---
title: "Submit a pentest finding"
method: POST
path: "/v1/pentests/{pentest_slug}/findings/"
tags: ["pentests"]
---

# Submit a pentest finding

`POST /v1/pentests/{pentest_slug}/findings/`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/pentests/{pentest_slug}/findings/`
- Auth: none declared

Submit a new finding against a pentest.

Open to hackers and machine integrators contributing results to
the pentest. The submission is recorded together with its
reporting hacker association.

Args:
    pentest_slug (str): Public pentest identifier.
    body (SubmitFindingRequest): The finding submission payload.
    db (AsyncSession): Request-scoped database session.
    context (ActiveContext): Resolved caller identity and scope.

Returns:
    SubmitFindingResponse: The identifier of the submitted finding.

## Path parameters

- `pentest_slug` string, required

## Request body

- SubmitFindingRequest: Request body for submitting a finding against a pentest. Attributes: asset (str): Asset identifier/value the finding targets. severity (str): Finding severity label. cwe (int): CWE identifier. cve (str | None): CVE identifier (e.g. ``CVE-2024-1234``). score (float | None): CVSS score (0-10.0). cvss_vector (str | None): CVSS vector string. title (str): Finding title. markdown (str): Finding description in Markdown. attachments (list[int]): Attachment IDs. beacon_id (int | None): The beacon an engine scan ran through. Engine submissions resolve their asset behind it. url (str | None): The affected URL. Required for engine submissions -- it is what resolves the finding to an asset. module (str | None): The engine module that produced it. submodule (str | None): The module's template/submodule. confidence_level (str | None): The engine's confidence label. scan_id (int | None): The scan that produced it, linked after creation. job_id (int | None): The job that produced it. sponsored_content (str | None): Vendor content appended to the write-up. data (dict[str, Any]): Engine metadata, surfaced to triagers.
  - `asset` string, required: Asset identifier/value.
  - `severity` string, required: Severity label.
  - `cwe` integer, required: CWE identifier.
  - `cve` string, nullable: CVE identifier.
  - `score` number, nullable: CVSS score (0-10.0).
  - `cvss_vector` string, nullable: CVSS vector string.
  - `title` string, required: Finding title.
  - `markdown` string, required: Finding description in Markdown.
  - `attachments` integer[]: Attachment IDs.
  - `beacon_id` integer, nullable: Beacon the engine scanned through; the asset is resolved behind it.
  - `url` string, nullable: Affected URL; resolves the finding to an asset.
  - `module` string, nullable: Engine module that produced the finding.
  - `submodule` string, nullable: Engine submodule/template that produced the finding.
  - `confidence_level` string, nullable: Engine confidence label for the finding.
  - `scan_id` integer, nullable: Scan that produced the finding.
  - `job_id` integer, nullable: Job that produced the finding.
  - `sponsored_content` string, nullable: Vendor content appended to the write-up.
  - `data` object: Engine metadata, surfaced in the triager view.

## Response `200`

Successful Response

- SubmitFindingResponse: Response from a successful finding submission. Attributes: result (str): Operation result (``"success"``). finding_id (str): Created finding ID as hex string.
  - `result` string
  - `finding_id` string, required: Finding ID as hex string.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)