Skip to main content
POST
Create a finding

Authorizations

Authorization
string
header
required

A Tolmo API token, sent as Authorization: Bearer <token>. Either a user token (usr_tok.*, minted by tolmo auth login, scoped to your own permissions) or an org API token created in the Tolmo app, for CI and automation.

Path Parameters

orgSlug
string
required

Body

application/json
title
string
required
Required string length: 1 - 512
severity
enum<string>
required
Available options:
critical,
high,
medium,
low,
info
description
string
required
resourceName
string | null
Maximum string length: 512
resourceKey
string | null
Maximum string length: 2048
resourceType
string | null
Maximum string length: 128
resourceArn
string | null
Maximum string length: 2048
targetUrl
string | null
Maximum string length: 2048
category
string | null
Maximum string length: 48
tags
string[]
Maximum array length: 24
Maximum string length: 48
cwe
string | null
Maximum string length: 16
sourceAgentName
string | null
Maximum string length: 128
sourceName
string
default:Tolmo
Maximum string length: 256
workflowRunId
string<uuid> | null
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
modusOperandi
string | null
visibility
enum<string>
default:published
Available options:
draft,
published
status
enum<string>
default:open
Available options:
open,
in_review,
closed,
acknowledged,
false_positive,
canceled

Response

Default Response

id
string
required
orgId
string
required
agentId
string | null
required
sourceAgentName
string | null
required
isManual
boolean
required
shownVerbatim
boolean
required
severity
string
required
title
string
required
description
string
required
resourceType
string | null
required
resourceName
string | null
required
resourceArn
string | null
required
resourceKey
string | null
required
targetUrl
string | null
required
category
string | null
required
tags
string[]
required
cwe
string | null
required
owasp
string | null
required
status
string
required
visibility
string
required
taskIds
any
required
tickets
object[]
required
acknowledgedAt
string | null
required
acknowledgedBy
string | null
required
falsePositiveReason
string | null
required
closedReason
string | null
required
sourceName
string
required
ingestionStatus
string | null
required
ingestedAt
string | null
required
createdAt
string
required
updatedAt
string
required
attachmentCount
integer
Required range: 0 <= x <= 9007199254740991
sourceSecret
object | null