Execute a remediation
POST
/remediations/{kind}
Supported kinds:
resolve-dlp-alert — resolve (close) a DLP alertafter triage, recording the classification and propagating the
resolution to the source provider (e.g. Microsoft Purview) when a
provider integration is connected; its target_id is the Anzenna
detection id of the alert (see query_key_finding_detections) and
classification is required.
revoke-encrypted-email — withdraw recipient access to a MicrosoftPurview encrypted message. Identify it with target_id, the outbound
email id from query_outbound_email_events; for mail Exchange knows
about before ingestion has listed it, send the RFC 5322 header in
message_id and in target_id. Revocation is per message,
not per recipient, so it settles every row sharing that Message-ID.
Only mail delivered through the encryption portal can be withdrawn —
a message that opened inline in a Microsoft 365 or Outlook.com
recipient's client has no link to revoke. The outcome is asynchronous:
the response reports the remediation was accepted, and the result
lands on that email's remediation lifecycle.
Request
Path Params
Body Params application/jsonRequired
Responses
Request Request Example
Shell
JavaScript
Java
Swift
curl --location '/remediations/' \
--header 'Content-Type: application/json' \
--data-raw '{
"classification": "false_positive",
"comment": "string",
"message_id": "<DS7PR11MB7906@DS7PR11MB7906.namprd11.prod.outlook.com>",
"target_id": "8CA67511-744C-4D74-B26E-7281CF88712F"
}'Response Response Example
{
"kind": "string",
"message": "string",
"provider_propagation": "queued",
"state": "accepted",
"target_id": "string"
}Modified at 2026-10-20 18:32:30