Actions86
- RemoteAccess Actions
- Reseller Actions
- List Reseller Invoices
- Get Reseller Invoice
- List Account Usage Line Items
- List Organization Usage Line Items
- List Reseller Subscriptions
- Get Reseller Subscription
- Update Reseller Subscription
- Upgrade Reseller Subscription
- List Accounts
- Create Account
- Get Specific Account
- Update Account
- Get Agent
- Update Agent
- Uninstall Agent
- Isolate Agent
- Release Agent Isolation
- List External Ports
- Get External Port
- List Account Invoices
- Get Account Invoice
- List Incident Reports
- Get Incident Report
- List Memberships
- Create a Membership
- Get Membership
- Update a User's membership
- Delete Membership
- List Organizations
- Create an Organization
- Get Organization
- Update an Organization
- Delete an Organization
- List Remediations
- Get Remediation
- Bulk Approve Remediations
- Bulk Reject Remediations
- List Summary Reports
- List Signals
- Get Signal
- List Remote Access Connections
- Get Actor
- SIEM Actions
- Accounts Actions
- Actor Actions
- Agents Actions
- Invoices Actions
- Escalations Actions
- ExternalRecon Actions
- Identities Actions
- IncidentReports Actions
- Users Actions
- Organizations Actions
- PlatformActions Actions
- SummaryReports Actions
- Signals Actions
- UnwantedAccessRules Actions
- KnownVPNs Actions
Escalations → Create an Escalation Resolution
AI-generatedSummary
Create an escalation resolution for the specified Huntress escalation. The resolution may record whether access was expected or unauthorized and, for supported unwanted access escalations, set the scope and related access rules.
Inputs
- Id (required) — The numeric ID of the escalation to resolve.
- Determination — Choose Expected or Unauthorized. The UI describes this as applying to Unwanted Country Access and Unwanted VPN Access escalations.
- Scope — Choose identity, organization, or account to set how broadly access rules created by the resolution apply. The UI describes this as applying to Unwanted Access escalations.
- Expiration Date — When determination is Expected, sets when a subsequently created Unwanted Access Rule expires; omit it for a rule that never expires.
- IP Address — When determination is Expected, sets a specific expected IPv4 or IPv6 address at the selected scope.
- Revoke And Disable Identities — May be included with determination Unauthorized. When false, affected identities remain unaffected, while future logins are treated as unauthorized and may trigger incident reports and remediation.
- Custom Body — Optional JSON merged with the configured fields; custom body values take priority.
- Custom Headers — Additional HTTP headers to send with the request.
- Query Filters — Additional query-string parameter names and values.
- Batching — Optionally set the input batch size and delay between batches; the UI states the node makes one request per input item.
- Debug — When enabled, adds the actual request URL, query parameters, headers, and body to the output under a debug entry.
- Timeout (ms) — Request timeout for response headers; defaults to 300000 ms.
Output shape
A response from the Huntress API for each input item.
The source pack provides only function and class signatures, so it does not show the request or output handling details. The operation UI identifies the endpoint as POST /v1/escalations/{id}/resolution. Pagination settings are declared in the shared options, but the UI describes them for list operations.