Reopen vulnerability
Returns a finding to the open list. Undoes a dismissal or a fix claim — whichever state the finding is in.
Authorizations
JWT login token tied to your Perfai user (not a separate API key). Obtain it via POST /api/v1/auth/token with your username and password (use the returned id_token) — the same login the web console performs. Carries org, user, and role; short-lived.
Path Parameters
MongoDB ObjectId of the finding — the id of an item from GET /apps/{appId}/vulnerabilities.
Response
Finding reopened.
State of the finding after the action.
DISMISSED, FIX_CLAIMED, OPEN A security finding, projected onto the public contract — internal test plumbing (token, decodedKey, errors, buildDetails) is never emitted. This is the same detail the Perfai dashboard shows a user. Only id, label, severity, path and method are present on every finding; every other field is conditional and omitted when the scan produced no value for it.

