Findings

Change a finding's status

Sets open, in_progress, accepted, suppressed or false_positive, with an optional note. resolved is set by an assessment that observes the fix; a person may set it only on manual and imported findings, which nothing will check again. A resolved finding is reopened before it is given another status.

patch/v1/findings/{findingId}

Request

  • Base URL: https://api.ironfang.com/security
  • URL: https://api.ironfang.com/security/v1/findings/{findingId}
  • Auth: HTTP bearer

Request body

notestring
status'open' | 'in_progress' | 'accepted' | 'suppressed' | 'false_positive' | 'resolved' required

resolved only on manual and imported findings. The names used before 0.2.0 (acknowledged, accepted_risk) are accepted for one release.

Response

The finding.

category'dns' | 'tls' | 'http' | 'email' | 'exposure' | 'technology' | 'discovery' | 'configuration' | 'vulnerability' | 'access_control' | 'authentication' | 'secrets' | 'network' | 'logging' | 'malware' | 'data_protection' | 'other' required

The area a finding is in; the first seven are the External Security Check's.

check_idstring required

Canonical, namespaced and permanent, e.g. ironfang.http.hsts_missing.

confidence'confirmed' | 'high' | 'medium' | 'low' required

How sure Ironfang is. low is presented as "potential".

detailstring

What was observed in this instance.

domain_idstring uuid required

asset.id.

first_seen_atstring date-time required
hoststring required

resource.identifier.

idstring uuid required
keystring required

The producer's own key (the catalogue key, e.g. http.hsts_missing, for the External Security Check). Use check_id.

kind'issue' | 'hardening' | 'informational' | 'potential_vulnerability' required
last_seen_atstring date-time required
resolved_atstring date-time
severity'critical' | 'high' | 'medium' | 'low' | 'info' required
status'open' | 'in_progress' | 'resolved' | 'accepted' | 'suppressed' | 'false_positive' required

open and in_progress still ask something of you. resolved is no longer present. accepted is real with the risk accepted; suppressed is hidden without a judgement; false_positive is not real.

titlestring required
verification'unverified' | 'fixed_verified' | 'still_present' required

Whether an assessment has confirmed the current state.

cwestring

The first cwe classification.

descriptionstring
docs_urlstring uri
fingerprintstring required

SHA-256 of the finding's identity (docs: the Ironfang Finding Format).

fixstring required

remediation.guidance.

impactstring

Why it matters.

notestring

The latest note recorded with a status change.

referencesstring[] required
summarystring required

What this kind of issue is.

whystring required

impact.

Changes

No recorded changes to this operation across all 1 revision of this API.