--- title: "Update Finding State" method: POST path: "/api/v1/findings/{finding_id}/state" tags: ["Findings"] --- # Update Finding State `POST /api/v1/findings/{finding_id}/state` Update finding workflow state (snooze, accept risk, suppress, reopen, resolve). ## Path parameters - `finding_id` string, required — The ID of the finding whose state to update. ## Request body - C1ApiFindingV1UpdateFindingStateRequestInput — The UpdateFindingStateRequest message. This message contains a oneof named action. Only a single field of the following list may be set at a time: - snooze - suppress - acceptRisk - unsuppress - resolve - reopen - `acceptRisk` C1ApiFindingV1AcceptRiskAction — AcceptRiskAction parameters for UpdateFindingState. - `expiresAt` string, date-time, nullable - `justification` string — The justification field. - `reopen` C1ApiFindingV1ReopenAction — ReopenAction parameters for UpdateFindingState. - `resolve` C1ApiFindingV1ResolveAction — ResolveAction parameters for UpdateFindingState (manual resolve). - `reason` string — The reason field. - `snooze` C1ApiFindingV1SnoozeAction — SnoozeAction parameters for UpdateFindingState. - `reason` string — The reason field. - `snoozeUntil` string, date-time, nullable - `suppress` C1ApiFindingV1SuppressStateAction — SuppressStateAction parameters for UpdateFindingState. - `reason` string — The reason field. - `unsuppress` C1ApiFindingV1UnsuppressAction — UnsuppressAction parameters for UpdateFindingState. ## Response `200` Successful response - C1ApiFindingV1UpdateFindingStateResponse — The UpdateFindingStateResponse message. - `finding` C1ApiFindingV1Finding — The Finding message. This message contains a oneof named finding_type. Only a single field of the following list may be set at a time: - similarUsernameMatch - serviceAccountMisclassification - nhiUnowned - serviceAccountUnowned - decoyCredentialUsed - custom - connectorAnomalyDetectionDisabled - deactivatedOwner - unusedSecret - credentialPubliclyExposed - decoyPubliclyExposed - credentialExpiring This message contains a oneof named target. Only a single field of the following list may be set at a time: - identityUserTarget - appUserTarget - decoyTarget - appResourceTarget - tenantTarget - connectorTarget This message contains a oneof named evidence. Only a single field of the following list may be set at a time: - similarUsernameMatchEvidence - serviceAccountMisclassificationEvidence - deactivatedOwnerEvidence - unusedSecretEvidence - credentialPubliclyExposedEvidence - decoyPubliclyExposedEvidence - credentialExpiringEvidence - `annotations` object — Bounded key/value metadata bag. Limits: ≤16 entries; keys 1-128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0-256 chars; total serialized ≤4096 bytes. Keys matching ^c1/ are reserved. Also readable (and settable) via CEL as both finding.annotations and finding.custom_tags. - `appId` string — The appId field. - `appResourceTarget` C1ApiFindingV1AppResourceTarget — AppResourceTarget points at the app resource the finding is about. - `appId` string — The appId field. - `appResourceId` string — The appResourceId field. - `appResourceTypeId` string — The appResourceTypeId field. - `appUserTarget` C1ApiFindingV1AppUserTarget — The AppUserTarget message. - `appId` string — The appId field. - `appUserId` string — The appUserId field. - `assignedOwner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `computedOwner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. - `connectorAnomalyDetectionDisabled` C1ApiFindingV1ConnectorAnomalyDetectionDisabledType — ConnectorAnomalyDetectionDisabledType: a connector has sync anomaly detection turned off, so a sudden drop in synced data will not trip the circuit breaker. Target: ConnectorTarget. - `connectorTarget` C1ApiFindingV1ConnectorTarget — ConnectorTarget points at the connector that produced this finding. - `appId` string — The appId field. - `connectorId` string — The connectorId field. - `createdAt` string, date-time, nullable - `credentialExpiring` C1ApiFindingV1CredentialExpiringType — CredentialExpiringType: a ConductorOne-managed credential is inside the detector's expiry warning window, or already past it. Dedup is (credential arm, credential_id). Target: IdentityUserTarget -- the identity holding the credential. This message contains a oneof named credential. Only a single field of the following list may be set at a time: - userClientId - `credentialDisplayName` string — The credentialDisplayName field. - `userClientId` string, nullable — Service-principal credential. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialExpiringType` for more details. - `credentialExpiringEvidence` C1ApiFindingV1CredentialExpiringEvidence — The CredentialExpiringEvidence message. - `expired` boolean — Whether the expiry was already past when last observed. - `expiresAt` string, date-time, nullable - `credentialPubliclyExposed` C1ApiFindingV1CredentialPubliclyExposedType — CredentialPubliclyExposedType: a live credential was reported as publicly exposed. Dedup is (credential arm, credential_id). This message contains a oneof named credential. Only a single field of the following list may be set at a time: - userClientId - connectorClientId - connectorManagedCredentialId - functionClientId - `connectorClientId` string, nullable — The connectorClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details. - `connectorManagedCredentialId` string, nullable — The connectorManagedCredentialId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details. - `credentialDisplayName` string — The credentialDisplayName field. - `functionClientId` string, nullable — The functionClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details. - `userClientId` string, nullable — The userClientId field. This field is part of the `credential` oneof. See the documentation for `c1.api.finding.v1.CredentialPubliclyExposedType` for more details. - `credentialPubliclyExposedEvidence` C1ApiFindingV1CredentialPubliclyExposedEvidence — CredentialPubliclyExposedEvidence carries scanner attribution for a public exposure. - `credentialRevoked` boolean — The credentialRevoked field. - `fingerprintPrefix` string — The fingerprintPrefix field. - `firstObservedAt` string, date-time, nullable - `firstScannerId` string — The firstScannerId field. - `reportingScanners` string[], nullable — The reportingScanners field. - `revokedAt` string, date-time, nullable - `sourceKind` string — The sourceKind field. - `sourceUrl` string — The sourceUrl field. - `custom` C1ApiFindingV1CustomFindingType — CustomFindingType: a user- or integration-authored finding. The discriminator carries no payload; the finding's content lives in description / remediation_description / custom_tags. - `customSubType` string — User-supplied sub-classification for custom findings (e.g. "shadow_it"). - `customTags` object — Deprecated: use annotations instead. Read-only mirror of annotations; writes to this field are ignored. - `deactivatedOwner` C1ApiFindingV1DeactivatedOwnerType — DeactivatedOwnerType: the human responsible for a target -- either the AppUser's own correlated identity, or the ownership_v2-assigned owner of an AppResource/service-account AppUser -- is deactivated. Target: AppUserTarget or AppResourceTarget. - `source` 'DEACTIVATED_OWNER_SOURCE_UNSPECIFIED' | 'DEACTIVATED_OWNER_SOURCE_IDENTITY_CORRELATION' | 'DEACTIVATED_OWNER_SOURCE_OWNERSHIP_ASSIGNED' — The source field. - `deactivatedOwnerEvidence` C1ApiFindingV1DeactivatedOwnerEvidence — The DeactivatedOwnerEvidence message. - `deactivatedOwners` C1ApiFindingV1DeactivatedOwnerDetail[], nullable — The deactivatedOwners field. - `reason` 'DEACTIVATED_OWNER_REASON_UNSPECIFIED' | 'DEACTIVATED_OWNER_REASON_USER_DELETED' | 'DEACTIVATED_OWNER_REASON_USER_DISABLED' | 'DEACTIVATED_OWNER_REASON_EMPLOYMENT_INACTIVE' — The reason field. - `userId` string — The userId field. - `decoyCredentialUsed` C1ApiFindingV1DecoyCredentialUsedType — DecoyCredentialUsedType: a planted decoy credential authenticated successfully. - `decoyId` string — The decoyId field. - `kind` 'DECOY_CREDENTIAL_KIND_UNSPECIFIED' | 'DECOY_CREDENTIAL_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_CREDENTIAL_KIND_CONNECTOR_CLIENT' | 'DECOY_CREDENTIAL_KIND_WORKLOAD_FEDERATION' | 'DECOY_CREDENTIAL_KIND_ACCESS_TOKEN' — The kind field. - `decoyPubliclyExposed` C1ApiFindingV1DecoyPubliclyExposedType — DecoyPubliclyExposedType: a planted decoy was reported as publicly exposed. Dedup is decoy_id. - `decoyDisplayName` string — The decoyDisplayName field. - `decoyId` string — The decoyId field. - `decoyPubliclyExposedEvidence` C1ApiFindingV1DecoyPubliclyExposedEvidence — DecoyPubliclyExposedEvidence mirrors CredentialPubliclyExposedEvidence for decoys. - `credentialRevoked` boolean — The credentialRevoked field. - `fingerprintPrefix` string — The fingerprintPrefix field. - `firstObservedAt` string, date-time, nullable - `firstScannerId` string — The firstScannerId field. - `reportingScanners` string[], nullable — The reportingScanners field. - `revokedAt` string, date-time, nullable - `sourceKind` string — The sourceKind field. - `sourceUrl` string — The sourceUrl field. - `decoyTarget` C1ApiFindingV1DecoyTarget — DecoyTarget points at the planted decoy that produced this finding. Populated for findings whose subject is the decoy artifact itself (e.g. decoy_credential_used), giving the UI and routing rules a uniform handle to the decoy alongside the finding_type payload. - `decoyId` string — The decoyId field. - `dedupKeyParts` string[], nullable — Caller-supplied dedup identity for custom findings; echoed back so IaC clients can roundtrip it. Empty for detector findings. - `description` string — User-authored finding body (markdown by convention). Set for custom findings. - `fingerprint` string — The fingerprint field. - `firstObservedAt` string, date-time, nullable - `id` string — The id field. - `identityUserTarget` C1ApiFindingV1IdentityUserTarget — The IdentityUserTarget message. - `identityUserId` string — The identityUserId field. - `lastAppearedAt` string, date-time, nullable - `lastObservedAt` string, date-time, nullable - `nhiUnowned` C1ApiFindingV1NhiUnownedType — NhiUnownedType: an AppResource with a non-human-identity type has no primary owner. Target: AppResourceTarget (the unowned NHI resource). - `recurrenceCount` integer — The recurrenceCount field. - `remediationDescription` string — The remediationDescription field. - `resolvedAt` string, date-time, nullable - `riskAcceptanceExpiresAt` string, date-time, nullable - `riskAcceptanceJustification` string — The riskAcceptanceJustification field. - `riskScore` C1ApiFindingV1FindingRiskScore — The FindingRiskScore message. - `originalScore` integer — The originalScore field. - `overrideByUserId` string — The overrideByUserId field. - `overrideScore` integer — The overrideScore field. - `riskFactors` C1ApiFindingV1FindingRiskFactor[], nullable — The riskFactors field. - `description` string — The description field. - `name` string — The name field. - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field. - `weight` integer — The weight field. - `score` integer — The score field. - `systemScore` integer — The systemScore field. - `serviceAccountMisclassification` C1ApiFindingV1ServiceAccountMisclassificationType — The ServiceAccountMisclassificationType message. - `currentAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The currentAccountType field. - `detectedAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The detectedAccountType field. - `serviceAccountMisclassificationEvidence` C1ApiFindingV1ServiceAccountMisclassificationEvidence — The ServiceAccountMisclassificationEvidence message. - `detectionReason` string — The detectionReason field. - `serviceAccountUnowned` C1ApiFindingV1ServiceAccountUnownedType — ServiceAccountUnownedType: a service-account-classified AppUser has no primary owner. Target: AppUserTarget (the unowned service account). - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field. - `similarUsernameMatch` C1ApiFindingV1SimilarUsernameMatchType — The SimilarUsernameMatchType message. - `proposedIdentityUserId` string — The proposedIdentityUserId field. - `similarUsernameMatchEvidence` C1ApiFindingV1SimilarUsernameMatchEvidence — The SimilarUsernameMatchEvidence message. - `appUsername` string — The appUsername field. - `identityUsername` string — The identityUsername field. - `similarityScore` number — The similarityScore field. - `snoozeReason` string — The snoozeReason field. - `snoozeUntil` string, date-time, nullable - `sourceDetectorId` string — The sourceDetectorId field. - `sourceKind` 'FINDING_SOURCE_KIND_UNSPECIFIED' | 'FINDING_SOURCE_KIND_DETECTOR' | 'FINDING_SOURCE_KIND_EXTERNAL' — Who authored the finding (detector, user, external). - `state` 'FINDING_STATE_UNSPECIFIED' | 'FINDING_STATE_OPEN' | 'FINDING_STATE_IN_PROGRESS' | 'FINDING_STATE_RESOLVED' | 'FINDING_STATE_SNOOZED' | 'FINDING_STATE_RISK_ACCEPTED' | 'FINDING_STATE_SUPPRESSED' — The state field. - `stateUpdatedById` string — The stateUpdatedById field. - `suppressReason` string — The suppressReason field. - `taskId` string — The taskId field. - `tenantTarget` C1ApiFindingV1TenantTarget — TenantTarget scopes a finding to the whole tenant. It carries no subject id; the finding's tenant is the scope. - `unusedSecret` C1ApiFindingV1UnusedSecretType — UnusedSecretType: a secret-trait AppResource has not been used in over the detector's staleness threshold. Target: AppResourceTarget. - `unusedSecretEvidence` C1ApiFindingV1UnusedSecretEvidence — The UnusedSecretEvidence message. - `lastUsedAt` string, date-time, nullable - `updatedAt` string, date-time, nullable --- [API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)