Bulk triage findings by hash

Bulk triage multiple findings by their finding hash within a single application environment.

Finding Hashes

Finding hashes are SHA-256 identifiers that uniquely identify a finding across scans. You can discover finding hashes from:

• GET /api/v1/reports/org/{orgId}/findings — the findingHash field on each finding
• GET /api/v1/scan/{scanId}/alert/{pluginId} — the findingHash field on each alert URI

Supported Statuses

• FALSE_POSITIVE — Mark the finding as a false positive
• RISK_ACCEPTED — Accept the risk of this finding
• UNKNOWN — Clear the triage status, returning the finding to an untriaged state
• ADD_COMMENT — Add a comment without changing the triage status

Limits

• Maximum 100 actions per request
• One request per organization/application/environment combination

Partial Success

The endpoint always returns HTTP 200 for valid requests. Individual action failures (e.g., finding hash not found) are reported per-result with success: false and an error message. Successful actions are still applied even if some fail.

Triage Behavior

• Triaging a finding with a parameterized URI (e.g., /api/v1/users/{userId}) affects all literal URIs that map to that parameterized URI
• Each environment has unique finding hashes — triage is per-environment
• Once a triage rule is created, it applies to future scans automatically

Notes

• The note field is optional. If omitted or blank, any existing note on the finding is preserved.
• To explicitly update a note, include a non-empty note value with your triage action.

🧾 Audited This is recorded as ALERT_RULE_TRIAGED User Activity.

Requires write:triage permission.