---
title: "Mark Code Scan Finding Treated"
method: POST
path: "/v1/projects/{project_id}/code-scan/findings/{finding_id}/treated"
tags: ["code-scan"]
---

# Mark Code Scan Finding Treated

`POST /v1/projects/{project_id}/code-scan/findings/{finding_id}/treated`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/projects/{project_id}/code-scan/findings/{finding_id}/treated`
- Auth: none declared

Record that this hardcoded string became a key (Developer+).

IDEMPOTENT: re-marking an already-treated finding with the SAME (namespace,
key) returns the existing row untouched — `treated_at` does not move, so a
client retry cannot rewrite when the decision was taken. An unknown
`finding_id` is a 404, never a silent create. When `namespace` is given and
the key does not exist there, the request is refused **422** — `treated` may
not point at a key that does not exist.

## Path parameters

- `project_id` string, required
- `finding_id` string, required

## Request body

- CodeScanTreatedIn
  - `key` string, required: The key name this string became.
  - `namespace` string, nullable: Namespace slug of the key. When given, the key MUST exist as an active key of that namespace on this project (else 422) — so `treated` points at a real key. Omit for the legacy behaviour (records the key string with no check).

## Response `200`

Successful Response

- CodeScanFindingOut
  - `uuid` string, required
  - `fingerprint` string, required
  - `file` string, required
  - `line` integer, required
  - `column` integer, nullable
  - `string` string, required
  - `status` string, required
  - `category` string: Scanner classification: keyless / key_default / unknown. `unknown` for findings recorded before the field existed.
  - `source` string, nullable: Where the text lives: `attribute` | `element` | null. Display only. null for findings recorded before the field existed, or when the scan omitted it.
  - `source_name` string, nullable: Attribute name or tag/component name (e.g. `placeholder`, `button`, `Foo.Bar`); null when unknown. Display only.
  - `suggested_namespace` string, nullable
  - `treated_key` string, nullable
  - `treated_namespace` string, nullable: Namespace of the treated key, when it was validated at treat time.
  - `treated_at` string, date-time, nullable
  - `first_seen_scan_id` string, required
  - `last_seen_scan_id` string, required
  - `first_seen_at` string, date-time, nullable
  - `last_seen_at` string, date-time, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)