---
title: "Deletes IOCs from IOC Set"
method: DELETE
path: "/threatintel/v1/ioc-sets/{iocsetid}/iocs"
tags: ["Threat Intel"]
---

# Deletes IOCs from IOC Set

`DELETE /threatintel/v1/ioc-sets/{iocsetid}/iocs`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threatintel/v1/ioc-sets/{iocsetid}/iocs`
- Auth: API key in header `Authorization`

Delete IOCs from the specified IOC Set.

## Path parameters

- `iocsetid` integer, required

## Request body

- DeleteIocsRequestBody
  - `deleteReason` string: Reasion for deletion.
  - `iocIDs` integer[]: IOC ID that needs to be deleted. A maximum of 10 IOCs can be deleted in one delete request.

## Response `200`

- DeleteIocsResponse

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal error.

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)