DELETE suppliers/{supplier}/indicators
April 11, 2024
ID 198660
Deletes the specified indicators from a supplier, including InternalTI and FalsePositive suppliers.
Only indicators from suppliers created with the REST API, as well as from InternalTI and FalsePositive suppliers, can be deleted with this request.
Path
/api/%API_VERSION%/suppliers/{supplier}/indicators
Method
DELETE
Request headers
This request has the following headers.
Request headers
Name | Value | Description |
|---|---|---|
|
| |
|
| Response content type. |
|
| Request content type. You can also specify the |
|
| Request body size, in bytes. The maximum body size for this request is 64 MB ( |
Request parameters
This request has the following parameters:
Request parameters
Name | Parameter type | Description |
|---|---|---|
| Path | Name of the supplier. |
Request body
This request body contains a JSON array of indicator objects.
[
{
"indicator":"%INDICATOR_VALUE_1%",
},
...
{
"indicator":"%INDICATOR_VALUE_N%",
}
]
Indicator object properties are described in the following table.
Indicator object properties
Property | Value | Mandatory | Description |
|---|---|---|---|
|
| Yes | An indicator that must be deleted. You can specify the following indicator types:
|
unmark_detections | boolean | No | Available starting with REST API 1.2. Flag that removes the indicator-related detections from false positives. This parameter is applied only if the value of supplier specified in a request path is When using REST API 1.2, include the |
Request example
The following is an example of a DELETE suppliers/{supplier}/indicators request.
DELETE https://192.0.2.57/api/1.1/
Accept: application/json Content-Type: application/json Authorization: Basic Content-Length: 77
[ {"indicator":"tux.example.com"}, {"indicator":"malicious.example.com"} ] |
The following is an example of a DELETE suppliers/{supplier}/indicators request with the unmark_detections parameter applied to the FalsePositive supplier.
DELETE https://192.0.2.57/api/1.2/suppliers/FalsePositive/indicators Accept: application/json Content-Type: application/json Authorization: Basic dXNlcjpwYXNzd29yZA== Content-Length: 110
[ { "indicator":"DC212B238A5A7C0A9DF7BF298546A154", "unmark_detections": false }, ... ]
|
Response headers
The response has the following headers.
Response headers
Name | Value | Description |
|---|---|---|
Content-Type |
| Response content type. |
Content-Length |
| Response body size, in bytes. |
Response body
The response body contains a JSON object with a status of the operation.
[
{
"status": "All indicators were successfully deleted from the database"
}
]
Status object properties are described in the following table.
Status object properties
Property | Value | Description |
|---|---|---|
|
| Status of the operation. |
Response example
The following is an example of a DELETE suppliers/{supplier}/indicators request response.
НТТР/1.1 201 ОК Date:Mon, 23 Dec 2019 09:56:10 UTC Content-Type: application/json Content-Length: 74
[{"status": "All indicators were successfully deleted from the database"}] |
Partial success response
This response is generated when not all indicators were successfully deleted.
The response body contains the partial success object with the status of the operation and an array of indicator error objects:
[
{
"status": "An error occurred while deleting some of the indicators from the database",
"error_indicators":[
{
"indicator": "%INDICATOR_VALUE_1%",
"reason": "%REASON%"
},
...
{
"indicator": "%INDICATOR_VALUE_N%",
"reason": "%REASON%"
}
]
}
]
Partial success object properties are described in the following table.
Partial success object properties
Property | Value | Description |
|---|---|---|
|
| Status of the operation. |
| Indicator error objects | Array of information about indicators that were not deleted. |
Indicator error object properties are described in the following table.
Indicator error object properties
Property | Value | Description |
|---|---|---|
|
| Indicator that was not deleted. |
|
| Cause of the error. This property may not be present in the response. |
Partial success response example
The following is an example of a partial success response for the DELETE suppliers/{supplier}/indicators request.
НТТР/1.1 202 Partial success Date:Mon, 23 Dec 2019 09:56:10 UTC Content-Type: application/json Content-Length: 251
[{"status": "An error occurred while deleting some of the indicators from the database","error_indicators":[{"indicator":"bad.example.com", "reason": "Indicator doesn't exist"},{"indicator":"bad2\.example.com", "reason": "Invalid indicator format"}]}] |
Error responses
An error response contains information about the response status.
An error response contains a JSON object with the error description.
[
{
"status": "An error occurred while deleting indicators from the database",
}
]
Error object properties are described in the following table.
Error object properties
Property | Value | Description |
|---|---|---|
|
| Error description. |
Error response example
The following is an example of a PUT suppliers/{supplier} error response.
HTTP/1.1 500 Internal Server Error Date:Mon, 23 Dec 2019 09:56:10 UTC Content-Type: application/json Content-Length: 77
[{"status": "An error occurred while deleting indicators from the database"}] |
