Skip to main content
PATCH
Update a penetration test finding status

Authorizations

X-API-Key
string
header
required

API key for authentication

Headers

X-Organization-Id
string

Organization ID (required for session auth, optional for API key auth)

Path Parameters

id
string
required
issueId
string
required

Body

application/json
status
enum<string>
required

New status for the finding. false_positive and wont_fix dispute the finding and require a justification note.

Available options:
open,
acknowledged,
resolved,
false_positive,
wont_fix
Example:

"false_positive"

note
string

Justification for the status change. REQUIRED, and at least 20 characters after trimming, when status is false_positive or wont_fix. Optional and unconstrained for the other statuses. Recorded in the finding's status history, written to the Comp audit log, and shared with the testing agent on future scans of the same target.

Maximum string length: 2000
Example:

"This endpoint is internal-only and unreachable from the public internet — the scanner reached it through the staging bastion, which is not a production path."

Response

Updated finding returned