---
title: "Bulk Create Finding Tasks"
method: POST
path: "/api/v1/findings/bulk/tasks"
tags: ["Findings"]
---

# Bulk Create Finding Tasks

`POST /api/v1/findings/bulk/tasks`

Bulk create tasks for findings.

## Request body

- C1ApiFindingV1BulkCreateFindingTasksRequest — The BulkCreateFindingTasksRequest message.
  - `policyId` string — Optional policy ID to use for the created tasks. Defaults to the app's grant policy.
  - `refs` C1ApiFindingV1FindingRef[], nullable — Individual finding references to create tasks for (by-ID mode).
    - `id` string — The ID of the finding.
  - `searchRequest` C1ApiFindingV1FindingSearchRequest — The FindingSearchRequest message.
    - `appIds` string[], nullable — Filter by app IDs (OR within field).
    - `appResourceIds` string[], nullable — Filter by app resource IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_id is in this list. An app resource is app-scoped, so pair with app_ids (and app_resource_type_ids) to hit the composite (tenant_id, app_id, app_resource_type_id, app_resource_id) index.
    - `appResourceTraitIds` string[], nullable — Filter to findings whose target resource's type carries any of these traits (e.g. the builtin agent / secret trait ids). OR within field; empty = not applied.
    - `appResourceTypeIds` string[], nullable — Filter by app resource type IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_type_id is in this list.
    - `appUserIds` string[], nullable — Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list.
    - `appUserTypes` string[], nullable — Filter to findings whose target is an app user of these types (OR within field). Empty = not applied.
    - `connectorIds` string[], nullable — Filter by connector IDs (OR within field). Matches findings whose target.connector_target.connector_id is in this list.
    - `customSubTypes` string[], nullable — Filter by custom sub-type (OR within field). Matches custom findings whose custom_sub_type equals any listed value.
    - `decoyIds` string[], nullable — Filter by decoy IDs (OR within field). Matches findings whose target.decoy_target.decoy_id is in this list.
    - `findingTypes` string[], nullable — Filter by finding type (OR within field).
    - `includeUnassigned` boolean — When true, includes findings with no effective identity-user owner. An explicit predicate for direct API callers who prefer a bool over the "unassigned" sentinel in owner_identity_user_ids; both signals are accepted.
    - `nhiTypes` string[], nullable — Filter to findings whose target resource's nhi_type is one of these (OR within field). Empty = not applied; pass all NhiType values to match any nhi resource.
    - `ownerIdentityUserIds` string[], nullable — Filter by effective owner identity-user IDs (OR within field). Matches findings whose effective owner (assigned_owner if set, else computed_owner) resolves to an identity user in this list. The reserved "unassigned" sentinel token selects findings with no effective identity-user owner; real identity-user IDs are exactly 27 alphanumerics so the token cannot collide.
    - `pageSize` integer — Maximum number of findings to return per page.
    - `pageToken` string — Pagination token from a previous response.
    - `query` string — Free text search query.
    - `refs` C1ApiFindingV1FindingRef[], nullable — Restrict results to these finding refs by ID (OR within field). Backs the websocket-notify re-query, which refetches just the changed finding(s) to patch a row in place or detect it dropping out of the filter; empty = not applied. Hits the (tenant_id, id) primary key.
      - `id` string — The ID of the finding.
    - `scopeToAppOwner` boolean — When true, restricts results to findings for apps you own. The caller is resolved from request credentials (no user id is read from the request), so results are always limited to your own apps.
    - `severities` string[], nullable — Filter by severities (OR within field).
    - `sourceKinds` string[], nullable — Filter by source kind (OR within field).
    - `states` string[], nullable — Filter by states (OR within field).

## Response `200`

Successful response

- C1ApiFindingV1BulkCreateFindingTasksResponse — The BulkCreateFindingTasksResponse message.
  - `bulkActionId` string — The ID of the asynchronous bulk action, which can be used to track progress.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)