Bulk add notes to findings by hash

Bulk add notes to findings by their finding hash within a single application environment. Unlike the full triage endpoint, this endpoint adds notes only — it does not change finding statuses.

Finding Hashes

Finding hashes are SHA-256 identifiers that uniquely identify a finding across scans. You can discover finding hashes from:

• GET /api/v1/reports/org/{orgId}/findings — the findingHash field on each finding
• GET /api/v1/scan/{scanId}/alert/{pluginId} — the findingHash field on each alert URI

Behavior

• The status field in each action is silently ignored — only the note is applied. No triage status is changed by this endpoint.
• Each action must include a non-blank note.
• This endpoint is available to all authenticated org members without any feature flag requirement.

Limits

• Maximum 100 actions per request
• One request per organization/application/environment combination

Partial Success

The endpoint always returns HTTP 200 for valid requests. Individual action failures (e.g., finding hash not found) are reported per-result with success: false and an error message. Successful actions are still applied even if some fail.

🧾 Audited This is recorded as ALERT_RULE_TRIAGED User Activity.