Update Finding State

Update finding workflow state (snooze, accept risk, suppress, reopen, resolve).

POST /api/v1/findings/{finding_id}/state

UpdateFindingState

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/operations"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.Finding.UpdateFindingState(ctx, operations.C1APIFindingV1FindingServiceUpdateFindingStateRequest{
        FindingID: "<id>",
    })
    if err != nil {
        log.Fatal(err)
    }
    if res.UpdateFindingStateResponse != nil {
        // handle response
    }
}

200

{
  "finding": {
    "annotations": {},
    "appId": "<string>",
    "appResourceTarget": {
      "appId": "<string>",
      "appResourceId": "<string>",
      "appResourceTypeId": "<string>"
    },
    "appUserTarget": {
      "appId": "<string>",
      "appUserId": "<string>"
    },
    "assignedOwner": {
      "appOwnerAppId": "<string>",
      "identityUserId": "<string>",
      "managerOfUserId": "<string>",
      "userSetId": "<string>"
    },
    "assigneeIdentityUserId": "<string>",
    "computedOwner": {
      "appOwnerAppId": "<string>",
      "identityUserId": "<string>",
      "managerOfUserId": "<string>",
      "userSetId": "<string>"
    },
    "connectorAnomalyDetectionDisabled": {},
    "connectorSyncFailing": {},
    "connectorSyncFailingEvidence": {
      "consecutiveFailureCount": 123,
      "lastFailedAt": "2023-11-07T05:31:56Z",
      "lastSyncLifecycleId": "<string>",
      "streakStartedAt": "2023-11-07T05:31:56Z"
    },
    "connectorTarget": {
      "appId": "<string>",
      "connectorId": "<string>"
    },
    "createdAt": "2023-11-07T05:31:56Z",
    "credentialExpiring": {
      "credentialDisplayName": "<string>",
      "userClientId": "<string>"
    },
    "credentialExpiringEvidence": {
      "expired": true,
      "expiresAt": "2023-11-07T05:31:56Z"
    },
    "credentialPubliclyExposed": {
      "connectorClientId": "<string>",
      "connectorManagedCredentialId": "<string>",
      "credentialDisplayName": "<string>",
      "functionClientId": "<string>",
      "userClientId": "<string>"
    },
    "credentialPubliclyExposedEvidence": {
      "credentialRevoked": true,
      "fingerprintPrefix": "<string>",
      "firstObservedAt": "2023-11-07T05:31:56Z",
      "firstScannerId": "<string>",
      "reportingScanners": [
        "<string>"
      ],
      "revokedAt": "2023-11-07T05:31:56Z",
      "sourceKind": "<string>",
      "sourceUrl": "<string>"
    },
    "custom": {},
    "customSubType": "<string>",
    "customTags": {},
    "deactivatedOwner": {
      "source": "DEACTIVATED_OWNER_SOURCE_UNSPECIFIED"
    },
    "deactivatedOwnerEvidence": {
      "deactivatedOwners": [
        {
          "reason": "DEACTIVATED_OWNER_REASON_UNSPECIFIED",
          "userId": "<string>"
        }
      ]
    },
    "decoyCredentialUsed": {
      "decoyId": "<string>",
      "kind": "DECOY_CREDENTIAL_KIND_UNSPECIFIED"
    },
    "decoyPubliclyExposed": {
      "decoyDisplayName": "<string>",
      "decoyId": "<string>"
    },
    "decoyPubliclyExposedEvidence": {
      "credentialRevoked": true,
      "fingerprintPrefix": "<string>",
      "firstObservedAt": "2023-11-07T05:31:56Z",
      "firstScannerId": "<string>",
      "reportingScanners": [
        "<string>"
      ],
      "revokedAt": "2023-11-07T05:31:56Z",
      "sourceKind": "<string>",
      "sourceUrl": "<string>"
    },
    "decoyTarget": {
      "decoyId": "<string>"
    },
    "dedupKeyParts": [
      "<string>"
    ],
    "description": "<string>",
    "fingerprint": "<string>",
    "firstObservedAt": "2023-11-07T05:31:56Z",
    "id": "<string>",
    "identityUserTarget": {
      "identityUserId": "<string>"
    },
    "lastAppearedAt": "2023-11-07T05:31:56Z",
    "lastObservedAt": "2023-11-07T05:31:56Z",
    "nhiUnowned": {},
    "objectPermissions": {
      "delete": true,
      "edit": true,
      "extra": {},
      "read": true
    },
    "recurrenceCount": 123,
    "remediationDescription": "<string>",
    "resolvedAt": "2023-11-07T05:31:56Z",
    "riskAcceptanceExpiresAt": "2023-11-07T05:31:56Z",
    "riskAcceptanceJustification": "<string>",
    "riskScore": {
      "originalScore": 123,
      "overrideByUserId": "<string>",
      "overrideScore": 123,
      "riskFactors": [
        {
          "description": "<string>",
          "name": "<string>",
          "severity": "FINDING_SEVERITY_UNSPECIFIED",
          "weight": 123
        }
      ],
      "score": 123,
      "systemScore": 123
    },
    "serviceAccountMisclassification": {
      "currentAccountType": "APP_USER_TYPE_UNSPECIFIED",
      "detectedAccountType": "APP_USER_TYPE_UNSPECIFIED"
    },
    "serviceAccountMisclassificationEvidence": {
      "detectionReason": "<string>"
    },
    "serviceAccountUnowned": {},
    "severity": "FINDING_SEVERITY_UNSPECIFIED",
    "shadowMcp": {
      "mcpIdentifier": "<string>"
    },
    "shadowMcpEvidence": {
      "deviceCount": 123,
      "userCount": 123
    },
    "similarUsernameMatch": {
      "proposedIdentityUserId": "<string>"
    },
    "similarUsernameMatchEvidence": {
      "appUsername": "<string>",
      "identityUsername": "<string>",
      "similarityScore": 123
    },
    "snoozeReason": "<string>",
    "snoozeUntil": "2023-11-07T05:31:56Z",
    "sourceDetectorId": "<string>",
    "sourceKind": "FINDING_SOURCE_KIND_UNSPECIFIED",
    "state": "FINDING_STATE_UNSPECIFIED",
    "stateUpdatedById": "<string>",
    "suppressReason": "<string>",
    "taskId": "<string>",
    "tenantTarget": {},
    "unusedSecret": {},
    "unusedSecretEvidence": {
      "lastUsedAt": "2023-11-07T05:31:56Z"
    },
    "updatedAt": "2023-11-07T05:31:56Z"
  }
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Path Parameters

finding_id · string · required

The ID of the finding whose state to update.

Body

application/json

The UpdateFindingStateRequest message.

This message contains a oneof named action. Only a single field of the following list may be set at a time:

• snooze
• suppress
• acceptRisk
• unsuppress
• resolve
• reopen

acceptRisk · Accept Risk Action · object | null

AcceptRiskAction parameters for UpdateFindingState.

Show child attributes

reopen · Reopen Action · object | null

ReopenAction parameters for UpdateFindingState.

resolve · Resolve Action · object | null

ResolveAction parameters for UpdateFindingState (manual resolve).

Show child attributes

snooze · Snooze Action · object | null

SnoozeAction parameters for UpdateFindingState.

Show child attributes

suppress · Suppress State Action · object | null

SuppressStateAction parameters for UpdateFindingState.

Show child attributes

unsuppress · Unsuppress Action · object | null · deprecated

UnsuppressAction parameters for UpdateFindingState.

Response

200 - application/json

Successful response

The UpdateFindingStateResponse message.

finding · Finding · object | null

The Finding message.

This message contains a oneof named finding_type. Only a single field of the following list may be set at a time:

• similarUsernameMatch
• serviceAccountMisclassification
• nhiUnowned
• serviceAccountUnowned
• decoyCredentialUsed
• custom
• connectorAnomalyDetectionDisabled
• deactivatedOwner
• unusedSecret
• credentialPubliclyExposed
• decoyPubliclyExposed
• credentialExpiring
• connectorSyncFailing
• shadowMcp

This message contains a oneof named target. Only a single field of the following list may be set at a time:

• identityUserTarget
• appUserTarget
• decoyTarget
• appResourceTarget
• tenantTarget
• connectorTarget

This message contains a oneof named evidence. Only a single field of the following list may be set at a time:

• similarUsernameMatchEvidence
• serviceAccountMisclassificationEvidence
• deactivatedOwnerEvidence
• unusedSecretEvidence
• credentialPubliclyExposedEvidence
• decoyPubliclyExposedEvidence
• credentialExpiringEvidence
• connectorSyncFailingEvidence
• shadowMcpEvidence

Show child attributes