> ## Documentation Index > Fetch the complete documentation index at: https://www.trycomp.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update a penetration test finding status | Comp AI API > Triage or dispute a single penetration test finding. Marking one `false_positive` or `wont_fix` requires a justification note, recorded in the finding's. ## OpenAPI ````yaml /openapi.json patch /v1/security-penetration-tests/{id}/issues/{issueId} openapi: 3.0.0 info: title: Comp AI API description: >- Compliance automation API for SOC 2, ISO 27001, HIPAA, GDPR, evidence collection, policy workflows, Trust Access, security questionnaires, integrations, cloud checks, and device compliance. version: '1.0' contact: {} servers: - url: https://api.trycomp.ai description: Production API Server security: [] tags: - name: Attachments description: >- Generate signed download links for files attached to compliance tasks, comments, evidence records, and workflow reviews. - name: Audit Logs description: >- Retrieve audit trails for compliance activity, evidence changes, access decisions, and customer-facing security review workflows. - name: CloudSecurity description: >- Run AWS, Azure, and GCP cloud security scans, detect enabled services, review findings, and connect cloud posture results to compliance work. x-group: Cloud Security - name: Comments description: >- Create and manage collaboration comments on compliance entities such as tasks, policies, risks, vendors, and findings. - name: Context description: >- Manage organization context that helps Comp AI tailor policies, assessments, and compliance automation to the business. - name: Controls description: >- Manage controls, map them to policies, tasks, framework requirements, and evidence document types, and track implementation progress. - name: Device Agent description: >- Register employee devices, submit device compliance check-ins, download agent builds, and manage endpoint security status. - name: Devices description: >- Read and manage employee device inventory and Fleet compliance data used for endpoint security controls. - name: Evidence Export description: >- Export task evidence, automation evidence, and reviewer-ready evidence bundles as PDF or ZIP files. - name: Evidence Export (Auditor) description: Export all organization evidence for an auditor review package. - name: Evidence Forms description: >- Collect, review, upload, and export structured evidence submissions for compliance tasks and document requirements. - name: Findings description: >- Create, review, update, and track audit findings, remediation activity, and finding history for an organization. - name: Frameworks description: >- Manage SOC 2, ISO 27001, HIPAA, GDPR, and custom framework instances, requirements, scores, and sync history. - name: ISMS description: >- Build and maintain the ISO 27001 ISMS document set — scope, leadership commitment, context, interested parties, objectives, roles, monitoring, internal audit, and management review. - name: Integrations description: >- Connect vendor systems, configure OAuth apps, run compliance checks, sync employees, manage variables, and collect automated evidence. - name: Knowledge Base description: >- Upload source documents, process them for retrieval, and manage reusable manual answers that power questionnaires and AI policy workflows. - name: Offboarding Checklist - name: Org Chart description: >- Manage organization chart metadata and evidence used for governance, accountability, and audit readiness. - name: Organization description: >- Manage organization profile data, API keys, logos, ownership, role notifications, and access approval settings. - name: People description: >- Invite and manage workforce members, training status, device compliance, email preferences, and employee evidence records. - name: Policies description: >- Create, version, publish, export, map, and improve compliance policies with AI-assisted drafting and approval workflows. - name: Questionnaire description: >- Parse security questionnaires, generate answers from approved evidence, save reviewer edits, stream progress, and export completed files. - name: Risks description: >- Create, update, and report on organizational risks with ownership, departments, and compliance remediation status. - name: Roles description: >- Create custom roles and resolve permission sets for organization-level access control. - name: SOA description: >- Create, auto-fill, review, approve, and export ISO 27001 Statement of Applicability documents. x-group: Statement of Applicability - name: Security Penetration Tests description: >- Create AI-powered penetration test runs, track progress, inspect findings and events, and download markdown or PDF reports. - name: Task Automations description: >- Create, version, run, and inspect automated evidence collection workflows attached to compliance tasks. - name: Task Management description: >- Manage task items and attachments linked to operational entities such as risks and vendors. - name: Tasks description: >- Manage compliance task lifecycle, assignments, review approvals, evidence uploads, policy links, and activity history. - name: Timelines description: >- Track audit and compliance readiness timelines, phases, and review milestones for an organization. - name: Training description: >- Record security awareness and HIPAA training completion status and generate completion certificates. - name: Trust Access description: >- Manage external Trust Center access requests, NDA signing, grants, tokenized document downloads, public FAQs, and reviewer access. - name: Trust Portal description: >- Configure the live Trust Center, custom domain, public overview, FAQs, compliance resources, documents, links, and vendor disclosures. - name: Uploads - name: Vendors description: >- Manage third-party vendors, global vendor search, risk assessment triggers, and Trust Center vendor visibility. paths: /v1/security-penetration-tests/{id}/issues/{issueId}: patch: tags: - Security Penetration Tests summary: Update a penetration test finding status description: >- Triage or dispute a single penetration test finding. Marking one `false_positive` or `wont_fix` requires a justification note, recorded in the finding's status history and the audit log. Requires `pentest:update`. operationId: SecurityPenetrationTestsController_updateFindingStatus_v1 parameters: - name: X-Organization-Id in: header description: >- Organization ID (required for session auth, optional for API key auth) required: false schema: type: string - name: id required: true in: path schema: type: string - name: issueId required: true in: path schema: type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateFindingStatusDto' responses: '200': description: Updated finding returned '400': description: Invalid status, or a dismissive status sent without a note '404': description: Run or finding not found security: - apikey: [] components: schemas: UpdateFindingStatusDto: type: object properties: status: type: string description: >- New status for the finding. `false_positive` and `wont_fix` dispute the finding and require a justification note. enum: - open - acknowledged - resolved - false_positive - wont_fix example: false_positive note: type: string description: >- Justification for the status change. REQUIRED, and at least 20 characters after trimming, when status is `false_positive` or `wont_fix`. Optional and unconstrained for the other statuses. Recorded in the finding's status history, written to the Comp audit log, and shared with the testing agent on future scans of the same target. example: >- This endpoint is internal-only and unreachable from the public internet — the scanner reached it through the staging bastion, which is not a production path. maxLength: 2000 required: - status securitySchemes: apikey: type: apiKey in: header name: X-API-Key description: API key for authentication ````