---
title: "Override the severity of security findings"
method: PATCH
path: "/api/v2/security/findings/severity"
tags: ["Security Monitoring"]
---

# Override the severity of security findings

`PATCH /api/v2/security/findings/severity`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/findings/severity`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token`
- TypeScript: <https://skmtc.dev/datadog/apis/datadog-api-v2-collection/docs/api/v2/security/findings/severity/patch.ts> (a function with typed inputs; its response is checked against the schema)

Set or clear the manual severity override of security findings.

You can update up to 100 security findings per request.
Use the `set` action with a `value` to apply a manual severity override.
`value` is required for `set` and must be omitted for `clear`.
The `info` value sets the lowest severity the finding type allows.
Use the `clear` action to remove a manual severity override.
`clear` does not remove a severity set by an automation rule.
The optional `description` is accepted with both actions and has a limit of 280 characters.

Auto-closed findings are excluded.
Findings whose severity was set by an automation rule are skipped and listed in the response `meta.warnings`.
If every finding is skipped this way, the request fails with a `400` error.
Findings that cannot be found are skipped without a warning.
The request fails with a `404` error only if none of the findings can be found.

## Request body

- SeverityOverrideRequest: Request to set or clear the manual severity override of security findings.
  - `data` SeverityOverrideRequestData, required: Data of the severity override request.
    - `attributes` SeverityOverrideRequestDataAttributes, required: Attributes of the severity override request.
      - `severity` union, required: Severity override to apply to the findings. Set `action` to `set` to apply a manual severity override with the given `value`. Set `action` to `clear` to remove a manual severity override.
        - SeverityOverrideSet: Applies a manual severity override to the findings.
          - `action` 'set', required: The action that applies a manual severity override.
          - `description` string: Additional information about the severity change. This field has a limit of 280 characters.
          - `value` 'critical' | 'high' | 'medium' | 'low' | 'info', required: Severity to apply to the findings. `info` sets the lowest severity the finding type allows.
        - SeverityOverrideClear: Removes the manual severity override of the findings. This action does not remove a severity set by an automation rule.
          - `action` 'clear', required: The action that removes a manual severity override.
          - `description` string: Additional information about the severity change. This field has a limit of 280 characters.
    - `id` string: Unique identifier of the severity override request. If not provided, an identifier is generated.
    - `relationships` SeverityOverrideRequestDataRelationships, required: Relationships of the severity override request.
      - `findings` Findings, required: A list of security findings.
        - `data` FindingData[]: Array of security finding data objects.
          - `id` string, required: Unique identifier of the security finding.
          - `type` 'findings', required: Security findings resource type.
    - `type` 'severity_override', required: Severity override resource type.

## Response `202`

Accepted

- SeverityOverrideResponse: Response for the severity override request.
  - `data` SeverityOverrideResponseData, required: Data of the severity override response.
    - `id` string, required: Unique identifier of the severity override request.
    - `type` 'severity_override', required: Severity override resource type.
  - `meta` SeverityOverrideResponseMeta: Security findings skipped while processing the severity override request.
    - `warnings` SeverityOverrideResult[]: Findings skipped because an automation rule set their severity.
      - `detail` string, required: Human-readable explanation of why the finding was skipped.
      - `finding_id` string, required: Unique identifier of the security finding.
      - `status` integer, required: HTTP-like status code describing the outcome for this finding.
      - `title` string, required: Short label describing the outcome for this finding.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: Unprocessable Entity
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/3f70db624329?raw)