Findings
Update a finding's status
Transition a finding between open, in_review, acknowledged, closed, false_positive, and canceled. The transition is recorded in the finding’s status history with its actor, so the change is auditable. On a scanner row (GitHub, Wiz, and the rest) this writes provider_status and does not call the provider; canceled is refused. A later scan that still reports the alert overwrites that provider status.
PATCH
/
api
/
v1
/
orgs
/
{orgSlug}
/
findings
/
{findingId}
/
status
Update a finding's status
curl --request PATCH \
--url https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"falsePositiveReason": "<string>",
"closedReason": "<string>",
"inReviewReason": "<string>",
"inReviewUrl": "<string>"
}
'import requests
url = "https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status"
payload = {
"falsePositiveReason": "<string>",
"closedReason": "<string>",
"inReviewReason": "<string>",
"inReviewUrl": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
falsePositiveReason: '<string>',
closedReason: '<string>',
inReviewReason: '<string>',
inReviewUrl: '<string>'
})
};
fetch('https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'falsePositiveReason' => '<string>',
'closedReason' => '<string>',
'inReviewReason' => '<string>',
'inReviewUrl' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status"
payload := strings.NewReader("{\n \"falsePositiveReason\": \"<string>\",\n \"closedReason\": \"<string>\",\n \"inReviewReason\": \"<string>\",\n \"inReviewUrl\": \"<string>\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"falsePositiveReason\": \"<string>\",\n \"closedReason\": \"<string>\",\n \"inReviewReason\": \"<string>\",\n \"inReviewUrl\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"falsePositiveReason\": \"<string>\",\n \"closedReason\": \"<string>\",\n \"inReviewReason\": \"<string>\",\n \"inReviewUrl\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"orgId": "<string>",
"agentId": "<string>",
"sourceAgentName": "<string>",
"isManual": true,
"shownVerbatim": true,
"severity": "<string>",
"title": "<string>",
"description": "<string>",
"resourceType": "<string>",
"resourceName": "<string>",
"resourceArn": "<string>",
"resourceKey": "<string>",
"targetUrl": "<string>",
"category": "<string>",
"tags": [
"<string>"
],
"cwe": "<string>",
"owasp": "<string>",
"status": "<string>",
"visibility": "<string>",
"taskIds": "<unknown>",
"tickets": [
{
"id": "<string>",
"provider": "<string>",
"integrationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"accountAlias": "<string>",
"externalId": "<string>",
"identifier": "<string>",
"url": "<string>",
"createdAt": "<string>",
"syncStatus": "syncing",
"syncError": "<string>",
"syncedAt": "<string>"
}
],
"acknowledgedAt": "<string>",
"acknowledgedBy": "<string>",
"falsePositiveReason": "<string>",
"closedReason": "<string>",
"inReviewReason": "<string>",
"inReviewUrl": "<string>",
"sourceName": "<string>",
"origin": "<string>",
"ingestionStatus": "<string>",
"ingestedAt": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"attachmentCount": 4503599627370495,
"sourceSecret": {
"secretFindingId": "<string>",
"ruleId": "<string>",
"verificationState": "<string>",
"isActive": true,
"activeLastSeenAt": "<string>",
"lastValidatedAt": "<string>",
"validationMethod": "<string>"
},
"exploits": [
{
"id": "<string>",
"steps": [
"<string>"
],
"resultsAtExploitTime": "<string>",
"retestProbe": "<string>",
"oracle": "<string>",
"drivenBy": "<string>",
"createdAt": "<string>",
"exploitedAt": "<string>",
"lineageId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
]
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}Authorizations
A Tolmo API token, sent as Authorization: Bearer <token>. Either a user token (usr_tok.*, minted by tolmo auth login, scoped to your own permissions) or an org API token created in the Tolmo app, for CI and automation.
Body
application/json
Available options:
open, in_review, closed, acknowledged, false_positive, canceled Maximum string length:
4096Maximum string length:
4096Maximum string length:
4096Maximum string length:
2048Response
Default Response
Show child attributes
Show child attributes
Required range:
0 <= x <= 9007199254740991Show child attributes
Show child attributes
Show child attributes
Show child attributes
⌘I
Update a finding's status
curl --request PATCH \
--url https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"falsePositiveReason": "<string>",
"closedReason": "<string>",
"inReviewReason": "<string>",
"inReviewUrl": "<string>"
}
'import requests
url = "https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status"
payload = {
"falsePositiveReason": "<string>",
"closedReason": "<string>",
"inReviewReason": "<string>",
"inReviewUrl": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
falsePositiveReason: '<string>',
closedReason: '<string>',
inReviewReason: '<string>',
inReviewUrl: '<string>'
})
};
fetch('https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'falsePositiveReason' => '<string>',
'closedReason' => '<string>',
'inReviewReason' => '<string>',
'inReviewUrl' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status"
payload := strings.NewReader("{\n \"falsePositiveReason\": \"<string>\",\n \"closedReason\": \"<string>\",\n \"inReviewReason\": \"<string>\",\n \"inReviewUrl\": \"<string>\"\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"falsePositiveReason\": \"<string>\",\n \"closedReason\": \"<string>\",\n \"inReviewReason\": \"<string>\",\n \"inReviewUrl\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.tolmo.com/api/v1/orgs/{orgSlug}/findings/{findingId}/status")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"falsePositiveReason\": \"<string>\",\n \"closedReason\": \"<string>\",\n \"inReviewReason\": \"<string>\",\n \"inReviewUrl\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"id": "<string>",
"orgId": "<string>",
"agentId": "<string>",
"sourceAgentName": "<string>",
"isManual": true,
"shownVerbatim": true,
"severity": "<string>",
"title": "<string>",
"description": "<string>",
"resourceType": "<string>",
"resourceName": "<string>",
"resourceArn": "<string>",
"resourceKey": "<string>",
"targetUrl": "<string>",
"category": "<string>",
"tags": [
"<string>"
],
"cwe": "<string>",
"owasp": "<string>",
"status": "<string>",
"visibility": "<string>",
"taskIds": "<unknown>",
"tickets": [
{
"id": "<string>",
"provider": "<string>",
"integrationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"accountAlias": "<string>",
"externalId": "<string>",
"identifier": "<string>",
"url": "<string>",
"createdAt": "<string>",
"syncStatus": "syncing",
"syncError": "<string>",
"syncedAt": "<string>"
}
],
"acknowledgedAt": "<string>",
"acknowledgedBy": "<string>",
"falsePositiveReason": "<string>",
"closedReason": "<string>",
"inReviewReason": "<string>",
"inReviewUrl": "<string>",
"sourceName": "<string>",
"origin": "<string>",
"ingestionStatus": "<string>",
"ingestedAt": "<string>",
"createdAt": "<string>",
"updatedAt": "<string>",
"attachmentCount": 4503599627370495,
"sourceSecret": {
"secretFindingId": "<string>",
"ruleId": "<string>",
"verificationState": "<string>",
"isActive": true,
"activeLastSeenAt": "<string>",
"lastValidatedAt": "<string>",
"validationMethod": "<string>"
},
"exploits": [
{
"id": "<string>",
"steps": [
"<string>"
],
"resultsAtExploitTime": "<string>",
"retestProbe": "<string>",
"oracle": "<string>",
"drivenBy": "<string>",
"createdAt": "<string>",
"exploitedAt": "<string>",
"lineageId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
]
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}{
"statusCode": 123,
"code": "<string>",
"error": "<string>",
"message": "<string>"
}