Update finding
curl --request PATCH \
--url https://api.example.com/findings/{id}import requests
url = "https://api.example.com/findings/{id}"
response = requests.patch(url)
print(response.text)const options = {method: 'PATCH'};
fetch('https://api.example.com/findings/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/findings/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/findings/{id}"
req, _ := http.NewRequest("PATCH", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.example.com/findings/{id}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/findings/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
response = http.request(request)
puts response.read_bodyFindings
Update finding
Change a finding’s state, severity, and/or duplicate link.
PATCH
/
findings
/
{id}
Update finding
curl --request PATCH \
--url https://api.example.com/findings/{id}import requests
url = "https://api.example.com/findings/{id}"
response = requests.patch(url)
print(response.text)const options = {method: 'PATCH'};
fetch('https://api.example.com/findings/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/findings/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/findings/{id}"
req, _ := http.NewRequest("PATCH", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.example.com/findings/{id}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/findings/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
response = http.request(request)
puts response.read_bodyUpdates the
The response contains only the updated state, severity, and duplicate link. Fetch the full finding via
state, severity, duplicate_of, or any combination of them on a single finding. Every change is recorded to the finding’s audit trail and propagated to connected integrations (GitHub, Slack, Jira, Linear).
Scope required:
writeRequest
curl -X PATCH https://api.hacktron.ai/v1/findings/d1e2f3a4-b5c6-7890-1234-567890abcdef \
-H "X-Api-Key: $HACKTRON_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"state": "true_positive",
"severity": "critical",
"duplicate_of": null,
"reason": "Confirmed reproducible against staging. Raising from high to critical."
}'
Path parameters
| Parameter | Type | Description |
|---|---|---|
id | UUID | Finding UUID. |
Body
At least one ofstate, severity, or duplicate_of must be provided. Providing none of them returns 400.
| Field | Type | Description |
|---|---|---|
state | enum | New state. One of open, true_positive, false_positive, accepted_risk, resolved. |
severity | enum | New severity. One of critical, high, medium, low, info. |
duplicate_of | UUID|null | Canonical finding UUID to mark this finding as a duplicate of, or null to unmark it. The canonical finding must be in the same repository. |
state_reason | string | Reason for the state change. Max 2000 chars. Falls back to reason if omitted. |
severity_reason | string | Reason for the severity change. Max 2000 chars. Falls back to reason if omitted. |
reason | string | Shorthand applied to both state and severity when their specific reason fields are omitted. Max 2000 chars. |
Pass
reason alone when the same justification applies to both state and severity. Use state_reason and severity_reason only when the justifications differ.Setting
duplicate_of to another finding UUID closes this finding as a duplicate. Setting duplicate_of to null removes the duplicate link and reopens the finding.Response
200 OK
{
"id": "d1e2f3a4-b5c6-7890-1234-567890abcdef",
"state": "true_positive",
"severity": "critical",
"duplicate_of": null
}
GET /findings/{id} for the remaining fields.
Errors
400— none ofstate,severity, orduplicate_ofprovided, or field validation failed.404— finding not found, still in verification, or not visible to your organization.
⌘I