---
title: "Change the triage state of a security signal"
method: PATCH
path: "/api/v1/security_analytics/signals/{signal_id}/state"
tags: ["Security Monitoring"]
deprecated: true
---

# Change the triage state of a security signal

`PATCH /api/v1/security_analytics/signals/{signal_id}/state`

> **Deprecated.**

This endpoint is deprecated - Change the triage state of a security signal.

## Path parameters

- `signal_id` string, required

## Request body

- SignalStateUpdateRequest — Attributes describing the change of state for a given state.
  - `archiveComment` string — Optional comment to explain why a signal is being archived.
  - `archiveReason` 'none' | 'false_positive' | 'testing_or_maintenance' | 'investigated_case_opened' | 'true_positive_benign' | 'true_positive_malicious' | 'other' — Reason why a signal has been archived.
  - `state` 'open' | 'archived' | 'under_review', required — The new triage state of the signal.
  - `version` integer — Version of the updated signal. If server side version is higher, update will be rejected.

## Response `200`

OK

- SuccessfulSignalUpdateResponse — Updated signal data following a successfully performed update.
  - `status` string — Status of the response.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v1.md) · [All operations](https://skmtc.dev/datadog/apis/api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v1/revisions/ca5871004d26/schema)