---
title: "Mcp Mark Code Scan Finding Treated"
method: POST
path: "/v1/mcp/projects/{project_id}/code-scan/findings/treated"
tags: ["mcp"]
---

# Mcp Mark Code Scan Finding Treated

`POST /v1/mcp/projects/{project_id}/code-scan/findings/treated`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/mcp/projects/{project_id}/code-scan/findings/treated`
- Auth: none declared

Record that a hardcoded string became a key (mcp:*).

MCP twin of `POST /v1/projects/{id}/code-scan/findings/{id}/treated`. The
finding id goes in the BODY here rather than the path, so the tool schema
stays one flat object like the other MCP writes.

IDEMPOTENT: re-marking the same finding with the same key returns the row
unchanged and does NOT move `treated_at`. An unknown `finding_id` is a 404 —
it never silently creates a finding, so a typo cannot invent a treated
record that no scan ever reported.

## Path parameters

- `project_id` string, required

## Request body

- McpCodeScanTreatedIn
  - `finding_id` string, required: uuid of the finding (from list_code_scan_findings).
  - `key` string, required: The key NAME this hardcoded string became.
  - `namespace` string, nullable: Namespace slug of the key. Send it (with the key you just created) so the backend verifies the key EXISTS before marking treated — a treated finding then points at a real key. Omitting it keeps the legacy unchecked behaviour.

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)