Bulk Update Finding State

Bulk update finding states.

POST /api/v1/findings/bulk/state

BulkUpdateFindingState

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.Finding.BulkUpdateFindingState(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.BulkUpdateFindingStateResponse != nil {
        // handle response
    }
}

200

{
  "bulkActionId": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The BulkUpdateFindingStateRequest message.

This message contains a oneof named action. Only a single field of the following list may be set at a time:

• snooze
• suppress
• acceptRisk
• unsuppress
• assignOwner
• reopen
• reprocess

acceptRisk · Bulk Accept Risk Action · object | null

The BulkAcceptRiskAction message.

Show child attributes

assignOwner · Bulk Assign Owner Action · object | null

The BulkAssignOwnerAction message.

Show child attributes

refs · Finding Ref · object[] | null

By-ID mode: specify individual finding refs.

Show child attributes

reopen · Bulk Reopen Action · object | null

The BulkReopenAction message.

reprocess · Bulk Reprocess Action · object | null

BulkReprocessAction re-evaluates eligible findings against transformation and routing rules using each finding's original detector-created state (original severity, original annotations) rather than any rule-mutated current state.

override_human_edits chooses how far re-derivation goes for human-attributed edits:

• Open findings are re-derived and re-routed in both modes.
• Findings parked by a rule (snoozed, suppressed, or risk-accepted by a routing rule with no subsequent human action) are released to open, re-derived, and re-routed in both modes.
• Findings parked by a person re-derive their content in both modes, but the state is only released, and a human severity override only cleared, when override_human_edits is true.
• Findings in progress re-derive their content and keep both their state and any linked ticket in both modes.
• Resolved, archived, and deleted findings are skipped in both modes.

Assigned owners and ticket links are never touched; rules do not derive them.

Show child attributes

searchRequest · Finding Search Request · object | null

The FindingSearchRequest message.

Show child attributes

snooze · Bulk Snooze Action · object | null

The BulkSnoozeAction message.

Show child attributes

suppress · Bulk Suppress Action · object | null

The BulkSuppressAction message.

Show child attributes

unsuppress · Bulk Unsuppress Action · object | null · deprecated

The BulkUnsuppressAction message.

Response

200 - application/json

Successful response

The BulkUpdateFindingStateResponse message.

bulkActionId · string

The ID of the asynchronous bulk action, which can be used to track progress.