findings

Update Finding

patch/v1/findings/{finding_id}

Request

  • Base URL: https://api.cybret.ai (the document declares no server; this is the origin it was published from)
  • URL: https://api.cybret.ai/v1/findings/{finding_id}
  • Auth: HTTP bearer

Path parameters

finding_idstring required

Request body

status'open' | 'fixed' | 'accepted_risk' | 'false_positive'

Customer-writable statuses. reopened is scanner-derived only.

notestring nullable
link_prstring nullable
assignee_subjectstring nullable

Response

Successful Response

finding_idstring required
tenant_idstring required
run_idstring required
stable_idstring required
severity'info' | 'low' | 'medium' | 'high' | 'critical' required
confidencenumber required
titlestring required
descriptionstring required
remediationstring nullable
cwe_idsstring[]
owasp_categoriesstring[]
endpointstring required

HTTP path or source file path. File-path locators (for example handlers.go) do not need a leading slash.

http_methodstring required

HTTP verb or store token. CODE is a store token for file-path locators, not a live HTTP verb.

identity_idstring nullable
owner_identity_idstring nullable
peer_identity_idstring nullable
remediation_pathstring nullable
remediation_lineinteger nullable
remediation_symbolstring nullable
auth_mode'unauthenticated' | 'secret_store' | 'controller' | 'mixed' | 'unknown'

Secret-free description of how report evidence was collected.

evidenceobject[]
reproductionstring nullable
proof_idstring nullable
proof_digeststring nullable
confidence_tier'unsupported' | 'reported' | 'corroborated' | 'proven'

Explicit confidence, derived from which pillars a proof actually carries.

Ordered weakest to strongest. The tier is computed from evidence, never reported by a model, so two findings with the same tier carry the same class of proof.

status'open' | 'fixed' | 'reopened' | 'accepted_risk' | 'false_positive' | 'not_reproduced'
status_notestring nullable
linked_prstring nullable
verify_outcome'fixed' | 'reproduced' | 'inconclusive' nullable
confirmation'needs_review' | 'confirmed' | 'refuted' | 'inconclusive'

Grey/black oracle state for a White CODE hypothesis.

DAST rows leave this unset. White ingest is needs_review until a live probe writes confirmed or refuted. inconclusive is a writeback-only verdict; locally the row stays needs_review.

confirmation_settled_atstring date-time nullable

When Grey set confirmation to confirmed or refuted and did not attach a proof bundle. proof.created_at is the settlement clock when a bundle is present. Null when confirmation is unsettled or the row was stored before this column existed. White republish arrives as needs_review; scanner_republish_verdict copies this value from the previous row, so last_observed_at can move without recording a new Grey judgment.

live_confirmedboolean

True when a captured live exchange matched this CODE finding's route and method. Derived from evidence.exchange. Does not change severity, confirmation, or the sink gate.

evidence_classstring nullable

What the evidence demonstrated (sink_policy.EvidenceClass value). Unset is not a sink. Medium+ without real evidence is capped.

severity_downgrade_reasonstring nullable

Stable reason recorded when a gate capped severity: 'sink_absent' (ADR-0003) or 'evidence_absent' (no real evidence). None when not downgraded.

original_severity'info' | 'low' | 'medium' | 'high' | 'critical'
compose_provenance'white' | 'website-dast' | 'both' nullable

Compose plane that produced this finding: white (repo CODE), website-dast (live Grey/Black), or both (White hypothesis confirmed by website DAST). Absent when the run is not a White+website compose.

risk_scorenumber nullable

Published 0-10 score copied from an upstream risk_score. Read a present score as Critical at or above 9.0, High at or above 7.0, Medium at or above 4.0, Low at or above 1.0, otherwise Info. The band does not replace severity.

planestring nullable

White finding plane copied from upstream (code, sast, white, secret, sca, iac, container, dast). Null on Grey/Black rows and on findings ingested before the column existed. Customer severity for unconfirmed CODE/SAST uses this plane; it does not replace severity.

repositorystring nullable

Repository locator White published (owner/name or the same class of repo string). Null when the payload did not name one. Not part of stable_id.

severity_scorenumber nullable

Published 0-10 score copied from an upstream severity_score. Does not replace severity. When risk_score is absent, the same number is also stored as risk_score.

locationstring nullable

Repository-relative file path White published. Display and export only — line numbers stay on remediation_line and are not part of stable_id when content_hash is present.

secret_maskstring nullable

Masked matched secret (for example the first and last four characters). Null when no matched secret was sealed. Never the full value.

revealableboolean

True when ciphertext is stored for this finding and POST /v1/findings/{finding_id}/reveal can return the plaintext to a caller who can read the finding. False for historical rows that never stored a matched secret.

first_observed_atstring date-time required
last_observed_atstring date-time required
fixed_atstring date-time nullable
reopened_atstring date-time nullable
scanner_versionstring required

Example response

{
  "endpoint": "/api/orders/{id}",
  "http_method": "GET"
}

Changes

No recorded changes to this operation across all 1 revision of this API.