---
title: "Bulk Update Account's Findings"
method: POST
path: "/findings/bulk/update/"
tags: ["Findings"]
---

# Bulk Update Account's Findings

`POST /findings/bulk/update/`

## Request body

- FindingBulkUpdateRequest
  - `ids` string[], required — List of object IDs.
  - `id` integer, required
  - `target` string, required — Target scanned to find vulnerabilities.
  - `scans` string, required — Scans that originated the vulnerability finding.
  - `labels` FindingLabel[] — Labels of the vulnerability finding.
    - `id` string, required — A unique Base58 value identifying this object.
    - `name` string, required — Name of the label. The maximum length is 255 characters.
    - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green.
    - `changed_by` SimpleUser, required
      - `id` string, required — A unique Base58 value identifying this object.
      - `email` string, email — Email of the user.
      - `name` string, required — Name of the user.
    - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `fix` string, required — Description of how to fix the vulnerability.
  - `requests` RequestResponsePairMarkdown[], required — Pairs of requests and responses of the vulnerability finding.
    - `request` string, nullable
    - `response` string, nullable
  - `evidence` string, required — Evidence with proof of the vulnerability finding.
  - `extra` string, required — Extra details about the vulnerability finding.
  - `definition` string, required — Definition of the vulnerability.
  - `url` string, required — URL of the vulnerability finding. For example, "http://www.example.com/user/show-details". The maximum length is 66000 characters.
  - `path` string, required — URL path of the vulnerability finding. For example, "user/show-details".
  - `method` 'get' | 'post' | 'trace' | 'options' | 'put' | 'delete', required — HTTP method used in the request: * `get` - GET * `post` - POST * `trace` - TRACE * `options` - OPTIONS * `put` - PUT * `delete` - DELETE
  - `insertion_point` 'cookie' | 'parameter' | 'arbitrary_url_param' | 'header' | 'url_folder' | 'url_filename' | 'json_parameter' | 'request_body' | 'multipart_parameter' | 'graphql_parameter' | 'non_standard_parameter', required — Insertion point of the parameter: * `cookie` - Cookie * `parameter` - Parameter * `arbitrary_url_param` - Parameter * `header` - Header * `url_folder` - URL Path * `url_filename` - URL Path * `json_parameter` - JSON Parameter * `request_body` - Request Body * `multipart_parameter` - Multipart Parameter * `graphql_parameter` - GraphQL Parameter * `non_standard_parameter` - Non Standard Parameter
  - `parameter` string, required — Name of the inserted parameter. The maximum length is 1024 characters.
  - `value` string, nullable, required — Value of the inserted parameter.
  - `operation_name` string, required — GraphQL operation name, if applicable.
  - `operation_type` string, required — GraphQL operation type (query, mutation, subscription), if applicable.
  - `params` string, required — Query parameters of the vulnerability finding, in JSON format. For example, "{'name': ['Joe Smith'], 'phone': ['+919999999999', '+628888888888']}"
  - `assignee` string, nullable — User who is assigned to fix the vulnerability.
  - `state` 'notfixed' | 'invalid' | 'accepted' | 'fixed' — State of the vulnerability finding: (Read more about [the meaning of vulnerability findings states](https://help.probely.com/en/articles/6673828-what-is-the-meaning-of-a-finding-s-state)) * `notfixed` - Not Fixed * `invalid` - Invalid * `accepted` - Accepted * `fixed` - Fixed
  - `severity` 10 | 20 | 30 | 40 — Severity of the vulnerability finding: * `10` - low * `20` - medium * `30` - high * `40` - critical
  - `cvss_score` number, double, nullable, required — Score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).
  - `cvss_vector` string, required — Vector with the metrics of the score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).
  - `last_found` string, date-time — Date and time of when the vulnerability was last found, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302"
  - `retesting` boolean, required — If true, the vulnerability will be retested. If, after the retest, the vulnerability is no longer found, the vulnerability finding is marked as fixed. Otherwise, it is marked as not fixed.
  - `new` boolean, required — If true, this is a newly found vulnerability. If false, this vulnerability has been found in previous scans.
  - `review_status` 'notrequired' | 'pending' | 'rejected' | 'accepted' | '' — Some findings we're unsure are valid and need a manual validation step. * `notrequired` - not required * `pending` - pending review * `rejected` - rejected after review * `accepted` - accepted after review
  - `review_reason` string — User's reason for finding's review.
  - `created_at` string, date-time, nullable, required — Timestamp of the Finding's creation.
  - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302".
  - `changed_by` SimpleUser, required
    - `id` string, required — A unique Base58 value identifying this object.
    - `email` string, email — Email of the user.
    - `name` string, required — Name of the user.
  - `comment` string, nullable — Comment on the object.
  - `change_reason` string — Reason for changing the Finding state to 'invalid' or 'accepted'.
  - `expiration_date` string, date, nullable — Expiration date of the acceptance. Required if the account setting 'Require expiration date on acceptance' is set.
  - `approver_name` string — Name of the person or entity approving the acceptance. Required if the account setting 'Require approval name on acceptance' is set.
  - `approval_date` string, date, nullable — Date of the approval of the acceptance. Required if the account setting 'Require approval date on acceptance' is set.

## Response `200`

- IDList
  - `ids` string[], required — List of object IDs.

## Other responses

- `400`
- `401`
- `500`

---

[API](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation.md) · [All operations](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/probely/snyk-api-web-s-api-reference-documentation/revisions/e29879bff01b/schema)