Reply or add a note

POST/workspaces/{workspace}/reports/{report}/messages

Adds a reply the reporter receives by email, or an internal note only your team sees. Replying hands the report back to the reporter unless you say where to move it.

Authentication

Send an API token as a bearer token. This endpoint needs a read and write token, made by an editor, admin or owner. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

workspacestringRequired
Your workspace slug, e.g. dokan.
reportintegerRequired
Report number.

Request body

application/json

kindenumRequired
reply: emailed to the reporter. note: team only. One of reply, note.
bodystringRequiredmax 10000
Trimmed. “Write a message first.”
move_toenum
Replies only: status after replying. Default: waiting_on_reporter if the report was waiting on you, otherwise unchanged. One of fixing, waiting_on_reporter, confirmed.
mentionsstringmax 20
Notes only: member ids to notify. All must be members.

Response

201 Created

Report detail.

numberintegerPer-workspace report number (used in paths).
titlestringTitle.
severityenumSeverity. One of critical, high, medium, low, info.
statusenumStatus. One of new, confirmed, waiting_on_us, waiting_on_reporter, fixing, fixed, resolved, duplicate, not_valid.
status_labelstringLocalized.
reporterstring|nullReporter’s handle.
reply_due_atstring|nullWhen your reply is due; only while the report waits on your team.
created_atstringISO 8601.
summarystringReporter’s summary.
reproducestring|nullSteps.
assetstring|nullAffected asset.
weaknessstring|nullWeakness class.
cvssnumber|null0.0–10.0.
reporter_severitystring|nullSeverity the reporter chose.
duplicate_ofinteger|nullReport number it duplicates.
assignee{id, name}|nullAssignee.
first_replied_atstring|nullISO 8601.
disclose_after_fixbooleanPublish a write-up after the fix.
evidence_forarray<string>Requirements this kind of report is evidence for, based on your certificates (e.g. “ISO 27001 A.8.8”).
trust_hoststringYour trust center host.
rewardobjectrange [min, max] in USD for the severity, suggested, amount, payout_method (paypal | bank | crypto | null).
resolutionobject|nullfix_summary, fixed_in, hall_of_fame, publish_writeup_on, resolved_at; null until resolved.
reporter_contactstringMasked email, e.g. r•••@proton.me.
reporter_history{earlier, valid}Earlier reports by the same email, and how many were valid.
hall_of_fame_consentbooleanReporter agreed to be listed.
position{index, total}Place in the list (newest first).
neighbours{previous, next}Adjacent report numbers.
team[]{id, name, role}All members.
messages[]objectid, kind (reporter | reply | note | event), author, body, mentions [{id, name}], attachments [{id, filename, mime, size, download_path}], created_at.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute. When you go over, wait for the number of seconds in Retry-After.

Errors

401The token is missing, wrong, revoked or expired.

403The token is read-only (message: “This token is read-only. Create a read and write token to make changes.”). Or: The token’s owner is a viewer (“Viewers can read everything but can’t change it.”), or the workspace’s editing is paused (a billing message, e.g. “Your trial has ended, so editing is paused. …”).

404The token belongs to another workspace, or its owner is no longer a member.

422Missing or too-long body; a reply on a resolved or closed report (“This report is resolved and the reporter was told. Add an internal note instead.” / “This report is closed. Reopen it by moving it to another status first.”); mentions outside the workspace (“Mention people in this workspace only.”).

Every error is JSON with a message. See Errors.

Next →List subprocessors