Mark vulnerability fixed
Records that you have fixed the finding. This is a claim pending verification, not a verified result: if the next security test still detects the finding, the claim is dropped and the finding stays open. Reported separately from isFixed, which the platform sets on its own once a finding stops being detected.
Authorizations
JWT login token tied to your Perfai user (not a separate API key). Obtain it via POST /api/v1/auth/token with your username and password (use the returned id_token) — the same login the web console performs. Carries org, user, and role; short-lived.
Path Parameters
MongoDB ObjectId of the finding — the id of an item from GET /apps/{appId}/vulnerabilities.
Body
Why the finding was dismissed or marked fixed. Stored on the finding and, for dismissals, on the audit record.
1000Response
Fix claim recorded.
State of the finding after the action.
DISMISSED, FIX_CLAIMED, OPEN A security finding, projected onto the public contract — internal test plumbing (token, decodedKey, errors, buildDetails) is never emitted. This is the same detail the Perfai dashboard shows a user. Only id, label, severity, path and method are present on every finding; every other field is conditional and omitted when the scan produced no value for it.

