Skip to content
zkaozkaozkao docs
These docs describe staging.zkao.io and the @zksecurity/zkao-cli@next release. For production, see docs.zkao.io.

Change a finding's resolution status

PATCH
/projects/{projectId}/findings/{findingId}/resolution
curl --request PATCH \
  --url https://zkao.io/api/v1/projects/example/findings/example/resolution \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "resolutionStatus": "NOT_STARTED", "note": { "content": "example", "existingNoteId": "example" }, "reason": "fixed_in_code" }'

Requires scope: findings:write.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters”
projectId
required
string
findingId
required
string

The finding id, or the ZK- label shown on the finding page (the id’s last eight characters, prefix optional). A label that matches more than one finding in the project is refused with 409 conflict; use the full id.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
resolutionStatus
required
string
Allowed values: NOT_STARTED IN_PROGRESS RESOLVED WONT_FIX MITIGATED FALSE_POSITIVE DUPLICATE
note

Optionally attach or reuse a note alongside a resolution change.

object
content

Create a new note with this body.

string
existingNoteId

Reuse an existing note by id.

string
reason

Short code for why a finding is being closed, chosen from the set offered for the resolutionStatus it is sent with; a code belonging to a different status is rejected with 400. Ignored for the open statuses (NOT_STARTED, IN_PROGRESS) and when note is also given. It is not stored as a field: it is recorded as a comment on the finding stating what was chosen, which is returned by the notes endpoints.

Codes per status. RESOLVED: fixed_in_code, fixed_upstream, code_removed. MITIGATED: compensating_control, limited_exposure, monitored. FALSE_POSITIVE: not_reachable, guarded_elsewhere, intended_behavior, misread_code, bad_assumption. WONT_FIX: risk_accepted, out_of_scope, not_worth_fixing, code_being_removed. DUPLICATE: duplicate_of_finding, same_root_cause.

string
Allowed values: fixed_in_code fixed_upstream code_removed compensating_control limited_exposure monitored not_reachable guarded_elsewhere intended_behavior misread_code bad_assumption risk_accepted out_of_scope not_worth_fixing code_being_removed duplicate_of_finding same_root_cause
Example
not_reachable

Responses

Section titled “ Responses ”

200

Section titled “200”

OK

Media typeapplication/json
object
findingId
required
string
resolutionStatus
required
string
Allowed values: NOT_STARTED IN_PROGRESS RESOLVED WONT_FIX MITIGATED FALSE_POSITIVE DUPLICATE
Example
{
  "resolutionStatus": "NOT_STARTED"
}

400

Section titled “400”

Invalid request

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal
message
required
string
Example
{
  "error": {
    "code": "unauthorized"
  }
}

401

Section titled “401”

Missing, malformed, expired, or revoked token

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal
message
required
string
Example
{
  "error": {
    "code": "unauthorized"
  }
}

403

Section titled “403”

The token lacks the required scope

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal
message
required
string
Example
{
  "error": {
    "code": "unauthorized"
  }
}

404

Section titled “404”

Resource not in this token’s project or repo allowlist

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal
message
required
string
Example
{
  "error": {
    "code": "unauthorized"
  }
}

409

Section titled “409”

A compare-and-set (expectedContent) missed: the guidance changed since it was read. Re-read the current guidance and retry.

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal
message
required
string
Example
{
  "error": {
    "code": "unauthorized"
  }
}