> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create Remediation Incident

Create a remediation incident by Message ID, File hash or a URL contained in an Email.

Required application permissions: `Services | Threat Remediation | Edit`.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [Mimecast documentation](https://developer.services.mimecast.com/docs/threatmanagement/1/routes/api/ttp/remediation/v2/create/post).

## Basic Parameters

| Parameter | Description |
| - | - |
| File Hash | The file hash contained in the email that should be remediated. |
| Incident Type | The type of the identifier to remediate by. |
| Message IDs | A comma separated or JSON list of message IDs of the emails that should be remediated. |
| Reason | The reason of the remediation. |
| URL | An URL present in the email that should be remediated. |

## Advanced Parameters

| Parameter | Description |
| - | - |
| End Time | Time of the most recent message to be remediated. |
| Start Time | Time of the earliest message to be remediated. |

## Example Output

```json theme={"dark"}
{
	"fail": [],
	"meta": {
		"status": 200
	},
	"data": [
		{
			"code": "String",
			"create": "String",
			"failed": "String",
			"fileRemediationCanBeCancelled": true,
			"fileRemediationCancelled": "string",
			"fileRemediationExpiryTime": "string",
			"id": "string",
			"identified": 1,
			"modified": "string",
			"reason": "string",
			"remediatedBy": "string",
			"removeFromDevice": "string",
			"restored": 1,
			"searchCriteria": {},
			"successful": 1,
			"type": "string"
		}
	]
}
```