Update a report

PATCH/workspaces/{workspace}/reports/{report}

Changes status, severity, CVSS, assignee or write-up choice. A status change is emailed to the reporter. To resolve a report, use Mark as fixed in the app.

Authentication

Send an API token as a bearer token. This endpoint needs a read and write token, made by an editor, admin or owner. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

workspacestringRequired
Your workspace slug, e.g. dokan.
reportintegerRequired
Report number.

Request body

application/json

statusenum
resolved is refused here. duplicate needs duplicate_of. One of new, confirmed, waiting_on_us, waiting_on_reporter, fixing, fixed, duplicate, not_valid.
duplicate_ofinteger, nullable
Number of an earlier report in this workspace (not itself). Required with status duplicate.
severityenum
Before the first reply, also moves the reply deadline. One of critical, high, medium, low, info.
cvssnumber, nullable
0–10, rounded to 1 decimal.
assignee_idinteger, nullable
A member of this workspace.
disclose_after_fixboolean
Publish a write-up after the fix.

Response

200 OK

Report detail.

numberintegerPer-workspace report number (used in paths).
titlestringTitle.
severityenumSeverity. One of critical, high, medium, low, info.
statusenumStatus. One of new, confirmed, waiting_on_us, waiting_on_reporter, fixing, fixed, resolved, duplicate, not_valid.
status_labelstringLocalized.
reporterstring|nullReporter’s handle.
reply_due_atstring|nullWhen your reply is due; only while the report waits on your team.
created_atstringISO 8601.
summarystringReporter’s summary.
reproducestring|nullSteps.
assetstring|nullAffected asset.
weaknessstring|nullWeakness class.
cvssnumber|null0.0–10.0.
reporter_severitystring|nullSeverity the reporter chose.
duplicate_ofinteger|nullReport number it duplicates.
assignee{id, name}|nullAssignee.
first_replied_atstring|nullISO 8601.
disclose_after_fixbooleanPublish a write-up after the fix.
evidence_forarray<string>Requirements this kind of report is evidence for, based on your certificates (e.g. “ISO 27001 A.8.8”).
trust_hoststringYour trust center host.
rewardobjectrange [min, max] in USD for the severity, suggested, amount, payout_method (paypal | bank | crypto | null).
resolutionobject|nullfix_summary, fixed_in, hall_of_fame, publish_writeup_on, resolved_at; null until resolved.
reporter_contactstringMasked email, e.g. r•••@proton.me.
reporter_history{earlier, valid}Earlier reports by the same email, and how many were valid.
hall_of_fame_consentbooleanReporter agreed to be listed.
position{index, total}Place in the list (newest first).
neighbours{previous, next}Adjacent report numbers.
team[]{id, name, role}All members.
messages[]objectid, kind (reporter | reply | note | event), author, body, mentions [{id, name}], attachments [{id, filename, mime, size, download_path}], created_at.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute. When you go over, wait for the number of seconds in Retry-After.

Errors

401The token is missing, wrong, revoked or expired.

403The token is read-only (message: “This token is read-only. Create a read and write token to make changes.”). Or: The token’s owner is a viewer (“Viewers can read everything but can’t change it.”), or the workspace’s editing is paused (a billing message, e.g. “Your trial has ended, so editing is paused. …”).

404The token belongs to another workspace, or its owner is no longer a member.

422“CVSS scores run from 0.0 to 10.0.”, “Use Mark as fixed to resolve a report, so the reporter hears about it.”, “This report is resolved and the reporter was told. It can’t be reopened.”, “Choose the earlier report this one duplicates.”, “Assign someone in this workspace.”

Every error is JSON with a message. See Errors.

Next →Reply or add a note