CAIN-42 CAIN Studio

API reference · CAIN Sentinel

Contain Incident

POST /fabric/sentinel/incidents/{incident_id}/contain

Last reviewed 2026-10-02

POST /fabric/sentinel/incidents/{incident_id}/contain

Contain incident - isolate affected entities.

CAIN Control: IS THAT RESPONSE AUTHORIZED?

Parameters

NameInTypeMeaning
incident_id requiredpathstring

Request body

ContainRequest (required)

FieldTypeMeaning
tenant requiredstring
actionstringdefault "contain"

Responses

StatusMeaningBody
200Successful ResponseJSON
422Validation ErrorHTTPValidationError
401No key, or a key that is not validJSON detail
429Rate limit for your plan reached; retry after the Retry-After secondsJSON detail

Try it

This call changes data in the account the key belongs to.

The request goes from your browser straight to this site. Your key is not stored unless you tick the box, and then only in this tab's session storage.

Code

curl -sS -X POST 'https://cainstudio.online/fabric/sentinel/incidents/<incident_id>/contain' \
  -H "X-API-Key: $CAIN_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"tenant": "tenant", "action": "contain"}'

Schemas used

ContainRequest · HTTPValidationError · ValidationError

← Close Incident · all 19 CAIN Sentinel calls · Get Incident Evidence →

Try CAIN-42 on your own agents

Create a free account and every new account starts with a 7-day trial of the full platform. Or try the sandbox first, with no account at all.

Create a free account →  ·  Try the sandbox  ·  See the whole ecosystem