---
title: "Re-run a finding's attacks to confirm a fix"
method: POST
path: "/api/v1/findings/{finding_id}/validate"
tags: ["findings"]
---

# Re-run a finding's attacks to confirm a fix

`POST /api/v1/findings/{finding_id}/validate`

## Request

- Base URL: `https://api.enokilabs.ai`
- URL: `https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate`
- Auth: none declared

Re-runs every attack under the finding against the live target and drives its verification status. Call AFTER marking the finding fixed (PATCH .../close status=fixed) -- validating a finding that is not marked fixed returns verdict='not_eligible'. Returns the terminal verdict when the re-run finishes quickly; otherwise returns verdict='validating' with a replay_run_id -- re-read the finding's status via the findings list. Cross-workspace ids resolve to 404.

## Path parameters

- `finding_id` string, required

## Headers

- `Authorization` string, nullable: Bearer token with API key

## Response `200`

Successful Response

- ApiValidateResponse: Outcome of POST /api/v1/findings/{finding_id}/validate. The embedded finding carries the full state; `verdict` sums it up as the one signal a remediation loop acts on.
  - `finding_id` string, required: The finding that was validated.
  - `replay_run_id` string, required: The replay run that re-ran the finding's attacks. Empty when the finding was not eligible and no run was spent.
  - `verdict` 'resolved' | 'still_broken' | 'not_eligible' | 'validating', required: resolved: every attack no longer reproduces (finding FIXED_VERIFIED). still_broken: at least one attack still reproduces or could not be checked. not_eligible: mark the finding fixed before validating -- it was not in a verifiable state. validating: still running -- re-read the finding's status via the findings list.
  - `finding` ApiFindingItem, required: One finding, with the attacks that reproduce it in `attacks`.
    - `finding_id` string, required
    - `lens` 'security' | 'safety' | 'quality' | 'policy', required: The kind of testing a finding came from.
    - `category` string, required
    - `severity` 'critical' | 'high' | 'medium' | 'low', required: Business-impact severity levels, ordered from most to least severe.
    - `description` string, required
    - `expected_behavior` string, required
    - `status` string, required
    - `created_at` string, required
    - `attacks` ApiAttackItem[], required
      - `attack_id` string, required
      - `score` integer, required
      - `source` ApiAttackSource, required: Provenance block of one attack in the external API response.
        - `source_type` 'manual' | 'adaptive_attacker' | 'compliance' | 'test_suite' | 'drill_down', required: What produced a finding's attack. An assessment, a compliance workflow, a test suite, a manual entry, or a follow-up on an existing finding.
        - `assessment_id` string, required
        - `attack_index` integer, required
        - `date` string, nullable, required
      - `replay_script` ReplayStepResponse[], required
        - `step` 'chat' | 'http' | 'assert', required
        - `message` string, nullable
        - `response` string, nullable
        - `session_id` string, nullable
        - `method` string, nullable
        - `url` string, nullable
        - `headers` object, nullable
        - `body` string, nullable
        - `response_status` integer, nullable
        - `response_body` string, nullable
        - `target` string, nullable
        - `assertion` string, nullable
        - `expected_behavior` string, nullable
        - `capture_as` string, nullable
      - `last_replay_status` 'pending' | 'succeeded' | 'failed' | 'inconclusive' | 'stale', required
      - `last_replayed_at` string, nullable
      - `created_at` string, required

## Other responses

- `403`: The workspace's plan withholds this finding's proof, so it cannot be re-run
- `404`: Finding not found
- `409`: A validation is already running for this finding
- `422`: The finding's target cannot be wired for replay
- `429`: Concurrency or daily replay cap exceeded

---

[API](https://skmtc.dev/enokilabs/apis/enoki-external-api.md) · [All operations](https://skmtc.dev/enokilabs/apis/enoki-external-api/llms.txt) · [OpenAPI document](https://skmtc.dev/enokilabs/apis/enoki-external-api/revisions/9b13fb6ab124?raw)