---
title: "Update one or several alerts"
method: POST
path: "/update"
tags: ["Alert"]
---

# Update one or several alerts

`POST /update`

## Request

- Base URL: `api.recordedfuture.com/alert/v2` (relative, and the document’s source URL is not known)
- URL: `api.recordedfuture.com/alert/v2/update`
- Auth: API key in header `X-RFToken`

Updates one or several alerts. It's possible to update assignee, status and a note tied to the triggered alert.

There are two types of statuses, the recommended "statusInPortal" and the legacy "status". They are mapped, so changing one will change the other and it is not possible to update both independently.

## Request body

- object[]
  - `id` string, required: Id of the alert to update
  - `assignee` string: New assignee. Can be an id, uhash, username or email.
  - `note` string: New note text
  - `status` 'unassigned' | 'assigned' | 'pending' | 'dismiss' | 'no-action' | 'actionable' | 'tuning': New alert status (legacy)
  - `statusInPortal` 'New' | 'Resolved' | 'Pending' | 'Dismissed' | 'Flag for Tuning': New alert status

## Response `200`

A partial view of the updated alert(s). If any alert update fails, errors will be included as well.

- AlertUpdateResponse
  - `success` object[]: A list of updated alerts
    - `id` string, required: Id of the updated alert
    - `status` 'unassigned' | 'assigned' | 'pending' | 'dismiss' | 'no-action' | 'actionable' | 'tuning', required: Updated status (legacy)
    - `statusInPortal` 'New' | 'Resolved' | 'Pending' | 'Dismissed' | 'Flag for Tuning', required: Updated status
    - `assignee` string: Updated assignee id
    - `note` object: Updated note
      - `text` string, required: Note text
      - `author` string, required: Note author id
      - `date` string, date-time, required: Note publish date
    - `reviewDate` string, date-time: Date of when the alert was last reviewed
    - `statusDate` string, date-time: Date of when the alert last had a status update
    - `statusChangeBy` string: Id of the user that performed the status update
  - `error` object[]: A list of alerts that failed to update
    - `id` string, required: Id of the alert that failed to update
    - `reason` string, required: Error message why the alert failed to update
    - `statusCode` integer, required: Error status code

## Changes

- **2026-11-03** `46a67c0859e1`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/recordedfuture/apis/alert-api/changes/update/post.md)

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/alert-api/revisions/46a67c0859e1?raw)