---
title: "Partial Update Account's Finding"
method: PATCH
path: "/findings/{id}/"
tags: ["Findings"]
---

# Partial Update Account's Finding

`PATCH /findings/{id}/`

## Path parameters

- `id` integer, required

## Request body

- PatchedFinding
  - `id` integer
  - `target` string — Target scanned to find vulnerabilities.
  - `scans` string — Scans that originated the vulnerability finding.
  - `labels` FindingLabel[] — Labels of the vulnerability finding.
    - `id` string, required — A unique Base58 value identifying this object.
    - `name` string, required — Name of the label. The maximum length is 255 characters.
    - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green.
    - `changed_by` SimpleUser, required
      - `id` string, required — A unique Base58 value identifying this object.
      - `email` string, email — Email of the user.
      - `name` string, required — Name of the user.
    - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `fix` string — Description of how to fix the vulnerability.
  - `requests` RequestResponsePairMarkdown[] — Pairs of requests and responses of the vulnerability finding.
    - `request` string, nullable
    - `response` string, nullable
  - `evidence` string — Evidence with proof of the vulnerability finding.
  - `extra` string — Extra details about the vulnerability finding.
  - `definition` string — Definition of the vulnerability.
  - `url` string — URL of the vulnerability finding. For example, "http://www.example.com/user/show-details". The maximum length is 66000 characters.
  - `path` string — URL path of the vulnerability finding. For example, "user/show-details".
  - `method` 'get' | 'post' | 'trace' | 'options' | 'put' | 'delete' — HTTP method used in the request: * `get` - GET * `post` - POST * `trace` - TRACE * `options` - OPTIONS * `put` - PUT * `delete` - DELETE
  - `insertion_point` 'cookie' | 'parameter' | 'arbitrary_url_param' | 'header' | 'url_folder' | 'url_filename' | 'json_parameter' | 'request_body' | 'multipart_parameter' | 'graphql_parameter' | 'non_standard_parameter' — Insertion point of the parameter: * `cookie` - Cookie * `parameter` - Parameter * `arbitrary_url_param` - Parameter * `header` - Header * `url_folder` - URL Path * `url_filename` - URL Path * `json_parameter` - JSON Parameter * `request_body` - Request Body * `multipart_parameter` - Multipart Parameter * `graphql_parameter` - GraphQL Parameter * `non_standard_parameter` - Non Standard Parameter
  - `parameter` string — Name of the inserted parameter. The maximum length is 1024 characters.
  - `value` string, nullable — Value of the inserted parameter.
  - `operation_name` string — GraphQL operation name, if applicable.
  - `operation_type` string — GraphQL operation type (query, mutation, subscription), if applicable.
  - `params` string — Query parameters of the vulnerability finding, in JSON format. For example, "{'name': ['Joe Smith'], 'phone': ['+919999999999', '+628888888888']}"
  - `assignee` string, nullable — User who is assigned to fix the vulnerability.
  - `state` 'notfixed' | 'invalid' | 'accepted' | 'fixed' — State of the vulnerability finding: (Read more about [the meaning of vulnerability findings states](https://help.probely.com/en/articles/6673828-what-is-the-meaning-of-a-finding-s-state)) * `notfixed` - Not Fixed * `invalid` - Invalid * `accepted` - Accepted * `fixed` - Fixed
  - `severity` 10 | 20 | 30 | 40 — Severity of the vulnerability finding: * `10` - low * `20` - medium * `30` - high * `40` - critical
  - `cvss_score` number, double, nullable — Score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).
  - `cvss_vector` string — Vector with the metrics of the score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).
  - `last_found` string, date-time — Date and time of when the vulnerability was last found, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302"
  - `retesting` boolean — If true, the vulnerability will be retested. If, after the retest, the vulnerability is no longer found, the vulnerability finding is marked as fixed. Otherwise, it is marked as not fixed.
  - `new` boolean — If true, this is a newly found vulnerability. If false, this vulnerability has been found in previous scans.
  - `review_status` 'notrequired' | 'pending' | 'rejected' | 'accepted' | '' — Some findings we're unsure are valid and need a manual validation step. * `notrequired` - not required * `pending` - pending review * `rejected` - rejected after review * `accepted` - accepted after review
  - `review_reason` string — User's reason for finding's review.
  - `created_at` string, date-time, nullable — Timestamp of the Finding's creation.
  - `changed` string, date-time — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `changed_by` SimpleUser
    - `id` string, required — A unique Base58 value identifying this object.
    - `email` string, email — Email of the user.
    - `name` string, required — Name of the user.
  - `comment` string, nullable — Comment on the object.
  - `change_reason` string — Reason for changing the Finding state to 'invalid' or 'accepted'.
  - `expiration_date` string, date, nullable — Expiration date of the acceptance. Required if the account setting 'Require expiration date on acceptance' is set.
  - `approver_name` string — Name of the person or entity approving the acceptance. Required if the account setting 'Require approval name on acceptance' is set.
  - `approval_date` string, date, nullable — Date of the approval of the acceptance. Required if the account setting 'Require approval date on acceptance' is set.
  - `has_sast_correlations` boolean

## Response `200`

- Finding
  - `id` string, required — Global ID in the format: <TARGET_ID>-<FINDING_ID>
  - `target` SimpleScope, required
    - `id` string, required
    - `name` string — Name of the target. The maximum length is 255 characters.
    - `site` Target — Mixin to handle obfuscation of sensitive fields in serializers.
      - `id` string, required — A unique Base58 value identifying this object.
      - `name` string — Name of the target or extra host. The maximum length is 255 characters.
      - `desc` string, nullable — Description of the target.
      - `url` string, uri, required — URL of the target.
      - `host` string, required — Hostname of the target.
      - `has_form_login` boolean — If true, the target authentication is done through a login form. Read more about [how to set up target authentication (login form)](https://help.probely.com/en/articles/3292779-how-to-set-up-target-authentication-login-form). Defaults to false.
      - `form_login_url` string, uri — URL of the login form of the target.
      - `form_login_check_pattern` string — Pattern to check a successful login. The maximum length is 255 characters.
      - `form_login` SensitiveFormLogin[] — Field and value pairs to fill the login form.
        - `name` string, required
        - `value` string, required
        - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
      - `logout_detection_enabled` boolean — If true, detects any undesired logouts that may occur during scans to log back in. Requires `check_session_url` and `logout_detectors` to be defined. Defaults to false.
      - `has_sequence_login` boolean — If true, the target authentication is done through a recorded login sequence. Read more about [how to set up target authentication (login sequence)](https://help.probely.com/en/articles/5402869-how-to-record-a-sequence-with-probely-s-sequence-recorder-plugin). Defaults to false.
      - `has_basic_auth` boolean — If true, the target authentication is done through username and password credentials. Defaults to false.
      - `basic_auth` BasicAuth — Mixin to handle obfuscation of sensitive fields in serializers.
        - `username` string, required
        - `password` string, required
        - `password_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `password` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
      - `headers` SensitiveHeader[] — Custom headers to send.
        - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
        - `name` string, required
        - `value` string, required
        - `allow_testing` boolean
        - `authentication` boolean
        - `authentication_secondary` boolean
      - `cookies` SensitiveCookies[] — Custom cookies to send.
        - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
        - `name` string, required
        - `value` string, required
        - `allow_testing` boolean
        - `authentication` boolean
        - `authentication_secondary` boolean
      - `whitelist` unknown
      - `blacklist` unknown
      - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
      - `changed_by` SimpleUser, required
        - `id` string, required — A unique Base58 value identifying this object.
        - `email` string, email — Email of the user.
        - `name` string, required — Name of the user.
      - `auth_enabled` boolean — If true, the target has authentication. Defaults to false.
      - `logout_condition` 'any' | 'all' — Type of combination of the logout conditions: * `any` - Is logged out if any condition is verified. * `all` - Is logged out only if all condition are verified.
      - `check_session_url` string — URL to check session.
      - `check_session_operation_name` string — GraphQL operation name for the check session request.
      - `has_otp` boolean — If true, the target has two-factor authentication (2FA). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). Defaults to false.
      - `otp_secret` string — The seed/secret obtained when the QR code is displayed to be scanned by the third-party authenticator (TPA) app installed on the phone (e.g., Google Authenticator, 1Password, Authy, Microsoft Authenticator, etc.). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa).
      - `otp_secret_is_sensitive` boolean, required — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `otp_secret` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`. Read-only.
      - `otp_algorithm` 'SHA1' | 'SHA256' | 'SHA512' — Secure hash algorithm (SHA) to generate the one-time password (OTP): (Defaults to `SHA1`) * `SHA1` - Sha1 * `SHA256` - Sha256 * `SHA512` - Sha512
      - `otp_digits` 6 | 7 | 8 — Number of digits of the one-time password (OTP): (Defaults to `6`) * `6` - Six * `7` - Seven * `8` - Eight
      - `otp_field` string — CSS selector of the HTML element in the page to enter the one-time password (OTP). For example, a text input field. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "".
      - `otp_submit` string — CSS selector of the HTML element in the page to submit the one-time password (OTP). For example, a button. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "".
      - `otp_login_sequence_totp_value` string — One-time password (OTP) obtained at the time when the login sequence was recorded, i.e., the time-based one-time password (TOTP). Defaults to "".
      - `otp_type` string
      - `otp_url` string, required
      - `is_mtls_active` boolean, required — If true, mTLS is configured and enabled for the target.
      - `is_signature_active` boolean, required — If true, message signature is configured and enabled for the target.
      - `is_mle_active` boolean, required — If true, MLE (Message Level Encryption) is configured and enabled for the target.
      - `postman_authentication_enabled` boolean — If true, use Postman authentication when performing the check session request.
      - `postman_check_session_folder` string
      - `has_authentication` boolean, required
      - `stack` Framework[] — Technologies identified in the target during scans. The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities.
        - `id` string, required — A unique Base58 value identifying this object.
        - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters.
        - `desc` string, nullable, required — Description of the technology. Defaults to "".
      - `verified` boolean, required — If true, the domain is verified. Read-only.
      - `verification_token` string, required — Token used to verify the domain. Read-only.
      - `verification_date` string, date-time, required — Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only.
      - `verification_method` 'file' | 'back_office' | 'existing_domain' | 'dns_txt' | 'dns' | 'dns_cname' | 'meta_tag' | 'whitelist' | 'email' | 'aws_route53' | 'cloudflare' | 'waved' | 'akamai', required — Method used in the domain verification: * `file` - Verifies the domain against a text file in the root directory of the website. Learn more in [this article](https://help.probely.com/en/articles/3289281-how-to-verify-the-ownership-of-a-target-using-a-txt-file). * `back_office` - Automatically set if manually verified in the back-office. Read-only. * `existing_domain` - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only. * `dns_txt` - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/3285635-how-to-verify-the-ownership-of-a-target-using-dns-txt-records). * `dns` - Same as `dns_txt`. * `dns_cname` - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/5642359-how-to-verify-the-ownership-of-a-target-using-dns-cname-records). * `meta_tag` - Verifies the domain against a meta tag in the index page of the website. Learn more in [this article](https://help.probely.com/en/articles/5642393-how-to-verify-the-ownership-of-a-target-using-a-meta-tag). * `whitelist` - Automatically verifies if the domain is in the whitelist * `email` - Automatically verifies a domain if the user's email is in the same domain as the target * `aws_route53` - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone. * `cloudflare` - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone. * `waved` - Automatically verifies a domain if there is a waver agreement. * `akamai` - Automatically verifies a domain if the host name exists as an AkamaiHost.
      - `verification_last_error` string, required — Error of the last verification of the domain. Read-only.
      - `api_scan_settings` APIScanSettings, required — Mixin to handle obfuscation of sensitive fields in serializers.
        - `api_schema_type` 'openapi' | 'postman' | 'graphql' — Type of schema that defines the API: * `openapi` - OpenAPI schema. * `postman` - Postman collection. * `graphql` - GraphQL schema.
        - `api_schema_url` string, nullable
        - `api_schema_file` string, nullable
        - `api_schema_method` 'url' | 'file' | 'introspection' | '' | 'null', nullable — Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'. * `url` - Fetch schema from URL * `file` - Upload schema file * `introspection` - Auto-discover via GraphQL introspection
        - `custom_api_parameters` APIParameter[]
          - `name` string, required
          - `value` string, required
          - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
        - `media_type` 'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql' — Format of the payload: * `application/json` - The payload is in JSON format in the request body. * `application/x-www-form-urlencoded` - The payload is encoded in the request URL. * `application/graphql` - The payload is a raw GraphQL query string.
        - `api_login_url` string — URL to make the authentication request to the API. The maximum length is 2048 characters.
        - `api_login_payload` string — Payload to send in the authentication request. The maximum length is 4096 characters.
        - `api_login_payload_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
        - `api_login_enabled` boolean
        - `api_login_token_field` string — Field containing the authentication token in the response to the authentication request. The maximum length is 256 characters.
        - `token_prefix` string — Prefix to add to the authentication token. For example, "Bearer" or "JWT". The maximum length is 16 characters.
        - `token_parameter_name` string — Parameter name to send the authentication token. For example, "Authorization". The maximum length is 256 characters.
        - `token_parameter_location` 'cookie' | 'header' — Where to send the parameter name with the authentication token and the prefix: * `cookie` - Cookie * `header` - Header
        - `api_login_method` 'api_login' | 'headers_or_cookies' — Method used for API Target authentication. * `api_login` - API Login * `headers_or_cookies` - Headers/Cookie
        - `api_payload_login_enabled_secondary` boolean — Enable secondary payload auth for authorization (BOLA) testing .
        - `api_headers_cookies_login_enabled_secondary` boolean — Enable secondary static headers/cookies auth for authorization (BOLA) testing.
        - `api_login_payload_secondary` string — Payload to send in the secondary authentication request, used for BOLA detection.
        - `api_login_payload_secondary_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload_secondary` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
      - `openapi_check_session_method` string
      - `openapi_check_session_media_type` string
      - `openapi_check_session_expired_payload` string, nullable
    - `type` string — Type of target. Possible values are "single" for a web application and "api" for an API. Defaults to "single".
    - `desc` string, nullable — Description of the target. Defaults to "".
    - `labels` ScopeLabel[]
      - `id` string, required — A unique Base58 value identifying this object.
      - `name` string, required — Name of the label. The maximum length is 255 characters.
      - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green.
      - `changed_by` SimpleUser, required
        - `id` string, required — A unique Base58 value identifying this object.
        - `email` string, email — Email of the user.
        - `name` string, required — Name of the user.
      - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
    - `has_assets` boolean, required
    - `report_fileformat` 'pdf' | 'docx' — [Report format](https://help.probely.com/en/articles/6649585-how-to-switch-between-different-report-formats) for the target: (Defaults to `pdf`) * `pdf` - PDF file format. * `docx` - DOCX file format.
    - `scanning_agent` ScanningAgent — Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in `to_internal_value`. This is for the drf-spectacular documentation generation.
      - `id` string
      - `name` string, required
      - `installer_generated` boolean, required
      - `online` boolean, required
      - `fallback` boolean, required
      - `rx_bytes` integer, required
      - `tx_bytes` integer, required
      - `latest_handshake` integer, required
    - `teams` SimpleTeam[], required
      - `id` string — A unique Base58 value identifying this object.
      - `name` string, required
    - `blackout_period` BlackoutPeriod, required
      - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27".
      - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27".
      - `weekdays` integer[], required
      - `enabled` boolean — If true, the blackout period is enabled.
      - `timezone` string
      - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
      - `changed_by` SimpleUser, required
        - `id` string, required — A unique Base58 value identifying this object.
        - `email` string, email — Email of the user.
        - `name` string, required — Name of the user.
  - `scans` string, required — Scans that originated the vulnerability finding.
  - `labels` FindingLabel[], required
    - `id` string, required — A unique Base58 value identifying this object.
    - `name` string, required — Name of the label. The maximum length is 255 characters.
    - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green.
    - `changed_by` SimpleUser, required
      - `id` string, required — A unique Base58 value identifying this object.
      - `email` string, email — Email of the user.
      - `name` string, required — Name of the user.
    - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `fix` string, required — Description of how to fix the vulnerability.
  - `requests` RequestResponsePairMarkdown[], required — Pairs of requests and responses of the vulnerability finding.
    - `request` string, nullable
    - `response` string, nullable
  - `evidence` string, required — Evidence with proof of the vulnerability finding.
  - `extra` string, required — Extra details about the vulnerability finding.
  - `definition` SimpleVulnerabilityDefinition, required
    - `id` string, required
    - `name` string — Name of the vulnerability. The maximum length is 255 characters.
    - `desc` string, nullable — Description of the vulnerability.
    - `cwe_id` string, nullable — CWE id.
    - `cwe_name` string, nullable — CWE name
  - `url` string, required — URL of the vulnerability finding. For example, "http://www.example.com/user/show-details". The maximum length is 66000 characters.
  - `path` string, required — URL path of the vulnerability finding. For example, "user/show-details".
  - `method` 'get' | 'post' | 'trace' | 'options' | 'put' | 'delete', required — HTTP method used in the request: * `get` - GET * `post` - POST * `trace` - TRACE * `options` - OPTIONS * `put` - PUT * `delete` - DELETE
  - `insertion_point` 'cookie' | 'parameter' | 'arbitrary_url_param' | 'header' | 'url_folder' | 'url_filename' | 'json_parameter' | 'request_body' | 'multipart_parameter' | 'graphql_parameter' | 'non_standard_parameter', required — Insertion point of the parameter: * `cookie` - Cookie * `parameter` - Parameter * `arbitrary_url_param` - Parameter * `header` - Header * `url_folder` - URL Path * `url_filename` - URL Path * `json_parameter` - JSON Parameter * `request_body` - Request Body * `multipart_parameter` - Multipart Parameter * `graphql_parameter` - GraphQL Parameter * `non_standard_parameter` - Non Standard Parameter
  - `parameter` string, required — Name of the inserted parameter. The maximum length is 1024 characters.
  - `value` string, nullable, required — Value of the inserted parameter.
  - `operation_name` string, required — GraphQL operation name, if applicable.
  - `operation_type` string, required — GraphQL operation type (query, mutation, subscription), if applicable.
  - `params` string, required — Query parameters of the vulnerability finding, in JSON format. For example, "{'name': ['Joe Smith'], 'phone': ['+919999999999', '+628888888888']}"
  - `assignee` SimpleUser, required
    - `id` string, required — A unique Base58 value identifying this object.
    - `email` string, email — Email of the user.
    - `name` string, required — Name of the user.
  - `state` 'notfixed' | 'invalid' | 'accepted' | 'fixed' — State of the vulnerability finding: (Read more about [the meaning of vulnerability findings states](https://help.probely.com/en/articles/6673828-what-is-the-meaning-of-a-finding-s-state)) * `notfixed` - Not Fixed * `invalid` - Invalid * `accepted` - Accepted * `fixed` - Fixed
  - `severity` 10 | 20 | 30 | 40 — Severity of the vulnerability finding: * `10` - low * `20` - medium * `30` - high * `40` - critical
  - `cvss_score` number, double, nullable, required — Score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).
  - `cvss_vector` string, required — Vector with the metrics of the score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).
  - `last_found` string, date-time — Date and time of when the vulnerability was last found, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302"
  - `retesting` boolean, required — If true, the vulnerability will be retested. If, after the retest, the vulnerability is no longer found, the vulnerability finding is marked as fixed. Otherwise, it is marked as not fixed.
  - `new` boolean, required — If true, this is a newly found vulnerability. If false, this vulnerability has been found in previous scans.
  - `review_status` 'notrequired' | 'pending' | 'rejected' | 'accepted' | '' — Some findings we're unsure are valid and need a manual validation step. * `notrequired` - not required * `pending` - pending review * `rejected` - rejected after review * `accepted` - accepted after review
  - `review_reason` string — User's reason for finding's review.
  - `created_at` string, date-time, nullable, required — Timestamp of the Finding's creation.
  - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `changed_by` SimpleUser, required
    - `id` string, required — A unique Base58 value identifying this object.
    - `email` string, email — Email of the user.
    - `name` string, required — Name of the user.
  - `comment` string, nullable — Comment on the object.
  - `change_reason` string — Reason for changing the Finding state to 'invalid' or 'accepted'.
  - `expiration_date` string, date, nullable — Expiration date of the acceptance. Required if the account setting 'Require expiration date on acceptance' is set.
  - `approver_name` string — Name of the person or entity approving the acceptance. Required if the account setting 'Require approval name on acceptance' is set.
  - `approval_date` string, date, nullable — Date of the approval of the acceptance. Required if the account setting 'Require approval date on acceptance' is set.

## Other responses

- `400`
- `401`
- `404`
- `500`

---

[API](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation.md) · [All operations](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/probely/snyk-api-web-s-api-reference-documentation/revisions/e29879bff01b/schema)