The VCF Operations API uses different payloads for finding, canceling, and deleting alerts. Treating those operations as interchangeable can either fail validation or broaden a cleanup beyond the alerts you intended to remove.
This follow-up corrects the API section in Bulk Delete Alerts in VCF Operations. The safe sequence is:
Query candidate alerts without changing them. Review every returned alert ID and account for pagination. Cancel only the approved IDs with a uuid-values body. Verify those IDs are now CANCELED. Delete the same IDs with a direct AlertQuery body. Query again to confirm that they are gone. Before You Begin Fix or tune the alert definition first. Deleting alert history does not stop the condition from generating new alerts. Use a VCF Operations account whose application role and object scope permit the required alert operations. Take any database backup required by your change policy before a large cleanup. Start with one small batch. The API documents a default query page size of 1,000, so a single response is not proof that you found every match. Use a trusted certificate. The examples intentionally do not bypass TLS verification. Set the appliance name, create a private working directory, and read an existing session token without placing it in shell history. Store the authorization header in a mode-600 file so the token is not expanded into each curl process argument, then remove it as soon as the cleanup is verified:
...
