---
title: "Bulk update security tests"
method: POST
path: "/security-tests/bulk-update"
tags: ["SecurityTests", "Beta"]
---

# Bulk update security tests

`POST /security-tests/bulk-update`

## Request

- Base URL: `https://public.escape.tech/v3`
- URL: `https://public.escape.tech/v3/security-tests/bulk-update`
- Auth: API key in header `X-ESCAPE-API-KEY`

Update the organization configuration of multiple security tests matching a filter predicate: enable or disable them, and/or override the severity assigned to their issues. Requires organization admin rights. A non-empty `where` or `all: true` is required. Set `dryRun` to preview the matching security test IDs without changing anything. When `enabled` is omitted, each matched test keeps the enabled state read at the start of the request; a concurrent change to the same test may therefore be overwritten. Pass `customSeverity: null` to reset the override to the scanner default.

## Request body

- object
  - `enabled` boolean: The new enabled state to apply
  - `customSeverity` 'CRITICAL' | 'HIGH' | 'INFO' | 'LOW' | 'MEDIUM' | 'null', nullable: The new severity override to apply. Pass null to reset to the scanner default. Omit to leave the current override unchanged.
  - `where` object: Filter predicate. Required unless `all` is true.
    - `ids` string[]: Filter by specific security test IDs
    - `search` string: Filter by name substring
    - `enabled` boolean: Filter by enabled state
    - `scannerKinds` string[]: Filter by scanner kinds
    - `categories` string[]: Filter by categories
    - `assetTypes` string[]: Filter by asset types
    - `compliances` string[]: Filter by compliance frameworks
    - `complianceItems` string[]: Filter by compliance items
  - `all` boolean: Set to true to target every security test. Mutually exclusive with a non-empty `where`.
  - `dryRun` boolean: Return the matching security test IDs and count without updating anything

## Response `200`

OK

- object
  - `ids` string[], required: IDs of the updated security tests (or matching security tests on dry run)
  - `count` integer, required: Number of security test IDs in `ids`
  - `dryRun` boolean, required: Whether this was a preview with no update applied

## Other responses

- `400`: Bad Request
- `403`: Forbidden

---

[API](https://skmtc.dev/escape/apis/escape-public-api.md) - [All operations](https://skmtc.dev/escape/apis/escape-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/escape/apis/escape-public-api/revisions/2eab35df40c7?raw)