---
title: "Update Finding Settings"
method: POST
path: "/api/v1/findings/settings/update"
tags: ["Finding Settings"]
---

# Update Finding Settings

`POST /api/v1/findings/settings/update`

Enable or disable detection for one or more finding types in a single
 write. Enabling a type whose detector is a scheduled job also queues an
 immediate run.

## Request body

- C1ApiFindingV1UpdateFindingSettingsRequest — The UpdateFindingSettingsRequest message.
  - `settings` C1ApiFindingV1FindingSettingsEntry[], nullable — Applied as one atomic write, so an admin changing several types either lands all of them or none. Empty is valid: a never-configured tenant's "accept the defaults" save has nothing to diff, and the empty write still creates the settings row.
    - `enabled` boolean, nullable — Target state. Required: explicit presence keeps an omitted field from reading as false and silently switching a detector off.
    - `findingType` 'FINDING_TYPE_UNSPECIFIED' | 'FINDING_TYPE_SIMILAR_USERNAME_MATCH' | 'FINDING_TYPE_SERVICE_ACCOUNT_MISCLASSIFICATION' | 'FINDING_TYPE_NHI_UNOWNED' | 'FINDING_TYPE_SERVICE_ACCOUNT_UNOWNED' | 'FINDING_TYPE_DECOY_CREDENTIAL_USED' | 'FINDING_TYPE_CUSTOM' | 'FINDING_TYPE_CONNECTOR_ANOMALY_DETECTION_DISABLED' | 'FINDING_TYPE_DEACTIVATED_OWNER' | 'FINDING_TYPE_UNUSED_SECRET' | 'FINDING_TYPE_CREDENTIAL_PUBLICLY_EXPOSED' | 'FINDING_TYPE_DECOY_PUBLICLY_EXPOSED' | 'FINDING_TYPE_CREDENTIAL_EXPIRING' — The finding type to configure. Must be a detector-backed type.

## Response `200`

Successful response

- C1ApiFindingV1UpdateFindingSettingsResponse — The UpdateFindingSettingsResponse message.
  - `list` C1ApiFindingV1FindingTypeSetting[], nullable — The full catalog after the write, in the same shape ListFindingSettings returns.
    - `enabled` boolean — Whether the system detects this finding type. Types never configured read back their shipped default, which is per type rather than uniformly on.
    - `findingType` 'FINDING_TYPE_UNSPECIFIED' | 'FINDING_TYPE_SIMILAR_USERNAME_MATCH' | 'FINDING_TYPE_SERVICE_ACCOUNT_MISCLASSIFICATION' | 'FINDING_TYPE_NHI_UNOWNED' | 'FINDING_TYPE_SERVICE_ACCOUNT_UNOWNED' | 'FINDING_TYPE_DECOY_CREDENTIAL_USED' | 'FINDING_TYPE_CUSTOM' | 'FINDING_TYPE_CONNECTOR_ANOMALY_DETECTION_DISABLED' | 'FINDING_TYPE_DEACTIVATED_OWNER' | 'FINDING_TYPE_UNUSED_SECRET' | 'FINDING_TYPE_CREDENTIAL_PUBLICLY_EXPOSED' | 'FINDING_TYPE_DECOY_PUBLICLY_EXPOSED' | 'FINDING_TYPE_CREDENTIAL_EXPIRING' — The findingType field.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)