Sign in

v1

latestOpenAPI 3.0.32026-07-134103031.5 MB
Findings

Partial Update Target's Finding

patch/targets/{target_id}/findings/{id}/

Path parameters

idinteger required
target_idstring required

Identifier of the target.

Request body

idinteger
targetstring

Target scanned to find vulnerabilities.

scansstring

Scans that originated the vulnerability finding.

fixstring

Description of how to fix the vulnerability.

evidencestring

Evidence with proof of the vulnerability finding.

extrastring

Extra details about the vulnerability finding.

definitionstring

Definition of the vulnerability.

urlstring

URL of the vulnerability finding. For example, "http://www.example.com/user/show-details". The maximum length is 66000 characters.

pathstring

URL path of the vulnerability finding. For example, "user/show-details".

method'get' | 'post' | 'trace' | 'options' | 'put' | 'delete'

HTTP method used in the request:

  • get - GET
  • post - POST
  • trace - TRACE
  • options - OPTIONS
  • put - PUT
  • delete - DELETE
insertion_point'cookie' | 'parameter' | 'arbitrary_url_param' | 'header' | 'url_folder' | 'url_filename' | 'json_parameter' | 'request_body' | 'multipart_parameter' | 'graphql_parameter' | 'non_standard_parameter'

Insertion point of the parameter:

  • cookie - Cookie
  • parameter - Parameter
  • arbitrary_url_param - Parameter
  • header - Header
  • url_folder - URL Path
  • url_filename - URL Path
  • json_parameter - JSON Parameter
  • request_body - Request Body
  • multipart_parameter - Multipart Parameter
  • graphql_parameter - GraphQL Parameter
  • non_standard_parameter - Non Standard Parameter
parameterstring

Name of the inserted parameter.
The maximum length is 1024 characters.

valuestring nullable

Value of the inserted parameter.

operation_namestring

GraphQL operation name, if applicable.

operation_typestring

GraphQL operation type (query, mutation, subscription), if applicable.

paramsstring

Query parameters of the vulnerability finding, in JSON format. For example, "{'name': ['Joe Smith'], 'phone': ['+919999999999', '+628888888888']}"

assigneestring nullable

User who is assigned to fix the vulnerability.

state'notfixed' | 'invalid' | 'accepted' | 'fixed'

State of the vulnerability finding:
(Read more about the meaning of vulnerability findings states)

  • notfixed - Not Fixed
  • invalid - Invalid
  • accepted - Accepted
  • fixed - Fixed
severity10 | 20 | 30 | 40

Severity of the vulnerability finding:

  • 10 - low
  • 20 - medium
  • 30 - high
  • 40 - critical
cvss_scorenumber double nullable

Score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).

cvss_vectorstring

Vector with the metrics of the score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).

last_foundstring date-time

Date and time of when the vulnerability was last found, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302"

retestingboolean

If true, the vulnerability will be retested.
If, after the retest, the vulnerability is no longer found, the vulnerability finding is marked as fixed. Otherwise, it is marked as not fixed.

newboolean

If true, this is a newly found vulnerability. If false, this vulnerability has been found in previous scans.

review_status'notrequired' | 'pending' | 'rejected' | 'accepted' | ''

Some findings we're unsure are valid and need a manual validation step.

  • notrequired - not required
  • pending - pending review
  • rejected - rejected after review
  • accepted - accepted after review
review_reasonstring

User's reason for finding's review.

created_atstring date-time nullable

Timestamp of the Finding's creation.

changedstring date-time

Date and time of the last change, in ISO 8601 UTC format.
For example, "2023-08-09T13:27:43.8208302".

commentstring nullable

Comment on the object.

change_reasonstring

Reason for changing the Finding state to 'invalid' or 'accepted'.

expiration_datestring date nullable

Expiration date of the acceptance. Required if the account setting 'Require expiration date on acceptance' is set.

approver_namestring

Name of the person or entity approving the acceptance. Required if the account setting 'Require approval name on acceptance' is set.

approval_datestring date nullable

Date of the approval of the acceptance. Required if the account setting 'Require approval date on acceptance' is set.

has_sast_correlationsboolean

Response

idstring required

Global ID in the format: <TARGET_ID>-<FINDING_ID>

scansstring required

Scans that originated the vulnerability finding.

fixstring required

Description of how to fix the vulnerability.

evidencestring required

Evidence with proof of the vulnerability finding.

extrastring required

Extra details about the vulnerability finding.

urlstring required

URL of the vulnerability finding. For example, "http://www.example.com/user/show-details". The maximum length is 66000 characters.

pathstring required

URL path of the vulnerability finding. For example, "user/show-details".

method'get' | 'post' | 'trace' | 'options' | 'put' | 'delete' required

HTTP method used in the request:

  • get - GET
  • post - POST
  • trace - TRACE
  • options - OPTIONS
  • put - PUT
  • delete - DELETE
insertion_point'cookie' | 'parameter' | 'arbitrary_url_param' | 'header' | 'url_folder' | 'url_filename' | 'json_parameter' | 'request_body' | 'multipart_parameter' | 'graphql_parameter' | 'non_standard_parameter' required

Insertion point of the parameter:

  • cookie - Cookie
  • parameter - Parameter
  • arbitrary_url_param - Parameter
  • header - Header
  • url_folder - URL Path
  • url_filename - URL Path
  • json_parameter - JSON Parameter
  • request_body - Request Body
  • multipart_parameter - Multipart Parameter
  • graphql_parameter - GraphQL Parameter
  • non_standard_parameter - Non Standard Parameter
parameterstring required

Name of the inserted parameter.
The maximum length is 1024 characters.

valuestring nullable required

Value of the inserted parameter.

operation_namestring required

GraphQL operation name, if applicable.

operation_typestring required

GraphQL operation type (query, mutation, subscription), if applicable.

paramsstring required

Query parameters of the vulnerability finding, in JSON format. For example, "{'name': ['Joe Smith'], 'phone': ['+919999999999', '+628888888888']}"

state'notfixed' | 'invalid' | 'accepted' | 'fixed'

State of the vulnerability finding:
(Read more about the meaning of vulnerability findings states)

  • notfixed - Not Fixed
  • invalid - Invalid
  • accepted - Accepted
  • fixed - Fixed
severity10 | 20 | 30 | 40

Severity of the vulnerability finding:

  • 10 - low
  • 20 - medium
  • 30 - high
  • 40 - critical
cvss_scorenumber double nullable required

Score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).

cvss_vectorstring required

Vector with the metrics of the score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).

last_foundstring date-time

Date and time of when the vulnerability was last found, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302"

retestingboolean required

If true, the vulnerability will be retested.
If, after the retest, the vulnerability is no longer found, the vulnerability finding is marked as fixed. Otherwise, it is marked as not fixed.

newboolean required

If true, this is a newly found vulnerability. If false, this vulnerability has been found in previous scans.

review_status'notrequired' | 'pending' | 'rejected' | 'accepted' | ''

Some findings we're unsure are valid and need a manual validation step.

  • notrequired - not required
  • pending - pending review
  • rejected - rejected after review
  • accepted - accepted after review
review_reasonstring

User's reason for finding's review.

created_atstring date-time nullable required

Timestamp of the Finding's creation.

changedstring date-time required

Date and time of the last change, in ISO 8601 UTC format.
For example, "2023-08-09T13:27:43.8208302".

commentstring nullable

Comment on the object.

change_reasonstring

Reason for changing the Finding state to 'invalid' or 'accepted'.

expiration_datestring date nullable

Expiration date of the acceptance. Required if the account setting 'Require expiration date on acceptance' is set.

approver_namestring

Name of the person or entity approving the acceptance. Required if the account setting 'Require approval name on acceptance' is set.

approval_datestring date nullable

Date of the approval of the acceptance. Required if the account setting 'Require approval date on acceptance' is set.