---
title: "Remediate a security event"
method: POST
path: "/v2/email-security/security-events/{eventId}/remediate"
tags: ["Email Security"]
---

# Remediate a security event

`POST /v2/email-security/security-events/{eventId}/remediate`

## Request

- Base URL: `https://api.adaptivesecurity.com`
- URL: `https://api.adaptivesecurity.com/v2/email-security/security-events/{eventId}/remediate`
- Auth: HTTP bearer

Move every recipient's copy of a security event's message to trash, spam, or quarantine. The event must be awaiting review, its source connected, and remediation enabled for the company. Remediation runs asynchronously: the response reports REMEDIATING, and the event reaches RESOLVED once every recipient has been remediated.

**Required permission:** `email_security:write`

## Path parameters

- `eventId` string, uuid, required

## Request body

- RemediateSecurityEventRequestDto: A remediation to apply to every recipient of a security event's message
  - `action` 'DELETE' | 'MARK_AS_SAFE' | 'MARK_AS_SPAM' | 'MOVE_TO_SPAM' | 'QUARANTINE', nullable, required: Where to move every recipient's copy of the message, or how to mark the event. MARK_AS_SAFE and MARK_AS_SPAM relabel the event without moving any message
  - `remediate_future_similar_messages` boolean: Arm this message's campaign so similar messages arriving later are remediated automatically with the same action. The event must belong to a campaign. Similar messages already received are remediated only when remediate_similar_messages is set. Only DELETE, MOVE_TO_SPAM and QUARANTINE accept it
  - `remediate_similar_messages` boolean: Apply the same action to every similar message already in this message's campaign. Messages that arrive later are not affected. A campaign can include a message that was itself judged safe, which this remediates along with the rest and which similar_security_event_ids on the security event does not list. Only DELETE, MOVE_TO_SPAM and QUARANTINE accept it

## Response `200`

Remediation started

- SecurityEventRemediationDto: A remediation that was started for a security event
  - `action` 'DELETE' | 'MARK_AS_SAFE' | 'MARK_AS_SPAM' | 'MOVE_TO_SPAM' | 'QUARANTINE': The remediation that was started
  - `future_similar_messages_armed` boolean: Whether the campaign was armed to remediate similar messages arriving later. False unless remediate_future_similar_messages was requested
  - `id` string, uuid: The remediated security event
  - `remediated_similar_security_event_ids` string[]: The similar messages' security events the action was also started for, excluding this one. Empty unless remediate_similar_messages was requested
  - `status` 'NEEDS_REVIEW' | 'REMEDIATING' | 'RESOLVED': Review state after the request. Remediation runs asynchronously; poll the security event until it is RESOLVED

## Other responses

- `400`: Missing or unknown action, the event's source or company settings do not allow the remediation, remediate_future_similar_messages was requested for an event with no campaign, MARK_AS_SPAM was requested while remediation is enabled, a similar-message option was set with MARK_AS_SAFE or MARK_AS_SPAM, or a spam event was sent MARK_AS_SPAM, a similar-message option, or a request while spam remediation is not enabled
- `401`: Unauthorized - Invalid or missing authentication token
- `403`: Missing EMAIL_SECURITY_WRITE permission, or Email Security is not available for this company
- `404`: Security event not found
- `409`: The event is no longer awaiting review because it was already remediated or marked
- `500`: Internal server error

## Changes

- **2026-10-09** `1e527b1a2d31`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/changes/v2/email-security/security-events/:eventId/remediate/post.md)

---

[API](https://skmtc.dev/adaptivesecurity/apis/adaptive-api.md) - [All operations](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/revisions/c367e8f673f3?raw)