> ## Documentation Index > Fetch the complete documentation index at: https://developer.vanta.com/llms.txt > Use this file to discover all available pages before exploring further. # Update vendor security incident alerts > Resolves or reopens 1–100 security incident alerts in a single request. Set the resolution state to RESOLVED to resolve alerts or OPEN to reopen them. This doesn’t change an alert’s confirmation status. Duplicate IDs are updated once, and the response lists each alert once, in the order it first appears in alertIds. If any alert isn’t found in your organization, the request fails and no alerts change. Requires continuous monitoring. ## OpenAPI ````yaml /reference/manage-vanta.json patch /vendor-security-incident-alerts openapi: 3.0.0 info: title: Manage Vanta version: 1.0.0 description: >- The REST API lets customers query and mutate Vanta's data. Use this API to automate bulk actions, query data for custom workflows and dashboards, and bolster your security operations **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)` from the server dropdown to issue requests against `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the commercial host — replace it with `https://api.vanta-gov.com/oauth/token`. termsOfService: https://www.vanta.com/terms license: name: UNLICENSED contact: name: API Support url: https://help.vanta.com/ email: support@vanta.com servers: - url: https://api.vanta.com/v1 description: Vanta (Commercial) - url: https://api.vanta-gov.com/v1 description: Vanta Gov (FedRAMP) security: [] paths: /vendor-security-incident-alerts: patch: tags: - Vendor Security Incident Alerts summary: Update vendor security incident alerts description: >- Resolves or reopens 1–100 security incident alerts in a single request. Set the resolution state to RESOLVED to resolve alerts or OPEN to reopen them. This doesn’t change an alert’s confirmation status. Duplicate IDs are updated once, and the response lists each alert once, in the order it first appears in alertIds. If any alert isn’t found in your organization, the request fails and no alerts change. Requires continuous monitoring. operationId: UpdateVendorSecurityIncidentAlerts parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateVendorSecurityIncidentAlertsInput' responses: '200': description: Ok content: application/json: schema: $ref: >- #/components/schemas/UpdateVendorSecurityIncidentAlertsResponse examples: Example 1: value: results: - id: 68f620000000000000000010 resolutionState: RESOLVED createdAt: '2026-10-20T12:00:00.000Z' updatedAt: '2026-10-20T13:00:00.000Z' affectedVendorIds: - 68f620000000000000000002 relatedVendorIds: [] status: CONFIRMED title: Confirmed unauthorized access at Example Vendor rootCause: COMPROMISED_CREDENTIALS threatActor: name: Unknown evidence: [] impact: severity: HIGH context: Customer credentials were exposed. affectedParties: - CUSTOMERS dataLeakStatus: CONFIRMED consequences: - type: DATA_LEAK dataCategories: - CREDENTIALS severity: HIGH timeline: - type: INCIDENT_DETECTION occurredAt: '2026-10-19T12:00:00.000Z' security: - bearerAuth: [] components: schemas: UpdateVendorSecurityIncidentAlertsInput: properties: alertIds: items: type: string type: array description: >- IDs of the security incident alerts to update. Use each alert’s ID, not the ID of the incident it reports. Every alert must belong to your organization. minItems: 1 maxItems: 100 resolutionState: $ref: '#/components/schemas/VendorSecurityIncidentAlertResolutionState' description: >- Target resolution state for every supplied alert. Use OPEN to reopen. required: - alertIds - resolutionState type: object additionalProperties: false UpdateVendorSecurityIncidentAlertsResponse: properties: results: items: $ref: '#/components/schemas/VendorSecurityIncidentAlert' type: array description: Updated alerts, once per ID, in first-occurrence request order. required: - results type: object additionalProperties: false VendorSecurityIncidentAlertResolutionState: type: string enum: - OPEN - RESOLVED VendorSecurityIncidentAlert: properties: id: type: string description: Organization-specific alert ID. resolutionState: $ref: '#/components/schemas/VendorSecurityIncidentAlertResolutionState' createdAt: type: string format: date-time updatedAt: type: string format: date-time affectedVendorIds: items: type: string type: array relatedVendorIds: items: type: string type: array status: $ref: '#/components/schemas/VendorSecurityIncidentAlertStatus' title: type: string rootCause: $ref: '#/components/schemas/VendorSecurityIncidentAlertRootCause' threatActor: $ref: '#/components/schemas/VendorSecurityIncidentAlertThreatActor' evidence: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertPublicUrlEvidence' type: array impact: $ref: '#/components/schemas/VendorSecurityIncidentAlertImpact' timeline: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertTimelineEvent' type: array required: - id - resolutionState - createdAt - updatedAt - affectedVendorIds - relatedVendorIds - status - title - rootCause - threatActor - evidence - impact - timeline type: object additionalProperties: false VendorSecurityIncidentAlertStatus: type: string enum: - POTENTIAL - CONFIRMED - SUSPECTED VendorSecurityIncidentAlertRootCause: type: string enum: - UNSPECIFIED - PHISHING - COMPROMISED_CREDENTIALS - VENDOR_PARTNER_COMPROMISE - ZERO_DAY_VULNERABILITY - KNOWN_VULNERABILITY - MISCONFIGURATION - INSIDER_THREAT - DDOS_ATTACK - PHYSICAL_ACCESS - PUBLICLY_EXPOSED_SENSITIVE_INTERFACE - NOT_DISCLOSED VendorSecurityIncidentAlertThreatActor: properties: name: type: string required: - name type: object additionalProperties: false VendorSecurityIncidentAlertPublicUrlEvidence: properties: id: type: string type: type: string enum: - PUBLIC_URL_EVIDENCE nullable: false contentCategory: $ref: >- #/components/schemas/VendorSecurityIncidentAlertEvidenceContentCategory url: type: string required: - id - type - contentCategory - url type: object additionalProperties: false VendorSecurityIncidentAlertImpact: properties: severity: $ref: '#/components/schemas/VendorSecurityIncidentAlertImpactSeverity' context: type: string affectedParties: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertAffectedParty' type: array dataLeakStatus: $ref: '#/components/schemas/VendorSecurityIncidentAlertDataLeakStatus' consequences: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertConsequence' type: array required: - severity - context - affectedParties - dataLeakStatus - consequences type: object additionalProperties: false VendorSecurityIncidentAlertTimelineEvent: properties: type: $ref: '#/components/schemas/VendorSecurityIncidentAlertTimelineEventType' occurredAt: type: string format: date-time required: - type - occurredAt type: object additionalProperties: false VendorSecurityIncidentAlertEvidenceContentCategory: type: string enum: - SEC - LEGAL - DATA_BREACH - GENERAL - EVIDENCE_OF_COMPROMISE - CLAIM_POST - PACKAGE_REGISTRY_PAGE - REGULATORY_FILING - VENDOR_NOTES - PUBLIC_NEWS_DISCUSSION VendorSecurityIncidentAlertImpactSeverity: type: string enum: - UNSPECIFIED - CRITICAL - HIGH - MEDIUM - LOW VendorSecurityIncidentAlertAffectedParty: type: string enum: - CUSTOMERS - EMPLOYEES - THIRD_PARTIES - MIXED - UNKNOWN VendorSecurityIncidentAlertDataLeakStatus: type: string enum: - UNSPECIFIED - UNKNOWN - OBSERVED - CONFIRMED VendorSecurityIncidentAlertConsequence: anyOf: - $ref: >- #/components/schemas/VendorSecurityIncidentAlertDenialOfServiceConsequence - $ref: >- #/components/schemas/VendorSecurityIncidentAlertUnauthorizedAccessConsequence - $ref: '#/components/schemas/VendorSecurityIncidentAlertDataLeakConsequence' VendorSecurityIncidentAlertTimelineEventType: type: string enum: - INITIAL_ACCESS - HACKER_DISCLOSURE - INCIDENT_DETECTION - DATA_BREACH_NOTIFICATION - SEC_FILING - LAWSUIT_FILING VendorSecurityIncidentAlertDenialOfServiceConsequence: title: VendorSecurityIncidentAlertDenialOfServiceConsequence properties: type: type: string enum: - DENIAL_OF_SERVICE nullable: false required: - type type: object additionalProperties: false VendorSecurityIncidentAlertUnauthorizedAccessConsequence: title: VendorSecurityIncidentAlertUnauthorizedAccessConsequence properties: type: type: string enum: - UNAUTHORIZED_ACCESS nullable: false required: - type type: object additionalProperties: false VendorSecurityIncidentAlertDataLeakConsequence: title: VendorSecurityIncidentAlertDataLeakConsequence properties: type: type: string enum: - DATA_LEAK nullable: false dataCategories: items: $ref: '#/components/schemas/VendorSecurityIncidentAlertDataCategory' type: array severity: $ref: '#/components/schemas/VendorSecurityIncidentAlertDataLeakSeverity' required: - type - dataCategories - severity type: object additionalProperties: false VendorSecurityIncidentAlertDataCategory: type: string enum: - PII - PHI - FINANCIAL - CREDENTIALS - INTELLECTUAL_PROPERTY VendorSecurityIncidentAlertDataLeakSeverity: type: string enum: - UNSPECIFIED - CRITICAL - HIGH - MEDIUM - LOW securitySchemes: bearerAuth: type: http scheme: bearer ```` ## Related topics - [List vendor security incident alerts](https://developer.vanta.com/api-reference/vendor-security-incident-alerts/list-vendor-security-incident-alerts.md) - [Get vendor security incident alert by ID](https://developer.vanta.com/api-reference/vendor-security-incident-alerts/get-vendor-security-incident-alert-by-id.md) - [Update vendor alert settings](https://developer.vanta.com/api-reference/vendor-alert-settings/update-vendor-alert-settings.md) - [Update vendor alerts](https://developer.vanta.com/api-reference/vendor-alerts/update-vendor-alerts.md) - [Get vendor alert](https://developer.vanta.com/api-reference/vendor-alerts/get-vendor-alert.md)