Radar

Mark finds or signals

POSThttps://traceeai.com/api/v1/radar/mark

CLI:tracee radar mark·MCP:radaraction mark

Authorizations

Authorizationstringheaderrequired
Bearer <key>: a personal key (tracee login or Settings → Personal keys), a workspace key, or an MCP client's OAuth token. See Authentication.

Headers

Tracee-Workspacestring
For a personal key or OAuth token that reaches several workspaces: the workspace id to act on. Workspace keys don't need it.
uuid

Body

application/json

idsstring[]required
Finds or signals From GET /api/v1/radar/findings or GET /api/v1/radar/signals.
up to 200 itemseach uuid
statusstringrequired
The status
Available options:newseensavedcontacteddismissed

Response

Errors

200Done.
The action's result, exactly as the MCP tool returns it to agents. A next field, when present, names the endpoint that follows up.

Mark finds or signals

curl -X POST "https://traceeai.com/api/v1/radar/mark" \
  -H "Authorization: Bearer $TRACEE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "ids": [
      "<signal_id>"
    ],
    "status": "saved"
  }'

{
  "…": "The action's result, as the MCP tool returns it"
}