FIfireblocks
Security Posture Management

Update a FSPM security finding by ID

Accepts or reopens a finding for the workspace. When accepting a finding (status: "ACCEPTED"), statusUpdatedReason is required. Endpoint Roles: Security Admin.

Note: This endpoint is available only for the FSPM Pro package. It is not available for FSPM Basic.

patch/security/fspm/findings/{id}

Request

Path parameters

idstring uuid required

Unique identifier of the finding

Headers

Idempotency-Keystring

A unique identifier for the request. If the request is sent multiple times with the same idempotency key, the server will return the same response as the first request. The idempotency key is valid for 24 hours.

Request body

OR

Example request

{
  "status": "ACCEPTED",
  "statusUpdatedReason": "Risk accepted - compensating controls are in place"
}

Response

The updated FSPM finding

idstring uuid required

Unique identifier of the finding

status'OPEN' | 'ACCEPTED' | 'RESOLVED' required

Current status of the finding

severity'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' required

Severity level of the finding

category'USER_MANAGEMENT' | 'APPROVAL_GROUP_MANAGEMENT' | 'POLICY_ENGINE_UTILIZATION' | 'WORKSPACE_CONFIGURATION' | 'DEFI_ACCESS' | 'FLEET_MANAGEMENT' required

Category of the finding

createdAtstring date-time required

When the finding was first detected

titlestring required

Human-readable title of the finding

statusUpdatedAtstring date-time

When the finding status was last updated, omitted if the status was never updated

statusUpdatedByUserIdstring uuid

The user who last updated the finding status, omitted if the status was never updated

statusUpdatedReasonstring

The reason provided for the last status update, omitted if none was provided

infoFindingInfo required

Additional structured context about the finding. Shape varies by finding type.

riskExplanationstring required

Explanation of the risk this finding represents

mitigationGuidancestring required

Guidance on how to mitigate this finding

Example response

{
  "id": "2f8a132e-623d-3a97-841f-2c5d9b7a3e60",
  "status": "ACCEPTED",
  "severity": "MEDIUM",
  "category": "USER_MANAGEMENT",
  "createdAt": "2026-07-21T07:49:28.000Z",
  "title": "The API user 'Admin API' is missing an IP allowlist",
  "statusUpdatedAt": "2026-08-16T08:52:57.000Z",
  "statusUpdatedByUserId": "7c2e3a4f-144d-4f23-932c-518b3d7f1a09",
  "statusUpdatedReason": "False positive, the API user only ever connects from a fixed, trusted network",
  "info": {
    "id": "2a6f3c4e-9d33-437e-8f2a-2c9b4d3e1f35",
    "createdAt": "2026-05-12T12:06:26.242Z",
    "email": "",
    "enabled": true,
    "firstName": "Admin API",
    "isWhitelisted": false,
    "lastName": "testd6",
    "role": "ADMIN",
    "status": "READY",
    "tenantId": "6d13843c-4e2b-4a22-2c6f-3b8e3d4a7f52",
    "userType": "API"
  },
  "complianceReqs": [
    {
      "id": "8a1e6f19-1c4b-2d7e-2f1a-2b6c8d2e4f50",
      "standard": "SOC 2",
      "criteria": "CC6.2",
      "description": "Access provisioning and credential lifecycle"
    },
    {
      "id": "5e2b8e47-ea9c-ef36-8e2d-ea4b9c3e6f18",
      "standard": "SOC 2",
      "criteria": "CC6.3",
      "description": "Least privilege and attack surface, roles and SoD"
    }
  ],
  "riskExplanation": "This API user has no IP allowlist, so it can be accessed from anywhere, increasing the risk of unauthorized activity.",
  "mitigationGuidance": "Go to Developer Center > API Users, click the actions button (3 dots) next to the API user, and select 'Allowlist IP address'."
}

Changes

No recorded changes to this operation across all 1 revision of this API.