API reference

Alerts

Alerts raised in the workspace and security events; acknowledge, resolve, dismiss.

POSTTriage alerts in bulk
GETList alerts
POSTAcknowledge an alert
POSTDismiss an alert
POSTMark an alert read
POSTReopen an alert
POSTResolve an alert
GETList security events
POSTAcknowledge a security event
POSTDismiss a security event
POSTReopen a security event
POSTResolve a security event

Triage alerts in bulk

POST/v0/tenants/{tenant_id}/alerts:triage

full-access token

Applies one triage action to up to 200 alerts and/or security events. All ids are checked first: if any is unknown, nothing changes (invalid-items). Alerts whose current status does not allow the action — or a dismiss without a valid reason / required note — are skipped and reported in results; the others change. Each change is audited and streamed to your SIEM.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Request body application/json

itemsarray of objectrequired
1-200 alerts (items beyond 200 are ignored).
items fields
- kindstringrequired
  One of: notification, security_event.
- idstringrequired
actionstringrequired
One of: acknowledge, resolve, dismiss, reopen.
reasonstring
Required for dismiss.
One of: false_positive, expected_activity, benign, duplicate, accepted_risk.
notestring
Up to 1000 characters. Required for dismiss of bad alerts.
assigneestring
For acknowledge: who owns them. Default: the caller.

Responses

200 What happened to each alert.

application/json

actionstringrequired
One of: acknowledge, resolve, dismiss, reopen.
doneintegerrequired
Alerts that changed state.
skippedintegerrequired
Alerts left as they were (see results[].error).
resultsarray of objectrequired
results fields
- kindstring
  One of: notification, security_event.
- idstring
- okboolean
- errorstring | null
  Why this alert was skipped, for example "this alert is resolved; acknowledge works from new".
- statusstring
  The alert's status after the call.
  One of: new, acknowledged, resolved, dismissed.

400 items-required invalid-action invalid-items

items-required: items is missing or empty.

invalid-action: action is not acknowledge, resolve, dismiss or reopen.

invalid-items: One or more items were not found (see errors[] with the item index); nothing was changed.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/alerts:triage" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "items": [
    {
      "kind": "security_event",
      "id": "sev_9x2k0m8s1d"
    },
    {
      "kind": "notification",
      "id": "ntf_4k2x9m0s8d"
    }
  ],
  "action": "dismiss",
  "reason": "duplicate",
  "note": "Same incident as SOC ticket 4411."
}'

PowerShell

$body = @'
{
  "items": [
    {
      "kind": "security_event",
      "id": "sev_9x2k0m8s1d"
    },
    {
      "kind": "notification",
      "id": "ntf_4k2x9m0s8d"
    }
  ],
  "action": "dismiss",
  "reason": "duplicate",
  "note": "Same incident as SOC ticket 4411."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/alerts:triage" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/alerts:triage",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "items": [
            {
                "kind": "security_event",
                "id": "sev_9x2k0m8s1d"
            },
            {
                "kind": "notification",
                "id": "ntf_4k2x9m0s8d"
            }
        ],
        "action": "dismiss",
        "reason": "duplicate",
        "note": "Same incident as SOC ticket 4411."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/alerts:triage", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "items": [
      {
        "kind": "security_event",
        "id": "sev_9x2k0m8s1d"
      },
      {
        "kind": "notification",
        "id": "ntf_4k2x9m0s8d"
      }
    ],
    "action": "dismiss",
    "reason": "duplicate",
    "note": "Same incident as SOC ticket 4411."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "action": "dismiss",
  "done": 1,
  "skipped": 1,
  "results": [
    {
      "kind": "security_event",
      "id": "sev_9x2k0m8s1d",
      "ok": true,
      "error": null,
      "status": "dismissed"
    },
    {
      "kind": "notification",
      "id": "ntf_4k2x9m0s8d",
      "ok": false,
      "error": "this alert is resolved; dismiss works from new / acknowledged",
      "status": "resolved"
    }
  ]
}

List alerts

GET/v0/tenants/{tenant_id}/notifications

read-only token

Returns the console alerts (the bell in the Cloudraw console): connector health, device trust changes, access requests, security events and more, newest first, each with its triage state. Not paginated: use limit (at most 500) and the filters.

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Query parameters

unreadstring
Only alerts not yet marked read.
Example: true
statusstring
Triage filter: open (= new + acknowledged, the work queue), all (default), or a comma-separated list of statuses (new,acknowledged,resolved,dismissed).
Example: open
sortstring
severity = high severity first (then newest). Default: newest first.
limitinteger
Maximum items, newest first. Default 100, at most 500.
Example: 100

Responses

200 The alerts.

application/json

itemsarray of Notificationrequired
items fields
- idstringrequired
- severitystringrequired
  bad = high severity.
  One of: info, warn, bad.
- categorystringrequired
  Usually one of security, connector_health, device, access, billing, system, app_firewall, files; a few events carry a more specific category (for example trust, identity, support).
- actionstring | null
  Machine-readable event name, for example jit_request.create, platform_alert.firing, security_event. Null on older alerts.
- dataobject | null
  Event-specific ids (for example { "grant": "…" }, { "event": "sev_…" }).
- messagestringrequired
  Human-readable text, up to 400 characters.
- viewstring | null
  Console page the alert links to (for example soc, connectors, jit).
- paramstring | null
  Optional parameter for that page.
- readbooleanrequired
  Marked read in the console inbox. Acknowledging, resolving or dismissing also marks it read.
- created_atstring (date-time)required
- triageAlertTriagerequired
  Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
  triage fields
  - statusstringrequired
    new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
    One of: new, acknowledged, resolved, dismissed.
  - assigneestring | null
    Who owns the alert (set on acknowledge).
  - acknowledged_bystring | null
  - acknowledged_atstring | null (date-time)
  - resolutionobject | null
    How the alert was closed; null while it is open.
    resolution fields
    kindstring
    One of: resolved, dismissed.
    reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
    notestring | null
    bystring
    atstring (date-time)
  - suppressed_bystring | null
    Id of the suppression rule that auto-dismissed this alert, if any.
  - historyarray of object
    The last 20 triage steps, oldest first.
    history fields
    atstring (date-time)
    bystring
    Who made the change.
    actionstring
    One of: acknowledge, resolve, dismiss, reopen.
    fromstring
    One of: new, acknowledged, resolved, dismissed.
    tostring
    One of: new, acknowledged, resolved, dismissed.
    reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
    notestring | null
- resolvedboolean
  True only for a sign-up request that was since approved or declined (the alert describes a state that is over).
- resolved_atstring | null (date-time)
- resolutionstring
  Only on resolved sign-up requests.
  One of: approved, declined.
unreadintegerrequired
Unread alerts in the whole workspace (not only this page).
next_pagenull
Always null: the list is bounded by limit (at most 500, newest first).

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "items": [
    {
      "id": "ntf_4k2x9m0s8d",
      "severity": "bad",
      "category": "security",
      "action": "security_event",
      "data": {
        "event": "sev_9x2k0m8s1d"
      },
      "message": "Blocked: Port scan from unmanaged device",
      "view": "soc",
      "param": null,
      "read": false,
      "created_at": "2026-10-13T09:24:11.000Z",
      "triage": {
        "status": "new",
        "assignee": null,
        "acknowledged_by": null,
        "acknowledged_at": null,
        "resolution": null,
        "suppressed_by": null,
        "history": []
      },
      "resolved": false,
      "resolved_at": null
    }
  ],
  "unread": 3,
  "next_page": null
}

Acknowledge an alert

POST/v0/tenants/{tenant_id}/notifications/{notification_id}/acknowledge

full-access token

Takes ownership of a new alert: status becomes acknowledged and assignee is set (the caller unless you name someone). The step is added to the alert's triage history, written to the audit log and streamed to your SIEM destinations. The alert is also marked read. Triage never deletes an alert.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
notification_idstringrequired
Alert (notification) id.
Example: ntf_4k2x9m0s8d

Request body application/json

assigneestring
Who owns it (up to 160 characters). Default: the caller.
notestring
Up to 1000 characters.

Responses

200 The alert with its new triage state.

application/json

idstringrequired
kindstringrequired
One of: notification, security_event.
severitystring
One of: info, warn, bad.
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 notification-not-found tenant-not-found

notification-not-found: No alert with this id.

tenant-not-found: No workspace with this id.

409 invalid-transition

invalid-transition: The alert is not new.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/acknowledge" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "assignee": "omer.katz@example.com"
}'

PowerShell

$body = @'
{
  "assignee": "omer.katz@example.com"
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/acknowledge" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/acknowledge",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "assignee": "omer.katz@example.com"
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/acknowledge", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "assignee": "omer.katz@example.com"
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "ntf_4k2x9m0s8d",
  "kind": "notification",
  "severity": "bad",
  "triage": {
    "status": "acknowledged",
    "assignee": "dana.levi@example.com",
    "acknowledged_by": "dana.levi@example.com",
    "acknowledged_at": "2026-10-13T09:24:11.000Z",
    "resolution": null,
    "suppressed_by": null,
    "history": [
      {
        "at": "2026-10-13T09:24:11.000Z",
        "by": "dana.levi@example.com",
        "action": "acknowledge",
        "from": "new",
        "to": "acknowledged",
        "reason": null,
        "note": null
      }
    ]
  }
}

Dismiss an alert

POST/v0/tenants/{tenant_id}/notifications/{notification_id}/dismiss

full-access token

Closes a new or acknowledged alert as not needing action (status dismissed). A reason is required, and a note too when the alert severity is bad. The step is added to the alert's triage history, written to the audit log and streamed to your SIEM destinations. The alert is also marked read. Triage never deletes an alert.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
notification_idstringrequired
Alert (notification) id.
Example: ntf_4k2x9m0s8d

Request body application/json

reasonstringrequired
One of: false_positive, expected_activity, benign, duplicate, accepted_risk.
notestring
Why (up to 1000 characters). Required when the alert severity is bad.

Responses

200 The alert with its new triage state.

application/json

idstringrequired
kindstringrequired
One of: notification, security_event.
severitystring
One of: info, warn, bad.
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null

400 reason-required note-required

reason-required: reason is missing or not one of the allowed values.

note-required: The alert severity is bad and no note was given.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 notification-not-found tenant-not-found

notification-not-found: No alert with this id.

tenant-not-found: No workspace with this id.

409 invalid-transition

invalid-transition: The alert is already resolved or dismissed.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/dismiss" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "expected_activity",
  "note": "Quarterly penetration test by our vendor."
}'

PowerShell

$body = @'
{
  "reason": "expected_activity",
  "note": "Quarterly penetration test by our vendor."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/dismiss" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/dismiss",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "reason": "expected_activity",
        "note": "Quarterly penetration test by our vendor."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/dismiss", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "reason": "expected_activity",
    "note": "Quarterly penetration test by our vendor."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "ntf_4k2x9m0s8d",
  "kind": "notification",
  "severity": "bad",
  "triage": {
    "status": "dismissed",
    "assignee": null,
    "acknowledged_by": null,
    "acknowledged_at": null,
    "resolution": {
      "kind": "dismissed",
      "reason": "expected_activity",
      "note": "Quarterly penetration test by our vendor.",
      "by": "dana.levi@example.com",
      "at": "2026-10-13T09:24:11.000Z"
    },
    "suppressed_by": null,
    "history": [
      {
        "at": "2026-10-13T09:24:11.000Z",
        "by": "dana.levi@example.com",
        "action": "dismiss",
        "from": "new",
        "to": "dismissed",
        "reason": "expected_activity",
        "note": null
      }
    ]
  }
}

Mark an alert read

POST/v0/tenants/{tenant_id}/notifications/{notification_id}/read

full-access token

Marks one alert read in the console inbox. Does not change its triage status. Not audited.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
notification_idstringrequired
Alert (notification) id.
Example: ntf_4k2x9m0s8d

Responses

200 The alert.

application/json

idstringrequired
severitystringrequired
bad = high severity.
One of: info, warn, bad.
categorystringrequired
Usually one of security, connector_health, device, access, billing, system, app_firewall, files; a few events carry a more specific category (for example trust, identity, support).
actionstring | null
Machine-readable event name, for example jit_request.create, platform_alert.firing, security_event. Null on older alerts.
dataobject | null
Event-specific ids (for example { "grant": "…" }, { "event": "sev_…" }).
messagestringrequired
Human-readable text, up to 400 characters.
viewstring | null
Console page the alert links to (for example soc, connectors, jit).
paramstring | null
Optional parameter for that page.
readbooleanrequired
Marked read in the console inbox. Acknowledging, resolving or dismissing also marks it read.
created_atstring (date-time)required
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null
resolvedboolean
True only for a sign-up request that was since approved or declined (the alert describes a state that is over).
resolved_atstring | null (date-time)
resolutionstring
Only on resolved sign-up requests.
One of: approved, declined.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 notification-not-found tenant-not-found

notification-not-found: No alert with this id.

tenant-not-found: No workspace with this id.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/read" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/read" -Headers $headers

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/read",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/read", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "ntf_4k2x9m0s8d",
  "severity": "bad",
  "category": "security",
  "action": "security_event",
  "data": {
    "event": "sev_9x2k0m8s1d"
  },
  "message": "Blocked: Port scan from unmanaged device",
  "view": "soc",
  "param": null,
  "read": true,
  "created_at": "2026-10-13T09:24:11.000Z",
  "triage": {
    "status": "new",
    "assignee": null,
    "acknowledged_by": null,
    "acknowledged_at": null,
    "resolution": null,
    "suppressed_by": null,
    "history": []
  },
  "resolved": false,
  "resolved_at": null
}

Reopen an alert

POST/v0/tenants/{tenant_id}/notifications/{notification_id}/reopen

full-access token

Puts a resolved or dismissed alert back to new and clears its resolution. The step is added to the alert's triage history, written to the audit log and streamed to your SIEM destinations. Triage never deletes an alert.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
notification_idstringrequired
Alert (notification) id.
Example: ntf_4k2x9m0s8d

Request body application/json

notestring
Up to 1000 characters.

Responses

200 The alert with its new triage state.

application/json

idstringrequired
kindstringrequired
One of: notification, security_event.
severitystring
One of: info, warn, bad.
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 notification-not-found tenant-not-found

notification-not-found: No alert with this id.

tenant-not-found: No workspace with this id.

409 invalid-transition

invalid-transition: The alert is not resolved or dismissed.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/reopen" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "note": "Recurred after the fix."
}'

PowerShell

$body = @'
{
  "note": "Recurred after the fix."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/reopen" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/reopen",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "note": "Recurred after the fix."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/reopen", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "note": "Recurred after the fix."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "ntf_4k2x9m0s8d",
  "kind": "notification",
  "severity": "bad",
  "triage": {
    "status": "new",
    "assignee": null,
    "acknowledged_by": null,
    "acknowledged_at": null,
    "resolution": null,
    "suppressed_by": null,
    "history": [
      {
        "at": "2026-10-13T09:24:11.000Z",
        "by": "dana.levi@example.com",
        "action": "reopen",
        "from": "resolved",
        "to": "new",
        "reason": null,
        "note": "Recurred after the fix."
      }
    ]
  }
}

Resolve an alert

POST/v0/tenants/{tenant_id}/notifications/{notification_id}/resolve

full-access token

Closes a new or acknowledged alert as handled (status resolved). The step is added to the alert's triage history, written to the audit log and streamed to your SIEM destinations. The alert is also marked read. Triage never deletes an alert.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
notification_idstringrequired
Alert (notification) id.
Example: ntf_4k2x9m0s8d

Request body application/json

notestring
Up to 1000 characters.

Responses

200 The alert with its new triage state.

application/json

idstringrequired
kindstringrequired
One of: notification, security_event.
severitystring
One of: info, warn, bad.
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 notification-not-found tenant-not-found

notification-not-found: No alert with this id.

tenant-not-found: No workspace with this id.

409 invalid-transition

invalid-transition: The alert is already resolved or dismissed.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/resolve" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "note": "Device re-encrypted; access works again."
}'

PowerShell

$body = @'
{
  "note": "Device re-encrypted; access works again."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/resolve" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/resolve",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "note": "Device re-encrypted; access works again."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/notifications/ntf_4k2x9m0s8d/resolve", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "note": "Device re-encrypted; access works again."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "ntf_4k2x9m0s8d",
  "kind": "notification",
  "severity": "bad",
  "triage": {
    "status": "resolved",
    "assignee": null,
    "acknowledged_by": null,
    "acknowledged_at": null,
    "resolution": {
      "kind": "resolved",
      "reason": null,
      "note": "Device re-encrypted; access works again.",
      "by": "dana.levi@example.com",
      "at": "2026-10-13T09:24:11.000Z"
    },
    "suppressed_by": null,
    "history": [
      {
        "at": "2026-10-13T09:24:11.000Z",
        "by": "dana.levi@example.com",
        "action": "resolve",
        "from": "new",
        "to": "resolved",
        "reason": null,
        "note": null
      }
    ]
  }
}

List security events

GET/v0/tenants/{tenant_id}/security-events

read-only token

Returns the Security Center feed: denied access attempts, blocked or quarantined file transfers and other enforcement events, newest first, with their triage state and workspace-wide counters. Not paginated: use limit (at most 500) and the filters. The workspace keeps its newest 2000 events.

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Query parameters

categorystring
Only this category (for example blocked, files).
Example: blocked
sincestring (date-time)
Only events at or after this time (ISO 8601, UTC, as returned in at).
Example: 2026-10-13T00:00:00.000Z
statusstring
Triage filter: open (= new + acknowledged, the work queue), all (default), or a comma-separated list of statuses (new,acknowledged,resolved,dismissed).
Example: open
limitinteger
Maximum items, newest first. Default 100, at most 500.
Example: 100

Responses

200 The events.

application/json

itemsarray of SecurityEventrequired
items fields
- idstringrequired
- atstring (date-time)required
- categorystringrequired
  blocked (denied access attempt, the default), files (a file transfer that was blocked, held or quarantined) or another short category, up to 40 characters.
- severitystringrequired
  One of: info, warn, bad.
- actorstring | null
  The person (e-mail or name) behind the attempt.
- devicestring | null
  Device name.
- target_appstring | null
  Application or resource that was targeted.
- reasonstring | null
  Why it was blocked, up to 300 characters.
- fileobject
  Only on files events.
  file fields
  - pathstring | null
  - sha256string | null
  - quarantine_idstring | null
  - opstring | null
    read or write.
  - verdictstring | null
    blocked, held, quarantined, error …
  - codestring | null
  - fixstring | null
    Suggested fix.
- triageAlertTriagerequired
  Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
  triage fields
  - statusstringrequired
    new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
    One of: new, acknowledged, resolved, dismissed.
  - assigneestring | null
    Who owns the alert (set on acknowledge).
  - acknowledged_bystring | null
  - acknowledged_atstring | null (date-time)
  - resolutionobject | null
    How the alert was closed; null while it is open.
    resolution fields
    kindstring
    One of: resolved, dismissed.
    reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
    notestring | null
    bystring
    atstring (date-time)
  - suppressed_bystring | null
    Id of the suppression rule that auto-dismissed this alert, if any.
  - historyarray of object
    The last 20 triage steps, oldest first.
    history fields
    atstring (date-time)
    bystring
    Who made the change.
    actionstring
    One of: acknowledge, resolve, dismiss, reopen.
    fromstring
    One of: new, acknowledged, resolved, dismissed.
    tostring
    One of: new, acknowledged, resolved, dismissed.
    reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
    notestring | null
countsobjectrequired
Workspace-wide counters, independent of the filters.
counts fields
- todayinteger
  Events since midnight (server time).
- today_blockedinteger
  blocked events since midnight.
- openinteger
  Events that are new or acknowledged.
- newinteger
  Events not yet triaged.
next_pagenull
Always null: the list is bounded by limit (at most 500, newest first). The workspace keeps the newest 2000 security events.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "items": [
    {
      "id": "sev_9x2k0m8s1d",
      "at": "2026-10-13T09:24:11.000Z",
      "category": "blocked",
      "severity": "warn",
      "actor": "dana.levi@example.com",
      "device": "LAPTOP-7Q2M",
      "target_app": "finance-erp",
      "reason": "Device posture: disk encryption off",
      "triage": {
        "status": "new",
        "assignee": null,
        "acknowledged_by": null,
        "acknowledged_at": null,
        "resolution": null,
        "suppressed_by": null,
        "history": []
      }
    }
  ],
  "counts": {
    "today": 14,
    "today_blocked": 11,
    "open": 6,
    "new": 4
  },
  "next_page": null
}

Acknowledge a security event

POST/v0/tenants/{tenant_id}/security-events/{event_id}/acknowledge

full-access token

Takes ownership of a new alert: status becomes acknowledged and assignee is set (the caller unless you name someone). The step is added to the security event's triage history, written to the audit log and streamed to your SIEM destinations. Triage never deletes an event (the workspace keeps its newest 2000 security events).

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
event_idstringrequired
Security event id.
Example: sev_9x2k0m8s1d

Request body application/json

assigneestring
Who owns it (up to 160 characters). Default: the caller.
notestring
Up to 1000 characters.

Responses

200 The alert with its new triage state.

application/json

idstringrequired
kindstringrequired
One of: notification, security_event.
severitystring
One of: info, warn, bad.
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 security-event-not-found tenant-not-found

security-event-not-found: No security event with this id.

tenant-not-found: No workspace with this id.

409 invalid-transition

invalid-transition: The alert is not new.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/acknowledge" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "assignee": "omer.katz@example.com"
}'

PowerShell

$body = @'
{
  "assignee": "omer.katz@example.com"
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/acknowledge" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/acknowledge",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "assignee": "omer.katz@example.com"
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/acknowledge", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "assignee": "omer.katz@example.com"
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "sev_9x2k0m8s1d",
  "kind": "security_event",
  "severity": "warn",
  "triage": {
    "status": "acknowledged",
    "assignee": "dana.levi@example.com",
    "acknowledged_by": "dana.levi@example.com",
    "acknowledged_at": "2026-10-13T09:24:11.000Z",
    "resolution": null,
    "suppressed_by": null,
    "history": [
      {
        "at": "2026-10-13T09:24:11.000Z",
        "by": "dana.levi@example.com",
        "action": "acknowledge",
        "from": "new",
        "to": "acknowledged",
        "reason": null,
        "note": null
      }
    ]
  }
}

Dismiss a security event

POST/v0/tenants/{tenant_id}/security-events/{event_id}/dismiss

full-access token

Closes a new or acknowledged alert as not needing action (status dismissed). A reason is required, and a note too when the alert severity is bad. The step is added to the security event's triage history, written to the audit log and streamed to your SIEM destinations. Triage never deletes an event (the workspace keeps its newest 2000 security events).

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
event_idstringrequired
Security event id.
Example: sev_9x2k0m8s1d

Request body application/json

reasonstringrequired
One of: false_positive, expected_activity, benign, duplicate, accepted_risk.
notestring
Why (up to 1000 characters). Required when the alert severity is bad.

Responses

200 The alert with its new triage state.

application/json

idstringrequired
kindstringrequired
One of: notification, security_event.
severitystring
One of: info, warn, bad.
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null

400 reason-required note-required

reason-required: reason is missing or not one of the allowed values.

note-required: The alert severity is bad and no note was given.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 security-event-not-found tenant-not-found

security-event-not-found: No security event with this id.

tenant-not-found: No workspace with this id.

409 invalid-transition

invalid-transition: The alert is already resolved or dismissed.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/dismiss" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "reason": "expected_activity",
  "note": "Quarterly penetration test by our vendor."
}'

PowerShell

$body = @'
{
  "reason": "expected_activity",
  "note": "Quarterly penetration test by our vendor."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/dismiss" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/dismiss",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "reason": "expected_activity",
        "note": "Quarterly penetration test by our vendor."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/dismiss", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "reason": "expected_activity",
    "note": "Quarterly penetration test by our vendor."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "sev_9x2k0m8s1d",
  "kind": "security_event",
  "severity": "warn",
  "triage": {
    "status": "dismissed",
    "assignee": null,
    "acknowledged_by": null,
    "acknowledged_at": null,
    "resolution": {
      "kind": "dismissed",
      "reason": "expected_activity",
      "note": "Quarterly penetration test by our vendor.",
      "by": "dana.levi@example.com",
      "at": "2026-10-13T09:24:11.000Z"
    },
    "suppressed_by": null,
    "history": [
      {
        "at": "2026-10-13T09:24:11.000Z",
        "by": "dana.levi@example.com",
        "action": "dismiss",
        "from": "new",
        "to": "dismissed",
        "reason": "expected_activity",
        "note": null
      }
    ]
  }
}

Reopen a security event

POST/v0/tenants/{tenant_id}/security-events/{event_id}/reopen

full-access token

Puts a resolved or dismissed alert back to new and clears its resolution. The step is added to the security event's triage history, written to the audit log and streamed to your SIEM destinations. Triage never deletes an event (the workspace keeps its newest 2000 security events).

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
event_idstringrequired
Security event id.
Example: sev_9x2k0m8s1d

Request body application/json

notestring
Up to 1000 characters.

Responses

200 The alert with its new triage state.

application/json

idstringrequired
kindstringrequired
One of: notification, security_event.
severitystring
One of: info, warn, bad.
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 security-event-not-found tenant-not-found

security-event-not-found: No security event with this id.

tenant-not-found: No workspace with this id.

409 invalid-transition

invalid-transition: The alert is not resolved or dismissed.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/reopen" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "note": "Recurred after the fix."
}'

PowerShell

$body = @'
{
  "note": "Recurred after the fix."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/reopen" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/reopen",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "note": "Recurred after the fix."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/reopen", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "note": "Recurred after the fix."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "sev_9x2k0m8s1d",
  "kind": "security_event",
  "severity": "warn",
  "triage": {
    "status": "new",
    "assignee": null,
    "acknowledged_by": null,
    "acknowledged_at": null,
    "resolution": null,
    "suppressed_by": null,
    "history": [
      {
        "at": "2026-10-13T09:24:11.000Z",
        "by": "dana.levi@example.com",
        "action": "reopen",
        "from": "resolved",
        "to": "new",
        "reason": null,
        "note": "Recurred after the fix."
      }
    ]
  }
}

Resolve a security event

POST/v0/tenants/{tenant_id}/security-events/{event_id}/resolve

full-access token

Closes a new or acknowledged alert as handled (status resolved). The step is added to the security event's triage history, written to the audit log and streamed to your SIEM destinations. Triage never deletes an event (the workspace keeps its newest 2000 security events).

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
event_idstringrequired
Security event id.
Example: sev_9x2k0m8s1d

Request body application/json

notestring
Up to 1000 characters.

Responses

200 The alert with its new triage state.

application/json

idstringrequired
kindstringrequired
One of: notification, security_event.
severitystring
One of: info, warn, bad.
triageAlertTriagerequired
Triage state. Alerts are never deleted: they are acknowledged, resolved or dismissed, and every step is kept here, written to the audit log and streamed to your SIEM.
triage fields
- statusstringrequired
  new → acknowledged → resolved | dismissed; resolved and dismissed alerts can be reopened (back to new).
  One of: new, acknowledged, resolved, dismissed.
- assigneestring | null
  Who owns the alert (set on acknowledge).
- acknowledged_bystring | null
- acknowledged_atstring | null (date-time)
- resolutionobject | null
  How the alert was closed; null while it is open.
  resolution fields
  - kindstring
    One of: resolved, dismissed.
  - reasonstring | null
    Dismiss reason: false_positive, expected_activity, benign, duplicate, accepted_risk, or suppressed (auto-dismissed by a suppression rule). Null when resolved.
  - notestring | null
  - bystring
  - atstring (date-time)
- suppressed_bystring | null
  Id of the suppression rule that auto-dismissed this alert, if any.
- historyarray of object
  The last 20 triage steps, oldest first.
  history fields
  - atstring (date-time)
  - bystring
    Who made the change.
  - actionstring
    One of: acknowledge, resolve, dismiss, reopen.
  - fromstring
    One of: new, acknowledged, resolved, dismissed.
  - tostring
    One of: new, acknowledged, resolved, dismissed.
  - reasonstring | null
    Dismiss reason (suppressed when a suppression rule dismissed it).
  - notestring | null

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 security-event-not-found tenant-not-found

security-event-not-found: No security event with this id.

tenant-not-found: No workspace with this id.

409 invalid-transition

invalid-transition: The alert is already resolved or dismissed.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/resolve" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "note": "Device re-encrypted; access works again."
}'

PowerShell

$body = @'
{
  "note": "Device re-encrypted; access works again."
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/resolve" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/resolve",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "note": "Device re-encrypted; access works again."
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/security-events/sev_9x2k0m8s1d/resolve", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "note": "Device re-encrypted; access works again."
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "sev_9x2k0m8s1d",
  "kind": "security_event",
  "severity": "warn",
  "triage": {
    "status": "resolved",
    "assignee": null,
    "acknowledged_by": null,
    "acknowledged_at": null,
    "resolution": {
      "kind": "resolved",
      "reason": null,
      "note": "Device re-encrypted; access works again.",
      "by": "dana.levi@example.com",
      "at": "2026-10-13T09:24:11.000Z"
    },
    "suppressed_by": null,
    "history": [
      {
        "at": "2026-10-13T09:24:11.000Z",
        "by": "dana.levi@example.com",
        "action": "resolve",
        "from": "new",
        "to": "resolved",
        "reason": null,
        "note": null
      }
    ]
  }
}