Skip to main content
POST
Create code finding disposition (browser session)

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json

Name the finding by exactly one of application_id or repository_id, plus tool, rule_id and path as the code security read reports them.

disposition
enum<string>
required
Available options:
false_positive,
accepted_risk
path
string
required
rule_id
string
required
tool
enum<string>
required
Available options:
semgrep,
checkov
application_id
string<uuid> | null
expires_at
string<date-time> | null

Review deadline. Required, and at most a year out, for accepted_risk.

reason
string

Required to create; recorded on the audit trail.

Maximum string length: 2000
repository_id
string<uuid> | null

Response

Successful response

One repository code finding disposition: a member's audited decision that a Semgrep or Checkov rule firing in one file of a pipeline repository is a false positive or an accepted risk. While active, the image gate does not block on it.

application_id
string<uuid> | null
required
created_at
string<date-time>
required
created_by
string
required
disposition
enum<string>
required
Available options:
false_positive,
accepted_risk
expires_at
string<date-time> | null
required
finding_severity
enum<string>
required
Available options:
HIGH,
MEDIUM,
LOW,
UNKNOWN
id
string<uuid>
required
path
string
required
reason
string
required
repository
string
required

owner/name of the pipeline repository.

repository_id
string<uuid>
required
revoked_at
string<date-time> | null
required
revoked_by
string | null
required
revoked_reason
string | null
required
rule_id
string
required
scope
enum<string>
required
Available options:
repository_code
status
enum<string>
required
Available options:
active,
expired,
revoked
tool
enum<string>
required
Available options:
semgrep,
checkov