Skip to main content
POST
Mark vulnerability fixed

Authorizations

Authorization
string
header
required

JWT login token tied to your Perfai user (not a separate API key). Obtain it via POST /api/v1/auth/token with your username and password (use the returned id_token) — the same login the web console performs. Carries org, user, and role; short-lived.

Path Parameters

vulnerabilityId
string
required

MongoDB ObjectId of the finding — the id of an item from GET /apps/{appId}/vulnerabilities.

Body

application/json
comment
string

Why the finding was dismissed or marked fixed. Stored on the finding and, for dismissals, on the audit record.

Maximum string length: 1000

Response

Fix claim recorded.

status
enum<string>
required

State of the finding after the action.

Available options:
DISMISSED,
FIX_CLAIMED,
OPEN
vulnerability
object
required

A security finding, projected onto the public contract — internal test plumbing (token, decodedKey, errors, buildDetails) is never emitted. This is the same detail the Perfai dashboard shows a user. Only id, label, severity, path and method are present on every finding; every other field is conditional and omitted when the scan produced no value for it.