---
title: "Bulk Update Finding State"
method: POST
path: "/api/v1/findings/bulk/state"
tags: ["Findings"]
---

# Bulk Update Finding State

`POST /api/v1/findings/bulk/state`

Bulk update finding states.

## Request body

- C1ApiFindingV1BulkUpdateFindingStateRequest — The BulkUpdateFindingStateRequest message. This message contains a oneof named action. Only a single field of the following list may be set at a time: - snooze - suppress - acceptRisk - unsuppress - assignOwner - reopen
  - `acceptRisk` C1ApiFindingV1BulkAcceptRiskAction — The BulkAcceptRiskAction message.
    - `expiresAt` string, date-time, nullable
    - `justification` string — The justification field.
  - `assignOwner` C1ApiFindingV1BulkAssignOwnerAction — The BulkAssignOwnerAction message.
    - `owner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId
      - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
  - `refs` C1ApiFindingV1FindingRef[], nullable — By-ID mode: specify individual finding refs.
    - `id` string — The ID of the finding.
  - `reopen` C1ApiFindingV1BulkReopenAction — The BulkReopenAction message.
  - `searchRequest` C1ApiFindingV1FindingSearchRequest — The FindingSearchRequest message.
    - `appIds` string[], nullable — Filter by app IDs (OR within field).
    - `appResourceIds` string[], nullable — Filter by app resource IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_id is in this list. An app resource is app-scoped, so pair with app_ids (and app_resource_type_ids) to hit the composite (tenant_id, app_id, app_resource_type_id, app_resource_id) index.
    - `appResourceTraitIds` string[], nullable — Filter to findings whose target resource's type carries any of these traits (e.g. the builtin agent / secret trait ids). OR within field; empty = not applied.
    - `appResourceTypeIds` string[], nullable — Filter by app resource type IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_type_id is in this list.
    - `appUserIds` string[], nullable — Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list.
    - `appUserTypes` string[], nullable — Filter to findings whose target is an app user of these types (OR within field). Empty = not applied.
    - `connectorIds` string[], nullable — Filter by connector IDs (OR within field). Matches findings whose target.connector_target.connector_id is in this list.
    - `customSubTypes` string[], nullable — Filter by custom sub-type (OR within field). Matches custom findings whose custom_sub_type equals any listed value.
    - `decoyIds` string[], nullable — Filter by decoy IDs (OR within field). Matches findings whose target.decoy_target.decoy_id is in this list.
    - `findingTypes` string[], nullable — Filter by finding type (OR within field).
    - `includeUnassigned` boolean — When true, includes findings with no effective identity-user owner. An explicit predicate for direct API callers who prefer a bool over the "unassigned" sentinel in owner_identity_user_ids; both signals are accepted.
    - `nhiTypes` string[], nullable — Filter to findings whose target resource's nhi_type is one of these (OR within field). Empty = not applied; pass all NhiType values to match any nhi resource.
    - `ownerIdentityUserIds` string[], nullable — Filter by effective owner identity-user IDs (OR within field). Matches findings whose effective owner (assigned_owner if set, else computed_owner) resolves to an identity user in this list. The reserved "unassigned" sentinel token selects findings with no effective identity-user owner; real identity-user IDs are exactly 27 alphanumerics so the token cannot collide.
    - `pageSize` integer — Maximum number of findings to return per page.
    - `pageToken` string — Pagination token from a previous response.
    - `query` string — Free text search query.
    - `refs` C1ApiFindingV1FindingRef[], nullable — Restrict results to these finding refs by ID (OR within field). Backs the websocket-notify re-query, which refetches just the changed finding(s) to patch a row in place or detect it dropping out of the filter; empty = not applied. Hits the (tenant_id, id) primary key.
      - `id` string — The ID of the finding.
    - `scopeToAppOwner` boolean — When true, restricts results to findings for apps you own. The caller is resolved from request credentials (no user id is read from the request), so results are always limited to your own apps.
    - `severities` string[], nullable — Filter by severities (OR within field).
    - `sourceKinds` string[], nullable — Filter by source kind (OR within field).
    - `states` string[], nullable — Filter by states (OR within field).
  - `snooze` C1ApiFindingV1BulkSnoozeAction — The BulkSnoozeAction message.
    - `reason` string — The reason field.
    - `snoozeUntil` string, date-time, nullable
  - `suppress` C1ApiFindingV1BulkSuppressAction — The BulkSuppressAction message.
    - `reason` string — The reason field.
  - `unsuppress` C1ApiFindingV1BulkUnsuppressAction — The BulkUnsuppressAction message.

## Response `200`

Successful response

- C1ApiFindingV1BulkUpdateFindingStateResponse — The BulkUpdateFindingStateResponse message.
  - `bulkActionId` string — The ID of the asynchronous bulk action, which can be used to track progress.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)