> ## Documentation Index > Fetch the complete documentation index at: https://docs.perfai.ai/llms.txt > Use this file to discover all available pages before exploring further. # Reopen vulnerability > Returns a finding to the open list. Undoes a dismissal or a fix claim — whichever state the finding is in. ## OpenAPI ````yaml /api-reference/openapi.yaml post /vulnerabilities/{vulnerabilityId}/reopen openapi: 3.1.1 info: title: Perfai Security API version: 1.1.0 description: > Partner-facing REST API for automating Perfai security testing: register apps, trigger security tests and vision (browser-automation) runs, poll run status, and retrieve vulnerability findings. All endpoints are JWT-authenticated and scoped to the caller's organization; cross-tenant access returns 404 (never 403) to prevent enumeration. Errors follow RFC 9457 Problem Details. servers: - url: https://api.perfai.ai/v1 description: Perfai cloud - url: https://api.{customerDomain}/v1 description: On-premise deployment variables: customerDomain: default: example.com security: - bearerAuth: [] tags: - name: Apps description: App catalog — list, register, and poll registration. - name: Security Agent description: Trigger security tests and poll their lifecycle. - name: Vision Agent description: >- Trigger vision (browser-automation) runs and poll their lifecycle. Always browserless. - name: Vulnerabilities description: Retrieve security findings. - name: Reports description: List an app's security reports and download them as PDF. - name: Tasks description: Poll any asynchronous operation started by this API. paths: /vulnerabilities/{vulnerabilityId}/reopen: post: tags: - Vulnerabilities summary: Reopen vulnerability description: > Returns a finding to the open list. Undoes a dismissal or a fix claim — whichever state the finding is in. operationId: reopenVulnerability parameters: - $ref: '#/components/parameters/VulnerabilityId' responses: '200': description: Finding reopened. content: application/json: schema: $ref: '#/components/schemas/VulnerabilityActionResponse' '400': description: Finding is already open. '401': $ref: '#/components/responses/Unauthorized' '403': description: Caller has the Viewer role and cannot modify findings. '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/RateLimited' components: parameters: VulnerabilityId: name: vulnerabilityId in: path required: true schema: type: string description: > MongoDB ObjectId of the finding — the `id` of an item from GET /apps/{appId}/vulnerabilities. schemas: VulnerabilityActionResponse: type: object required: - status - vulnerability properties: status: type: string enum: - DISMISSED - FIX_CLAIMED - OPEN description: State of the finding after the action. vulnerability: $ref: '#/components/schemas/Vulnerability' Vulnerability: type: object description: > A security finding, projected onto the public contract — internal test plumbing (token, decodedKey, errors, buildDetails) is never emitted. This is the same detail the Perfai dashboard shows a user. Only id, label, severity, path and method are present on every finding; every other field is conditional and omitted when the scan produced no value for it. properties: id: type: string description: Finding identifier. Always present. label: type: string description: >- Canonical finding name from the security-category registry. Always present. title: type: string severity: type: string enum: - Critical - High - Medium - Low description: Always present. path: type: string description: API path where the issue was found. Always present. method: type: string description: HTTP method of the affected endpoint. Always present. uiPath: type: string description: UI route the finding was reproduced through. updated_severity: type: string description: Severity after a manual override. impact: type: string description: Business and security impact summary. issueType: type: string description: security or privacy. action: type: string description: Action classification the scanner assigned. intent: type: string description: Intended request behaviour the test exercised. owasp: type: string description: OWASP API Security Top 10 reference (e.g. API1:2023). cwe: type: string description: CWE identifier (e.g. CWE-639). cvss_score: type: number description: CVSS v3 base score (0.0-10.0). cvss_vector: type: string description: CVSS v3 vector string. isPII: type: boolean isPCI: type: boolean isHIPAA: type: boolean explainer: type: string description: Technical explanation of the vulnerability. remediation: type: string description: Recommended fix. additionalDetails: type: object additionalProperties: true description: > Deep-dive analysis when available: description, StepsToReproduce, impact_analysis, mitigation, long_solution, references, conclusion, copilot_prompt, workingExamples. Which keys are present varies by finding. request: type: string description: cURL reproducer for the authenticated request. response: type: object description: Response body observed for the authenticated request. unsecureRequest: type: string description: cURL reproducer for the same call made without authentication. unsecuredResponse: type: object description: Response body observed for the unauthenticated request. requestSchema: type: object description: JSON Schema of the request body. responseSchema: type: object description: JSON Schema of the response body. fields: type: array items: type: object description: >- Affected or sensitive fields, each with a name, data type and location. isFixed: type: boolean description: > Set by the platform once a previously-reported finding stops being detected by a later test. Not settable by callers. isDismissed: type: boolean fixClaimed: type: boolean description: > Someone asserted this finding is fixed — a claim pending verification, distinct from isFixed. If the next test still detects the finding, the claim is dropped and the finding stays open. fixClaimedAt: type: - string - 'null' format: date-time fixClaimedByEmail: type: - string - 'null' fixComment: type: - string - 'null' isCustomIssue: type: boolean description: true for a manually created finding. created_on: type: - string - 'null' format: date-time updated_on: type: - string - 'null' format: date-time additionalProperties: true Problem: type: object description: RFC 9457 Problem Details. properties: type: type: string description: Error type URI, e.g. https://perfai.ai/errors/app-already-registered title: type: string additionalProperties: true responses: Unauthorized: description: Missing or expired JWT. NotFound: description: Resource not found or belongs to a different tenant. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' RateLimited: description: >- Rate limit exceeded. Back off and retry after the Retry-After header value. headers: Retry-After: schema: type: integer description: Seconds to wait before retrying. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > JWT login token tied to your Perfai user (not a separate API key). Obtain it via POST /api/v1/auth/token with your username and password (use the returned id_token) — the same login the web console performs. Carries org, user, and role; short-lived. ````