---
title: "Update Status"
method: POST
path: "/api/v2/issues/updateStatus"
tags: ["Issues"]
---

# Update Status

`POST /api/v2/issues/updateStatus`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/issues/updateStatus`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Update the workflow status of one or more issues. Accepts statuses: PENDING_REVIEW, REVIEWING, PATCHING, NON_EXPLOITABLE, FALSE_POSITIVE, ACCEPTED_RISK, RESOLVED, BACKLOG, INFORMATIONAL. Special behaviors: FALSE_POSITIVE records a false-positive validation judgment and generates embeddings for future triage. NON_EXPLOITABLE records a non-exploitable validation judgment (sets validated to DISCONFIRMED) and persists NON_EXPLOITABLE status. ACCEPTED_RISK triggers archiving with timestamps. Setting PENDING_REVIEW on archived issues triggers unarchiving (requires archive permission).

## Request body

- object
  - `organizationId` string
  - `issueIds` string[], required
  - `issueStatus` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
  - `reason` string
  - `acceptedRiskExpiresAt` string, date-time, nullable: Only valid with issueStatus ACCEPTED_RISK: when the risk acceptance expires, as a future ISO 8601 date-time. When it expires the issue returns to PENDING_REVIEW, unless it has been resolved or marked a false positive since, in which case it keeps that status. Omit it or send null to accept the risk until the issue is reopened.
  - `expected` object: Optional check that the issue has not changed since you read it: the issueStatus and updatedAt returned by issues.get. The update is refused with 409 ISSUE_MOVE_STALE if either differs. Only valid when issueIds names exactly one issue. Omit it to update the issue as it is now.
    - `status` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
    - `updatedAt` string, date-time, required

## Response `200`

Status updated

- object
  - `ok` boolean
  - `updatedCount` number

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)