---
title: "Undo a security event's remediation"
method: POST
path: "/v2/email-security/security-events/{eventId}/undo-remediation"
tags: ["Email Security"]
---

# Undo a security event's remediation

`POST /v2/email-security/security-events/{eventId}/undo-remediation`

## Request

- Base URL: `https://api.adaptivesecurity.com`
- URL: `https://api.adaptivesecurity.com/v2/email-security/security-events/{eventId}/undo-remediation`
- Auth: HTTP bearer

Restore every recipient's copy of a security event's message to where it was before it was moved to trash, spam, or quarantine. The event must be resolved with its message in trash, spam, or quarantine, its latest remediation must not have failed, and its source must be connected with read-write scopes. The undo runs asynchronously: the response reports REMEDIATING, and the event returns to NEEDS_REVIEW once every recipient's copy has been restored.

**Required permission:** `email_security:write`

## Path parameters

- `eventId` string, uuid, required

## Response `200`

Undo started

- SecurityEventRemediationUndoDto: An undo that was started for a security event's remediation
  - `id` string, uuid: The security event being restored
  - `status` 'NEEDS_REVIEW' | 'REMEDIATING' | 'RESOLVED': Review state after the request. The undo runs asynchronously; poll the security event until it is NEEDS_REVIEW

## Other responses

- `400`: The event's source is not connected or not provisioned with read-write scopes
- `401`: Unauthorized - Invalid or missing authentication token
- `403`: Missing EMAIL_SECURITY_WRITE permission, or Email Security is not available for this company
- `404`: Security event not found
- `409`: The event is not resolved, its message was not moved, or its latest remediation failed, so there is no remediation to undo
- `429`: Too many requests - Rate limit exceeded
- `500`: Internal server error

## Changes

- **2026-10-09** `1e527b1a2d31`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/changes/v2/email-security/security-events/:eventId/undo-remediation/post.md)

---

[API](https://skmtc.dev/adaptivesecurity/apis/adaptive-api.md) - [All operations](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/adaptivesecurity/apis/adaptive-api/revisions/c367e8f673f3?raw)