> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update a finding's status

> Transition a finding between `open`, `in_review`, `acknowledged`, `closed`, `false_positive`, and `canceled`. The transition is recorded in the finding's status history with its actor, so the change is auditable.



## OpenAPI

````yaml /api-reference/openapi.json patch /api/v1/orgs/{orgSlug}/findings/{findingId}/status
openapi: 3.0.3
info:
  title: Tolmo API
  version: 1.0.0
  description: >-
    The Tolmo REST API. Every endpoint is scoped to one organization and
    authenticated with an API token.
servers:
  - url: https://api.tolmo.com
    description: Production
security:
  - bearerAuth: []
paths:
  /api/v1/orgs/{orgSlug}/findings/{findingId}/status:
    patch:
      tags:
        - findings
      summary: Update a finding's status
      description: >-
        Transition a finding between `open`, `in_review`, `acknowledged`,
        `closed`, `false_positive`, and `canceled`. The transition is recorded
        in the finding's status history with its actor, so the change is
        auditable.
      operationId: apiUpdateFindingStatus
      parameters:
        - schema:
            type: string
          in: path
          name: orgSlug
          required: true
        - schema:
            type: string
          in: path
          name: findingId
          required: true
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                status:
                  type: string
                  enum:
                    - open
                    - in_review
                    - closed
                    - acknowledged
                    - false_positive
                    - canceled
                falsePositiveReason:
                  nullable: true
                  type: string
                  maxLength: 4096
                closedReason:
                  nullable: true
                  type: string
                  maxLength: 4096
              required:
                - status
              additionalProperties: false
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                  orgId:
                    type: string
                  agentId:
                    nullable: true
                    type: string
                  sourceAgentName:
                    nullable: true
                    type: string
                  isManual:
                    type: boolean
                  shownVerbatim:
                    type: boolean
                  severity:
                    type: string
                  title:
                    type: string
                  description:
                    type: string
                  resourceType:
                    nullable: true
                    type: string
                  resourceName:
                    nullable: true
                    type: string
                  resourceArn:
                    nullable: true
                    type: string
                  resourceKey:
                    nullable: true
                    type: string
                  targetUrl:
                    nullable: true
                    type: string
                  category:
                    nullable: true
                    type: string
                  tags:
                    type: array
                    items:
                      type: string
                  cwe:
                    nullable: true
                    type: string
                  owasp:
                    nullable: true
                    type: string
                  status:
                    type: string
                  visibility:
                    type: string
                  taskIds: {}
                  tickets:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        provider:
                          type: string
                        integrationId:
                          nullable: true
                          type: string
                          format: uuid
                          pattern: >-
                            ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                        accountAlias:
                          nullable: true
                          type: string
                        externalId:
                          type: string
                        identifier:
                          type: string
                        url:
                          type: string
                        createdAt:
                          type: string
                        syncStatus:
                          nullable: true
                          type: string
                          enum:
                            - syncing
                            - synced
                            - needs_attention
                        syncError:
                          nullable: true
                          type: string
                        syncedAt:
                          nullable: true
                          type: string
                      required:
                        - id
                        - provider
                        - integrationId
                        - accountAlias
                        - externalId
                        - identifier
                        - url
                        - createdAt
                        - syncStatus
                        - syncError
                        - syncedAt
                      additionalProperties: false
                  acknowledgedAt:
                    nullable: true
                    type: string
                  acknowledgedBy:
                    nullable: true
                    type: string
                  falsePositiveReason:
                    nullable: true
                    type: string
                  closedReason:
                    nullable: true
                    type: string
                  sourceName:
                    type: string
                  ingestionStatus:
                    nullable: true
                    type: string
                  ingestedAt:
                    nullable: true
                    type: string
                  createdAt:
                    type: string
                  updatedAt:
                    type: string
                  attachmentCount:
                    type: integer
                    minimum: 0
                    maximum: 9007199254740991
                  sourceSecret:
                    nullable: true
                    type: object
                    properties:
                      secretFindingId:
                        type: string
                      ruleId:
                        type: string
                      verificationState:
                        type: string
                      isActive:
                        nullable: true
                        type: boolean
                      activeLastSeenAt:
                        nullable: true
                        type: string
                      lastValidatedAt:
                        nullable: true
                        type: string
                      validationMethod:
                        nullable: true
                        type: string
                    required:
                      - secretFindingId
                      - ruleId
                      - verificationState
                      - isActive
                      - activeLastSeenAt
                      - lastValidatedAt
                      - validationMethod
                    additionalProperties: false
                required:
                  - id
                  - orgId
                  - agentId
                  - sourceAgentName
                  - isManual
                  - shownVerbatim
                  - severity
                  - title
                  - description
                  - resourceType
                  - resourceName
                  - resourceArn
                  - resourceKey
                  - targetUrl
                  - category
                  - tags
                  - cwe
                  - owasp
                  - status
                  - visibility
                  - taskIds
                  - tickets
                  - acknowledgedAt
                  - acknowledgedBy
                  - falsePositiveReason
                  - closedReason
                  - sourceName
                  - ingestionStatus
                  - ingestedAt
                  - createdAt
                  - updatedAt
                additionalProperties: false
        '401':
          description: Default Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpError'
        '404':
          description: Default Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpError'
components:
  schemas:
    HttpError:
      type: object
      properties:
        statusCode:
          type: number
        code:
          type: string
        error:
          type: string
        message:
          type: string
      title: HttpError
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        A Tolmo API token, sent as `Authorization: Bearer <token>`. Either a
        user token (`usr_tok.*`, minted by `tolmo auth login`, scoped to your
        own permissions) or an org API token created in the Tolmo app, for CI
        and automation.

````