Triage a security finding

PATCH/v1/security/findings/{findingId}

Risk acceptance requires a reason and a future expiration. State transitions are validated and written to the security audit log.

How to call this endpoint

Every ACP API request uses bearer authentication. The examples here show the actual request path, auth header, and body shape that the platform expects.

Path, query, and header parameters

These parameters control which ACP object the endpoint acts on and how the request is processed.

Path parameters
NameLocationTypeRequiredDescription
findingIdpathstringYesSecurity finding ID
Query parameters
None.
Header parameters
NameLocationTypeRequiredDescription
X-Computer-Agents-OrganizationheaderstringNoActive organization context. If omitted, the authenticated user's personal organization is used.

Body schema

Content type: application/json · Required

FieldTypeRequiredDescription
statusopen | accepted | risk_accepted | false_positive | fixedYesCurrent lifecycle status.
reasonstringNo
expiresAtstringNo
assignedToUserIdstringNo

What the API returns

Each response code below includes the documented payload shape for the ACP API.

200Updated findingapplication/json
FieldTypeRequiredDescription
idstringYesUnique identifier.
repositoryIdstringYes
repositoryFullNamestringNo
fingerprintstringYes
ruleIdstringNo
titlestringYesDisplay title.
summarystringYes
severitycritical | high | medium | low | informationalYes
confidencenumberYes
exploitabilitystringNo
cwestring[]No
cvssnumberNo
statusopen | accepted | risk_accepted | false_positive | fixedYesCurrent lifecycle status.
firstSeenRunIdstringNo
lastSeenRunIdstringNo
assignedToUserIdstringNo
resolutionReasonstringNo
resolutionExpiresAtstringNo
fixedAtstringNo
metadataobjectNoFree-form metadata object.
occurrenceCountintegerYes
createdAtstringYesISO 8601 timestamp.
updatedAtstringYesISO 8601 timestamp.
404Resource not foundapplication/json
FieldTypeRequiredDescription
errorstringNo
409Invalid finding state transition
None.
Triage a security finding
Loading...
Response 200
Loading...
See the ACP quickstart and SDK flow