many incidents or events in one call. Bulk operations are asynchronous: you submit a selection plus one action, get a job_id back immediately, and poll for per-record outcomes.

Endpoints

Operation	Endpoint
Bulk update incidents	POST /v2/incidents/bulk
Bulk update events	POST /v2/events/bulk
Poll a job	GET /v2/jobs/{jobId}

Submit an incident bulk job

Incident bulk selects by explicit IDs and/or filters (status, priority, module_name, created_after, created_before, assignee_email) and supports update_status, update_priority, and update_assignee:

curl -s -X POST "https://api.cloudsek.com/v2/incidents/bulk" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "operation": "update_priority",
    "filters": { "incident_display_ids": ["XVA-201", "XVA-205"] },
    "action": { "priority": "P0", "comment": "Escalated after threat-intel match." }
  }'

Event bulk selects by an explicit event_record_identifiers list only (up to 500 per request) and supports update_status and update_assignee. Omitting the list is rejected with 400 VALIDATION_ERROR.

Both accepts return 202 with the same shape:

{ "success": true, "data": { "job_id": "be979b5c-...", "state": "queued", "accepted": 1, "status_url": "/v2/jobs/be979b5c-..." } }

Poll the job

Poll until the state leaves the in-flight set (initiated, queued, running). A few seconds between polls is plenty:

curl -s "https://api.cloudsek.com/v2/jobs/be979b5c-..." \
  -H "Authorization: Bearer $TOKEN"

{
  "success": true,
  "data": {
    "job_id": "be979b5c-...",
    "state": "completed",
    "summary": { "total": 3, "success": 1, "skipped": 0, "failed": 2 },
    "records": [
      { "incident_display_id": "XVA-24281742", "outcome": "success" },
      { "incident_display_id": "XVA-243", "outcome": "failed", "reason": "not_found" }
    ],
    "page_info": { "limit": 100, "returned": 3, "has_more": false, "next_cursor": null }
  }
}

Notes

• The summary always reconciles. total = success + skipped + failed, and every submitted record appears in records with its outcome.
• Treat skipped as success for idempotent workflows. It means the entity was already in the target state (reason already_in_target_status).
• Page large jobs. Walk records with the cursor and limit parameters, or pass outcome=failed to triage failures directly.
• Batch aggressively. Bulk submissions have a lower per-token rate budget than single writes. Prefer one large job over many small ones.

Next

After a bulk job, confirm the results with Reconciliation with snapshots.