---
title: "Create Finding Task"
method: POST
path: "/api/v1/findings/{finding_id}/task"
tags: ["Findings"]
---

# Create Finding Task

`POST /api/v1/findings/{finding_id}/task`

Create a task for a finding.

## Path parameters

- `finding_id` string, required — The ID of the finding to create a remediation task for.

## Request body

- C1ApiFindingV1CreateFindingTaskRequestInput — The CreateFindingTaskRequest message.
  - `policyId` string — Optional policy ID. Defaults to the app's grant policy or the built-in "Finding Review" policy.

## Response `200`

Successful response

- C1ApiFindingV1CreateFindingTaskResponse — The CreateFindingTaskResponse message.
  - `finding` C1ApiFindingV1Finding — The Finding message. This message contains a oneof named finding_type. Only a single field of the following list may be set at a time: - similarUsernameMatch - serviceAccountMisclassification - decoyCredentialUsed This message contains a oneof named target. Only a single field of the following list may be set at a time: - identityUserTarget - appUserTarget This message contains a oneof named evidence. Only a single field of the following list may be set at a time: - similarUsernameMatchEvidence - serviceAccountMisclassificationEvidence
    - `appId` string — The appId field.
    - `appUserTarget` C1ApiFindingV1AppUserTarget, nullable — The AppUserTarget message.
      - `appId` string — The appId field.
      - `appUserId` string — The appUserId field.
    - `assignedOwner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId
      - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
    - `computedOwner` C1ApiFindingV1FindingOwnerRef — The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId
      - `appOwnerAppId` string, nullable — The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `identityUserId` string, nullable — The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `managerOfUserId` string, nullable — The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
      - `userSetId` string, nullable — The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details.
    - `createdAt` string, date-time
    - `customTags` object — The customTags field.
    - `decoyCredentialUsed` C1ApiFindingV1DecoyCredentialUsedType, nullable — DecoyCredentialUsedType: a planted decoy credential authenticated successfully.
      - `decoyId` string — The decoyId field.
      - `kind` 'DECOY_CREDENTIAL_KIND_UNSPECIFIED' | 'DECOY_CREDENTIAL_KIND_USER_CLIENT_CREDENTIAL' | 'DECOY_CREDENTIAL_KIND_CONNECTOR_CLIENT' | 'DECOY_CREDENTIAL_KIND_WORKLOAD_FEDERATION' | 'DECOY_CREDENTIAL_KIND_ACCESS_TOKEN' — The kind field.
    - `fingerprint` string — The fingerprint field.
    - `firstObservedAt` string, date-time
    - `id` string — The id field.
    - `identityUserTarget` C1ApiFindingV1IdentityUserTarget, nullable — The IdentityUserTarget message.
      - `identityUserId` string — The identityUserId field.
    - `lastObservedAt` string, date-time
    - `recurrenceCount` integer — The recurrenceCount field.
    - `remediationDescription` string — The remediationDescription field.
    - `resolvedAt` string, date-time
    - `riskAcceptanceExpiresAt` string, date-time
    - `riskAcceptanceJustification` string — The riskAcceptanceJustification field.
    - `riskScore` C1ApiFindingV1FindingRiskScore — The FindingRiskScore message.
      - `originalScore` integer — The originalScore field.
      - `overrideByUserId` string — The overrideByUserId field.
      - `overrideScore` integer — The overrideScore field.
      - `riskFactors` C1ApiFindingV1FindingRiskFactor[], nullable — The riskFactors field.
        - `description` string — The description field.
        - `name` string — The name field.
        - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field.
        - `weight` integer — The weight field.
      - `score` integer — The score field.
      - `systemScore` integer — The systemScore field.
    - `serviceAccountMisclassification` C1ApiFindingV1ServiceAccountMisclassificationType, nullable — The ServiceAccountMisclassificationType message.
      - `currentAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The currentAccountType field.
      - `detectedAccountType` 'APP_USER_TYPE_UNSPECIFIED' | 'APP_USER_TYPE_USER' | 'APP_USER_TYPE_SERVICE_ACCOUNT' | 'APP_USER_TYPE_SYSTEM_ACCOUNT' — The detectedAccountType field.
    - `serviceAccountMisclassificationEvidence` C1ApiFindingV1ServiceAccountMisclassificationEvidence, nullable — The ServiceAccountMisclassificationEvidence message.
      - `detectionReason` string — The detectionReason field.
    - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field.
    - `similarUsernameMatch` C1ApiFindingV1SimilarUsernameMatchType, nullable — The SimilarUsernameMatchType message.
      - `proposedIdentityUserId` string — The proposedIdentityUserId field.
    - `similarUsernameMatchEvidence` C1ApiFindingV1SimilarUsernameMatchEvidence, nullable — The SimilarUsernameMatchEvidence message.
      - `appUsername` string — The appUsername field.
      - `identityUsername` string — The identityUsername field.
      - `similarityScore` number — The similarityScore field.
    - `snoozeReason` string — The snoozeReason field.
    - `snoozeUntil` string, date-time
    - `sourceDetectorId` string — The sourceDetectorId field.
    - `state` 'FINDING_STATE_UNSPECIFIED' | 'FINDING_STATE_OPEN' | 'FINDING_STATE_IN_PROGRESS' | 'FINDING_STATE_RESOLVED' | 'FINDING_STATE_SNOOZED' | 'FINDING_STATE_RISK_ACCEPTED' | 'FINDING_STATE_SUPPRESSED' — The state field.
    - `stateUpdatedById` string — The stateUpdatedById field.
    - `suppressReason` string — The suppressReason field.
    - `taskId` string — The taskId field.
    - `updatedAt` string, date-time
  - `taskId` string — The ID of the created task.

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/versions/d391405a35d3/schema)