---
title: "Update vendor finding"
method: PATCH
path: "/vendors/{vendorId}/findings/{findingId}"
tags: ["Vendors"]
---

# Update vendor finding

`PATCH /vendors/{vendorId}/findings/{findingId}`

Update vendor finding.

## Path parameters

- `vendorId` string, required
- `findingId` string, required

## Request body

- UpdateFindingInput
  - `content` string — The content of the finding.
  - `riskStatus` 'ACCEPT' | 'REMEDIATE' | 'NONE' — The status of the finding: - ACCEPT: The finding and its risk has been accepted and no follow up is required. - REMEDIATE: The finding needs to be remediated in some way. - NONE: The finding is not related to an observed risk that needs to be accepted or remediated.
  - `remediation` object — Remediation information about the finding. Will only be populated if riskStatus is set to "REMEDIATE".
    - `state` 'OPEN' | 'CLOSED' — The current state of a finding remediation: - OPEN: The finding has not been remediated and still needs to be addressed. - CLOSED: The finding has been remediated and no further action is needed.
    - `requirementNotes` string — A string containing the information needed to properly remediate the finding.

## Response `200`

Ok

- VendorFinding
  - `id` string, required — Unique identifier for the finding.
  - `vendorId` string, required — Unique identifier for the vendor.
  - `securityReviewId` string, nullable, required — Unique identifier for a security review.
  - `documentId` string, nullable, required — Unique identifier for a document.
  - `content` string, required — The content of the finding.
  - `riskStatus` 'ACCEPT' | 'REMEDIATE' | 'NONE', required — The status of the finding: - ACCEPT: The finding and its risk has been accepted and no follow up is required. - REMEDIATE: The finding needs to be remediated in some way. - NONE: The finding is not related to an observed risk that needs to be accepted or remediated.
  - `remediation` object, nullable, required — Remediation information about the finding. Will only be populated if riskStatus is set to "REMEDIATE".
    - `state` 'OPEN' | 'CLOSED', required — The current state of a finding remediation: - OPEN: The finding has not been remediated and still needs to be addressed. - CLOSED: The finding has been remediated and no further action is needed.
    - `requirementNotes` string, nullable, required — A string containing the information needed to properly remediate the finding.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)