Code Review API
Query code review findings and events via the Nullify API
For PR and default-branch scanning, see scan coverage, start operations and completion checks.
Existing endpoints retain the
/sastprefix for backwards compatibility. New wrappers will be introduced over time without breaking the current contract.
Base URL
All endpoints share the base URL: https://api.<TENANT>.nullify.ai. Replace <TENANT> with your tenant slug (for example https://api.acme.nullify.ai).
Conventions
Provider scope. Every call identifies the connected provider account with one scope query parameter:
githubOwnerIdfor GitHub, orazureOrganizationId,bitbucketWorkspaceId,gitlabGroupIdorinstallationIdfor the other providers. The examples usegithubOwnerId=1234.Repository scope. To narrow a list to specific repositories, add
githubRepositoryId(repeatable) orgithubTeamId(all repositories the team can access) to the scope parameters. For/sast/findingsand/sast/findings/previewtherepositoryIdsparameter in the specification is not read by the handler, so use these scope parameters instead./sast/findings/detailedtakes a singlerepositoryId.Pagination. List calls accept
limitandnextToken(see Pagination).limitdefaults to 100 and a value above 100 returns 400.sortisascordesc(defaultdesc).Permissions. Reads need finding read access. Updates, allowlisting, tickets and autofix need finding write access.
Finding IDs. Take
findingIdfromGET /sast/findings. An ID that does not exist in your tenant returns 404.
Events
List events
Receive a stream of notable code-review activity (new findings, fixes, suppressions, branch summaries). Pass fromTime as a UTC timestamp such as 2025-01-31T00:00:00Z, and filter with eventType, findingId and fileOwnerName. A page holds at most 100 events, so keep following nextToken to read on. fileOwnerName is applied after a page is fetched, so a filtered page can hold fewer events than limit while nextToken is still set.
Returns SAST events after a specified timestamp or event ID. All events are returned if no timestamp or event ID is provided. A maximum of 100 events can be returned per request.
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Internal Server Error
GET /sast/events HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"events": [
{
"data": null,
"id": "text",
"time": "text",
"timestampUnix": 1,
"type": "org_context_agent_started"
}
],
"nextToken": "text",
"numItems": 1,
"version": "text"
}Findings
List findings
List findings with filtering by branch, severity, priority, state and file owner. The list returns previews; call Get a finding for the full record. Only push-workflow findings are returned unless you set workflow, and findings in deactivated repositories are left out. sortBy is priority (default) or time. State filters include isResolved, isFixed, isFalsePositive, isAllowlisted, isArchived, aiGenerated and autoFixState; isLatest defaults from isFixed. fileOwnerName is applied after a page is fetched, so a filtered page can be shorter than limit. GET /sast/findings/preview is a deprecated alias of this operation.
Returns a filtered set of SAST findings based on query parameters
if not provided, all repositories will be included
combination of isFixed, isFalsePositive, isAllowlisted and isArchived
true = AI code-review only, false = rule-only, omitted = both
filter by AutoFixState (e.g. 'none' for findings with no cached fix)
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Internal Server Error
GET /sast/findings HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"findings": [
{
"aiDevTitle": "text",
"aiGenerated": true,
"aiTitle": "text",
"allowlistReason": "text",
"allowlistState": "none",
"allowlistType": "AI",
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"branch": "text",
"category": "text",
"commitHash": "text",
"createdAt": "text",
"cwe": 1,
"cweIds": [
1
],
"endLine": 1,
"endLines": [
1
],
"entrypoint": "text",
"fileOwners": [
{
"name": "text",
"type": "email"
}
],
"filePath": "text",
"firstSeenCommit": "text",
"graphExists": true,
"id": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixable": true,
"isCloudTriaged": true,
"isFalsePositive": true,
"isLatest": true,
"isResolved": true,
"language": "Apex",
"message": "text",
"priorityLabel": "URGENT",
"priorityOverride": "URGENT",
"priorityScore": 1,
"projectId": "text",
"projectName": "text",
"pullRequestsAllowlist": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pullRequestsAutofix": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"repository": "text",
"repositoryId": "text",
"ruleId": "text",
"ruleIds": [
"text"
],
"ruleUrl": "text",
"ruleUrls": [
"text"
],
"severity": "CRITICAL",
"startLine": 1,
"startLines": [
1
],
"tenantId": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "DX"
},
"title": "text",
"triageEnd": "2026-01-01T00:00:00.000Z",
"triageStart": "2026-01-01T00:00:00.000Z",
"updatedAt": "text",
"workflow": "text"
}
],
"nextToken": "text",
"numItems": 1,
"version": "text"
}Returns a filtered set of SAST findings based on query parameters
if not provided, all repositories will be included
combination of isFixed, isFalsePositive, isAllowlisted and isArchived
true = AI code-review only, false = rule-only, omitted = both
filter by AutoFixState (e.g. 'none' for findings with no cached fix)
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Internal Server Error
GET /sast/findings/preview HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"findings": [
{
"aiDevTitle": "text",
"aiGenerated": true,
"aiTitle": "text",
"allowlistReason": "text",
"allowlistState": "none",
"allowlistType": "AI",
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"branch": "text",
"category": "text",
"commitHash": "text",
"createdAt": "text",
"cwe": 1,
"cweIds": [
1
],
"endLine": 1,
"endLines": [
1
],
"entrypoint": "text",
"fileOwners": [
{
"name": "text",
"type": "email"
}
],
"filePath": "text",
"firstSeenCommit": "text",
"graphExists": true,
"id": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixable": true,
"isCloudTriaged": true,
"isFalsePositive": true,
"isLatest": true,
"isResolved": true,
"language": "Apex",
"message": "text",
"priorityLabel": "URGENT",
"priorityOverride": "URGENT",
"priorityScore": 1,
"projectId": "text",
"projectName": "text",
"pullRequestsAllowlist": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pullRequestsAutofix": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"repository": "text",
"repositoryId": "text",
"ruleId": "text",
"ruleIds": [
"text"
],
"ruleUrl": "text",
"ruleUrls": [
"text"
],
"severity": "CRITICAL",
"startLine": 1,
"startLines": [
1
],
"tenantId": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "DX"
},
"title": "text",
"triageEnd": "2026-01-01T00:00:00.000Z",
"triageStart": "2026-01-01T00:00:00.000Z",
"updatedAt": "text",
"workflow": "text"
}
],
"nextToken": "text",
"numItems": 1,
"version": "text"
}List findings with full detail
Returns complete finding records rather than previews, for exports and integrations that need every field in one pass. It takes a single repositoryId, most of the list call's state and severity filters, and a language filter; sortBy is priority (default) or time and the workflow defaults to push. Unlike the list call, it does not hide findings in deactivated repositories.
Returns current SAST findings in default branches
if set, only findings for this repository are returned
combination of isFixed, isFalsePositive, isAllowlisted and isArchived
true = AI code-review only, false = rule-only, omitted = both
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Internal Server Error
GET /sast/findings/detailed HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"findings": [
{
"aiConfidence": 1,
"aiDevTitle": "text",
"aiGenerated": true,
"aiSignalCategory": "text",
"aiTitle": "text",
"allowlistReason": "text",
"allowlistState": "none",
"allowlistType": "AI",
"autoFixCurrentActivity": "text",
"autoFixDurationMs": 1,
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixLLMCostUSD": 1,
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autoFixTokenCount": 1,
"autoFixTotalDurationSecs": 1,
"autoFixTotalInputTokens": 1,
"autoFixTotalIterations": 1,
"autoFixTotalOutputTokens": 1,
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"branch": "text",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"category": "text",
"commitHash": "text",
"concurrencyLimit": 1,
"createdAt": "text",
"cwe": 1,
"cweIds": [
1
],
"deletedAt": "2026-01-01T00:00:00.000Z",
"description": "text",
"devDescription": "text",
"endLine": 1,
"endLines": [
1
],
"entrypoint": "text",
"exploitabilityConfidence": "text",
"exploitabilityLabel": "text",
"failedTriage": true,
"fileOwners": [
{
"name": "text",
"type": "email"
}
],
"filePath": "text",
"firstSeenCommit": "text",
"fixCommit": "text",
"fixSource": "nullify_autofix",
"fixedAt": "2026-01-01T00:00:00.000Z",
"graphExists": true,
"id": "text",
"impactConfidence": "text",
"impactLabel": "text",
"installationId": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixableAgentVerdict": true,
"isCloudTriaged": true,
"isFalsePositive": true,
"isFixed": true,
"isInternetReachable": true,
"isLatest": true,
"isResolved": true,
"language": "Apex",
"message": "text",
"owner": "text",
"platform": "text",
"priorityLabel": "URGENT",
"priorityLabelReason": "text",
"priorityOverride": "URGENT",
"priorityScore": 1,
"projectId": "text",
"projectName": "text",
"pullRequestsAllowlist": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pullRequestsAutofix": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pureInsertion": true,
"repository": "text",
"repositoryId": "text",
"resolvedAt": "2026-01-01T00:00:00.000Z",
"ruleConfidence": 1,
"ruleConfidenceLabel": "text",
"ruleId": "text",
"ruleIds": [
"text"
],
"ruleImpact": 1,
"ruleImpactLabel": "text",
"ruleLikelihood": 1,
"ruleLikelihoodLabel": "text",
"ruleSeverity": 1,
"ruleSeverityLabel": "text",
"ruleUrl": "text",
"ruleUrls": [
"text"
],
"severity": "CRITICAL",
"severityConfidence": "text",
"severityLabel": "CRITICAL",
"severityOverride": "CRITICAL",
"severityScore": 1,
"startLine": 1,
"startLines": [
1
],
"tenantId": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "DX"
},
"ticketState": "text",
"title": "text",
"triageAgentVersion": "text",
"triageDurationSeconds": 1,
"triageEnd": "2026-01-01T00:00:00.000Z",
"triageLlmCostUsd": 1,
"triageMaxInputTokens": 1,
"triageStart": "2026-01-01T00:00:00.000Z",
"triageStopReason": "text",
"triageTokenCount": 1,
"triageTraceId": "text",
"updatedAt": "text",
"userNotes": "text",
"workflow": "text"
}
],
"nextToken": "text",
"numItems": 1,
"version": "text"
}Get a finding
Retrieve full context for a single finding, including reachability evidence and ownership metadata. The response also carries a presignedUrl for the stored triage document when one exists. Unknown or other-tenant IDs return 404.
Returns a given finding with explanation and impact
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
GET /sast/findings/{findingId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"finding": {
"aiConfidence": 1,
"aiDevTitle": "text",
"aiGenerated": true,
"aiSignalCategory": "text",
"aiTitle": "text",
"allowlistReason": "text",
"allowlistState": "none",
"allowlistType": "AI",
"autoFixCurrentActivity": "text",
"autoFixDurationMs": 1,
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixLLMCostUSD": 1,
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autoFixTokenCount": 1,
"autoFixTotalDurationSecs": 1,
"autoFixTotalInputTokens": 1,
"autoFixTotalIterations": 1,
"autoFixTotalOutputTokens": 1,
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"branch": "text",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"category": "text",
"commitHash": "text",
"concurrencyLimit": 1,
"createdAt": "text",
"cwe": 1,
"cweIds": [
1
],
"deletedAt": "2026-01-01T00:00:00.000Z",
"description": "text",
"devDescription": "text",
"endLine": 1,
"endLines": [
1
],
"entrypoint": "text",
"exploitabilityConfidence": "text",
"exploitabilityLabel": "text",
"failedTriage": true,
"fileOwners": [
{
"name": "text",
"type": "email"
}
],
"filePath": "text",
"firstSeenCommit": "text",
"fixCommit": "text",
"fixSource": "nullify_autofix",
"fixedAt": "2026-01-01T00:00:00.000Z",
"graphExists": true,
"id": "text",
"impactConfidence": "text",
"impactLabel": "text",
"installationId": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixableAgentVerdict": true,
"isCloudTriaged": true,
"isFalsePositive": true,
"isFixed": true,
"isInternetReachable": true,
"isLatest": true,
"isResolved": true,
"language": "Apex",
"message": "text",
"owner": "text",
"platform": "text",
"priorityLabel": "URGENT",
"priorityLabelReason": "text",
"priorityOverride": "URGENT",
"priorityScore": 1,
"projectId": "text",
"projectName": "text",
"pullRequestsAllowlist": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pullRequestsAutofix": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pureInsertion": true,
"repository": "text",
"repositoryId": "text",
"resolvedAt": "2026-01-01T00:00:00.000Z",
"ruleConfidence": 1,
"ruleConfidenceLabel": "text",
"ruleId": "text",
"ruleIds": [
"text"
],
"ruleImpact": 1,
"ruleImpactLabel": "text",
"ruleLikelihood": 1,
"ruleLikelihoodLabel": "text",
"ruleSeverity": 1,
"ruleSeverityLabel": "text",
"ruleUrl": "text",
"ruleUrls": [
"text"
],
"severity": "CRITICAL",
"severityConfidence": "text",
"severityLabel": "CRITICAL",
"severityOverride": "CRITICAL",
"severityScore": 1,
"startLine": 1,
"startLines": [
1
],
"tenantId": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "DX"
},
"ticketState": "text",
"title": "text",
"triageAgentVersion": "text",
"triageDurationSeconds": 1,
"triageEnd": "2026-01-01T00:00:00.000Z",
"triageLlmCostUsd": 1,
"triageMaxInputTokens": 1,
"triageStart": "2026-01-01T00:00:00.000Z",
"triageStopReason": "text",
"triageTokenCount": 1,
"triageTraceId": "text",
"updatedAt": "text",
"userNotes": "text",
"workflow": "text"
},
"presignedUrl": "text",
"version": "text"
}Update a finding
Override a finding's priority or severity. The request accepts priorityOverride (URGENT, IMPORTANT, MEDIUM, INFORMATIONAL, LOW, NEGLIGIBLE, FALSE_POSITIVE, UNKNOWN) and severityOverride (CRITICAL, HIGH, MEDIUM, LOW, NONE, INFORMATIONAL, UNKNOWN). An invalid value returns 400. The response is the updated finding.
Update a given finding with the fields provided
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
PATCH /sast/findings/{findingId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 59
{
"priorityOverride": "URGENT",
"severityOverride": "CRITICAL"
}{
"finding": {
"aiConfidence": 1,
"aiDevTitle": "text",
"aiGenerated": true,
"aiSignalCategory": "text",
"aiTitle": "text",
"allowlistReason": "text",
"allowlistState": "none",
"allowlistType": "AI",
"autoFixCurrentActivity": "text",
"autoFixDurationMs": 1,
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixLLMCostUSD": 1,
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autoFixTokenCount": 1,
"autoFixTotalDurationSecs": 1,
"autoFixTotalInputTokens": 1,
"autoFixTotalIterations": 1,
"autoFixTotalOutputTokens": 1,
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"branch": "text",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"category": "text",
"commitHash": "text",
"concurrencyLimit": 1,
"createdAt": "text",
"cwe": 1,
"cweIds": [
1
],
"deletedAt": "2026-01-01T00:00:00.000Z",
"description": "text",
"devDescription": "text",
"endLine": 1,
"endLines": [
1
],
"entrypoint": "text",
"exploitabilityConfidence": "text",
"exploitabilityLabel": "text",
"failedTriage": true,
"fileOwners": [
{
"name": "text",
"type": "email"
}
],
"filePath": "text",
"firstSeenCommit": "text",
"fixCommit": "text",
"fixSource": "nullify_autofix",
"fixedAt": "2026-01-01T00:00:00.000Z",
"graphExists": true,
"id": "text",
"impactConfidence": "text",
"impactLabel": "text",
"installationId": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixableAgentVerdict": true,
"isCloudTriaged": true,
"isFalsePositive": true,
"isFixed": true,
"isInternetReachable": true,
"isLatest": true,
"isResolved": true,
"language": "Apex",
"message": "text",
"owner": "text",
"platform": "text",
"priorityLabel": "URGENT",
"priorityLabelReason": "text",
"priorityOverride": "URGENT",
"priorityScore": 1,
"projectId": "text",
"projectName": "text",
"pullRequestsAllowlist": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pullRequestsAutofix": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pureInsertion": true,
"repository": "text",
"repositoryId": "text",
"resolvedAt": "2026-01-01T00:00:00.000Z",
"ruleConfidence": 1,
"ruleConfidenceLabel": "text",
"ruleId": "text",
"ruleIds": [
"text"
],
"ruleImpact": 1,
"ruleImpactLabel": "text",
"ruleLikelihood": 1,
"ruleLikelihoodLabel": "text",
"ruleSeverity": 1,
"ruleSeverityLabel": "text",
"ruleUrl": "text",
"ruleUrls": [
"text"
],
"severity": "CRITICAL",
"severityConfidence": "text",
"severityLabel": "CRITICAL",
"severityOverride": "CRITICAL",
"severityScore": 1,
"startLine": 1,
"startLines": [
1
],
"tenantId": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "DX"
},
"ticketState": "text",
"title": "text",
"triageAgentVersion": "text",
"triageDurationSeconds": 1,
"triageEnd": "2026-01-01T00:00:00.000Z",
"triageLlmCostUsd": 1,
"triageMaxInputTokens": 1,
"triageStart": "2026-01-01T00:00:00.000Z",
"triageStopReason": "text",
"triageTokenCount": 1,
"triageTraceId": "text",
"updatedAt": "text",
"userNotes": "text",
"workflow": "text"
},
"version": "text"
}Get triage details
Retrieve the AI triage reasoning and reachability assessment for a finding. The response carries triageStatus (pending, completed or failed). While triage has not completed, finding is empty. Poll with a bounded timeout while the status is pending; this can also mean triage has never run. Stop on failed and inspect stopReason. This GET does not start or retry triage; use Retriage findings to request another attempt. A completed response also includes a presignedUrl and mapped vulnerability-management frameworks.
Returns the triage data for a specific finding
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
GET /sast/findings/{findingId}/triage HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"finding": {
"agentVersion": "text",
"assessmentFactors": [
{
"description": "text",
"title": "text"
}
],
"codeContext": {
"codeBlocks": [
{
"codeText": "text",
"endLine": 1,
"filePath": "text",
"startLine": 1
}
],
"dataFlow": "text",
"error": "text",
"exitReason": "text",
"summary": "text",
"thoughts": "text"
},
"exploitEvidence": [
{
"contentType": "text",
"id": "text",
"kind": "text"
}
],
"falsePositiveReason": "text",
"finding": {
"aiConfidence": 1,
"aiDevTitle": "text",
"aiGenerated": true,
"aiSignalCategory": "text",
"aiTitle": "text",
"allowlistReason": "text",
"allowlistState": "none",
"allowlistType": "AI",
"autoFixCurrentActivity": "text",
"autoFixDurationMs": 1,
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixLLMCostUSD": 1,
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autoFixTokenCount": 1,
"autoFixTotalDurationSecs": 1,
"autoFixTotalInputTokens": 1,
"autoFixTotalIterations": 1,
"autoFixTotalOutputTokens": 1,
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"branch": "text",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"category": "text",
"commitHash": "text",
"concurrencyLimit": 1,
"createdAt": "text",
"cwe": 1,
"cweIds": [
1
],
"deletedAt": "2026-01-01T00:00:00.000Z",
"description": "text",
"devDescription": "text",
"endLine": 1,
"endLines": [
1
],
"entrypoint": "text",
"exploitabilityConfidence": "text",
"exploitabilityLabel": "text",
"failedTriage": true,
"fileOwners": [
{
"name": "text",
"type": "email"
}
],
"filePath": "text",
"firstSeenCommit": "text",
"fixCommit": "text",
"fixSource": "nullify_autofix",
"fixedAt": "2026-01-01T00:00:00.000Z",
"graphExists": true,
"id": "text",
"impactConfidence": "text",
"impactLabel": "text",
"installationId": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixableAgentVerdict": true,
"isCloudTriaged": true,
"isFalsePositive": true,
"isFixed": true,
"isInternetReachable": true,
"isLatest": true,
"isResolved": true,
"language": "Apex",
"message": "text",
"owner": "text",
"platform": "text",
"priorityLabel": "URGENT",
"priorityLabelReason": "text",
"priorityOverride": "URGENT",
"priorityScore": 1,
"projectId": "text",
"projectName": "text",
"pullRequestsAllowlist": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pullRequestsAutofix": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "DX"
},
"recordId": "text",
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"pureInsertion": true,
"repository": "text",
"repositoryId": "text",
"resolvedAt": "2026-01-01T00:00:00.000Z",
"ruleConfidence": 1,
"ruleConfidenceLabel": "text",
"ruleId": "text",
"ruleIds": [
"text"
],
"ruleImpact": 1,
"ruleImpactLabel": "text",
"ruleLikelihood": 1,
"ruleLikelihoodLabel": "text",
"ruleSeverity": 1,
"ruleSeverityLabel": "text",
"ruleUrl": "text",
"ruleUrls": [
"text"
],
"severity": "CRITICAL",
"severityConfidence": "text",
"severityLabel": "CRITICAL",
"severityOverride": "CRITICAL",
"severityScore": 1,
"startLine": 1,
"startLines": [
1
],
"tenantId": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "DX"
},
"ticketState": "text",
"title": "text",
"triageAgentVersion": "text",
"triageDurationSeconds": 1,
"triageEnd": "2026-01-01T00:00:00.000Z",
"triageLlmCostUsd": 1,
"triageMaxInputTokens": 1,
"triageStart": "2026-01-01T00:00:00.000Z",
"triageStopReason": "text",
"triageTokenCount": 1,
"triageTraceId": "text",
"updatedAt": "text",
"userNotes": "text",
"workflow": "text"
},
"fixStoryPointEstimate": 1,
"investigationSteps": [
{
"details": [
"text"
],
"title": "text"
}
],
"isFalsePositive": true,
"orgContextVersion": "text",
"priority": {
"description": "text",
"exploitability": {
"attackComplexity": {
"description": "text",
"label": "HIGH",
"privilegesRequired": {
"description": "text",
"label": "AUTHENTICATED"
}
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVector": [
"LOCAL_COMMAND_LINE_ARGUMENT"
]
},
"description": "text",
"evidence": {
"edges": [
{
"confidence": 1,
"explanation": "text",
"properties": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"label": "LIKELY"
},
"fixEffort": {
"description": "text",
"label": "EASY"
},
"label": "FALSE_POSITIVE",
"score": 1,
"severity": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH"
},
"businessCriticality": {
"description": "text",
"label": "HIGH"
},
"confidentiality": {
"dataLeaked": [
"ADDRESS"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"type": [
"BEHAVIOUR_MANIPULATED"
]
},
"label": "CRITICAL"
}
},
"repoContextVersion": "text",
"triage": {
"budgetExhausted": true,
"campaignMetadata": {
"id": "text",
"name": "text"
},
"cloudContext": {
"confidence": 1,
"mode": "MODEA",
"ownershipBasis": "declared",
"repos": [
"text"
],
"thoughts": "text"
},
"complianceImpact": {
"citations": [
{
"documentId": "text",
"endLine": 1,
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"startLine": 1,
"title": "text"
}
],
"confidence": "HIGH",
"frameworks": [
{
"clause": "text",
"framework": "CCPA",
"obligation": "text"
}
],
"rationale": "text"
},
"customerQuestions": {
"customMessage": "text",
"generatedMemoryIds": [
"text"
],
"id": "text",
"questions": [
{
"answer": null,
"answerMemoryId": "text",
"answeredAt": "2026-01-01T00:00:00.000Z",
"customMessage": "text",
"findingIds": [
"text"
],
"id": "text",
"options": [
{
"id": "text",
"label": "text",
"value": "text"
}
],
"questionText": "text",
"questionType": "FREE_TEXT",
"relatedMemoryIds": [
"text"
],
"scope": "CLOUD",
"scopeResourceId": "text",
"unknownIds": [
"text"
]
}
]
},
"description": "text",
"descriptionSummary": "text",
"devDescription": "text",
"devTitle": "text",
"evidence": {
"edges": [
{
"confidence": 1,
"explanation": "text",
"properties": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitHypothesis": {
"edges": [
{
"confidence": 1,
"explanation": "text",
"properties": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitability": {
"attackComplexity": {
"description": "text",
"exploitChainRequired": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"payloadDifficulty": {
"description": "text",
"label": "EASY"
}
},
"attackRequirements": {
"description": "text",
"environmentState": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"mitm": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"raceCondition": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"timeWindow": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"title": "text"
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVectors": [
{
"description": "text",
"otherVector": "text",
"vector": "ADJACENT_ARP_SPOOFING"
}
]
},
"confidence": "HIGH",
"description": "text",
"label": "LIKELY",
"privilegesRequired": {
"description": "text",
"label": "HIGH",
"title": "text",
"types": [
"PRIVILEGED_USER"
]
},
"title": "text",
"unknowns": [
"text"
],
"userInteraction": {
"description": "text",
"label": "ACTIVE",
"otherTypes": [
"text"
],
"title": "text",
"types": [
"BROWSING"
]
}
},
"failedTriage": true,
"fixEffort": {
"confidence": "HIGH",
"description": "text",
"label": "EASY",
"title": "text",
"unknowns": [
"text"
]
},
"id": "text",
"impact": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"COMPLETE_SERVICE_OUTAGE"
]
},
"businessCriticality": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"confidence": "HIGH",
"confidentiality": {
"dataLeaked": [
"ACCESS_TOKEN"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"DATABASE_ALTERED"
]
},
"label": "CRITICAL",
"title": "text",
"unknowns": [
"text"
]
},
"investigationConfidence": "HIGH",
"investigationId": "text",
"investigationUnknowns": [
"text"
],
"lastTriagedAt": "2026-01-01T00:00:00.000Z",
"memoriesGenerated": [
"text"
],
"memoriesUsed": [
"text"
],
"parentTriageId": "text",
"pentest": {
"attemptedCVEs": [
"text"
],
"browserEvidence": {
"citation": "text",
"family": "text",
"reason": "text",
"screenshotRefs": [
"text"
],
"verdict": "text"
},
"confidence": 1,
"cost": 1,
"duration": 1,
"exploitedCVE": "text",
"logs": [
{
"logs": [],
"summary": "text"
}
],
"mutationDisclosure": {
"writes": [
{
"method": "text",
"outcome": "text",
"statusCode": 1,
"url": "text"
}
],
"writesAttempted": true
},
"outcome": "CANNOT_DETERMINE",
"report": "text",
"reproductionScript": "text",
"sourceAvailability": {
"apiSchema": true,
"checkout": true,
"codeSnippets": true
},
"testedEndpoints": [
{
"method": "text",
"path": "text"
}
],
"validatedBy": {
"engine": "FINDING_EXPLOIT_VALIDATION",
"recordedAt": "2026-01-01T00:00:00.000Z",
"runId": "text"
}
},
"priority": "FALSE_POSITIVE",
"references": [
{
"documentId": "text",
"endLine": 1,
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"startLine": 1,
"title": "text"
}
],
"retriageComparison": {
"narrative": "text",
"newInformation": {
"cloudContextUpdated": true,
"memoryChanges": [
{
"description": "text",
"kind": "ADDED"
}
],
"pentestResultAdded": true,
"userComments": [
{
"commentId": "text",
"influence": "changed_verdict",
"keyClaim": "text"
}
]
},
"qualityAssessment": {
"remainingUncertainties": [
"text"
],
"sufficientEvidence": true
},
"verdictChanges": [
{
"current": "text",
"field": "text",
"previous": "text",
"reason": "text"
}
]
},
"retriageMetadata": {
"memoryChanges": [
{
"memoryChangeType": "MEMORY_ADDED",
"memoryId": "text"
}
],
"triggeredAt": "2026-01-01T00:00:00.000Z"
},
"retriageStatus": "NOT_RETRIAGED",
"severity": {
"confidence": "HIGH",
"label": "CRITICAL",
"score": 1,
"unknowns": [
"text"
]
},
"stopReason": "cost_cap",
"thoughts": "text",
"title": "text",
"version": 1
},
"triagedCommitSha": "text"
},
"presignedUrl": "text",
"stopReason": "text",
"triageStatus": "pending",
"version": "text",
"vulnManagementFrameworks": {
"results": [
{
"controls": [
{
"confidence": "exact",
"id": "text",
"level": "text",
"relationship": "text",
"title": "text",
"url": "text"
}
],
"framework": "cvss-3.1",
"mappingConfidence": "exact",
"notes": [
"text"
],
"rank": "text",
"score": {
"baseScore": 1,
"nomenclature": "text",
"qualitative": "text",
"synthesized": true,
"vector": "text"
},
"version": "text"
}
]
}
}List users associated with a finding
Returns up to three candidate people for routing the finding, ranked from git blame on the finding's lines, then other editors of the same file, then repository contributors, each with a reason. Providers that cannot supply blame data fall back to repository contributors.
Returns the users associated with a specific finding
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
GET /sast/findings/{findingId}/users HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"users": [
{
"reason": "text",
"user": {
"asana": {
"id": "text"
},
"azure": {
"id": "text"
},
"azureEntra": {
"id": "text"
},
"bitbucket": {
"id": "text"
},
"createdAt": "text",
"createdBy": "text",
"deleted": true,
"displayName": "text",
"email": "text",
"github": {
"id": 1,
"nodeId": "text"
},
"gitlab": {
"id": 1
},
"googleWorkspace": {
"id": "text"
},
"id": "text",
"isBot": true,
"isRestricted": true,
"jira": {
"id": "text",
"name": "text"
},
"lastUpdatedBy": "text",
"linear": {
"id": "text"
},
"name": "text",
"okta": {
"id": "text"
},
"provider": {
"asana": {
"id": "text"
},
"azure": {
"id": "text"
},
"azureEntra": {
"id": "text"
},
"bitBucket": {
"id": "text"
},
"gitHub": {
"id": 1,
"nodeId": "text"
},
"gitlab": {
"id": 1
},
"googleWorkspace": {
"id": "text"
},
"id": "DX",
"jira": {
"id": "text",
"name": "text"
},
"linear": {
"id": "text"
},
"okta": {
"id": "text"
},
"slack": {
"id": "text",
"name": "text"
},
"teams": {
"id": "text",
"teamIDs": [
"text"
]
}
},
"realName": "text",
"slack": {
"id": "text",
"name": "text"
},
"slug": "text",
"teams": {
"id": "text",
"teamIDs": [
"text"
]
},
"updatedAt": "text",
"username": "text"
}
}
],
"version": "text"
}List finding events
Review every decision applied to a finding (status changes, tickets, suppressions). The response is not paginated.
Returns a list of events for a given finding.
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
GET /sast/findings/{findingId}/events HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"events": [
{
"data": null,
"id": "text",
"time": "text",
"timestampUnix": 1,
"type": "org_context_agent_started"
}
],
"nextToken": "text",
"numItems": 1,
"version": "text"
}Triage and allowlisting
Allowlist a finding
Apply a policy exception when you accept the risk for a finding. Supply an allowlistReason (required) and an allowlistType (AI, UserFixed, UserAssumeRisk, UserFalsePositive, or UserOther). Allowlisting marks the finding resolved, discards any cached autofix for it, emits an allowlist event, and best-effort closes an open ticket for the finding. A ticket-close failure does not fail the call.
Allowlists a finding
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
The reason for allowlisting the finding
OK
A link to the pull request
The title of the pull request
Bad Request
Forbidden
Not Found
Internal Server Error
POST /sast/findings/{findingId}/allowlist HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 47
{
"allowlistReason": "text",
"allowlistType": "AI"
}{
"link": "text",
"title": "text",
"version": "text"
}Allowlist findings in bulk
Allowlist multiple findings in a single call. The body adds a findingIds array alongside allowlistReason and allowlistType; an empty array or empty reason returns 400. The findings are processed concurrently and the call is not atomic: if one ID is unknown the call returns 404, but findings processed before the failure stay allowlisted. A success returns 204 with no body.
Allowlist a list of SAST findings, by findingsID
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
The reason for allowing the finding
The ID of the finding to allowlist
No Content
No content
Bad Request
Forbidden
Not Found
Internal Server Error
POST /sast/findings/allowlist HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 69
{
"allowlistReason": "text",
"allowlistType": "AI",
"findingIds": [
"text"
]
}No content
Remove a finding from the allowlist
Re-activate alerting for a previously allowlisted finding. Supply an unallowlistReason (required). The finding is resolved again only if it is also archived, a false positive or no longer the latest version. A ticket that was closed by the allowlist is reopened, or a new linked ticket is created if the old one cannot be reopened. Success returns 204.
Unallowlists a finding
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
The reason for unallowlisting the finding
No Content
No content
Bad Request
Forbidden
Not Found
Internal Server Error
POST /sast/findings/{findingId}/unallowlist HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 28
{
"unallowlistReason": "text"
}No content
Tickets
Create a ticket
Create a ticket for the finding on the tenant's configured ticket integration. The body is optional and accepts message, assignees, project, campaignId and campaignTitle. A finding that already has a ticket on that provider returns 400. Errors to expect: 501 when no ticket integration is configured, 412 when the integration is disabled, needs reconnecting, or requires an assignee you did not supply, and 503 or 504 when the ticket provider is temporarily unavailable. The response is the created ticket.
Creates a ticket for a given finding on the tenant's configured ticket integration
The ID of the finding to create a Jira ticket for
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Precondition Failed
Internal Server Error
Not Implemented
Service Unavailable
Gateway Timeout
POST /sast/findings/{findingId}/ticket HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 1031
{
"assignees": [
{
"asana": {
"id": "text"
},
"azure": {
"id": "text"
},
"azureEntra": {
"id": "text"
},
"bitbucket": {
"id": "text"
},
"createdAt": "text",
"createdBy": "text",
"deleted": true,
"displayName": "text",
"email": "text",
"github": {
"id": 1,
"nodeId": "text"
},
"gitlab": {
"id": 1
},
"googleWorkspace": {
"id": "text"
},
"id": "text",
"isBot": true,
"isRestricted": true,
"jira": {
"id": "text",
"name": "text"
},
"lastUpdatedBy": "text",
"linear": {
"id": "text"
},
"name": "text",
"okta": {
"id": "text"
},
"provider": {
"asana": {
"id": "text"
},
"azure": {
"id": "text"
},
"azureEntra": {
"id": "text"
},
"bitBucket": {
"id": "text"
},
"gitHub": {
"id": 1,
"nodeId": "text"
},
"gitlab": {
"id": 1
},
"googleWorkspace": {
"id": "text"
},
"id": "DX",
"jira": {
"id": "text",
"name": "text"
},
"linear": {
"id": "text"
},
"okta": {
"id": "text"
},
"slack": {
"id": "text",
"name": "text"
},
"teams": {
"id": "text",
"teamIDs": [
"text"
]
}
},
"realName": "text",
"slack": {
"id": "text",
"name": "text"
},
"slug": "text",
"teams": {
"id": "text",
"teamIDs": [
"text"
]
},
"updatedAt": "text",
"username": "text"
}
],
"campaignId": "text",
"campaignTitle": "text",
"message": "text",
"project": "text"
}{
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "DX"
},
"version": "text"
}Delete a ticket
Close the finding's ticket on the ticket integration and clear Nullify's link to it. The call is idempotent: a finding with no ticket returns 200 and does nothing. It returns 501 when no ticket integration is configured.
Removes the ticket associated with a finding: closes it on the configured ticket integration and clears Nullify's tracking. Idempotent.
The ID of the finding whose ticket should be removed
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Precondition Failed
Internal Server Error
Not Implemented
DELETE /sast/findings/{findingId}/ticket HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"version": "text"
}Autofix
Autofix generates a fix for a finding and opens a pull request. It runs asynchronously: the trigger call returns once the run is accepted, and you follow progress with the status, state and activity calls below.
Trigger autofix
Starts autofix for the finding and returns autoFixState (normally in_progress_requested) and a runId. Optional body fields are message (guidance for the agent), force and originCampaignId. Refusals: 409 when a run is already in flight, a pull request is already open, or the finding is resolved; 400 when the agent previously judged the finding not fixable and you did not set force, or set force without a message; and 412 when the repository is archived.
Creates a pull request to fix a given finding
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Conflict
Precondition Failed
Internal Server Error
Service Unavailable
POST /sast/findings/{findingId}/autofix/fix HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 1010
{
"assignees": [
{
"asana": {
"id": "text"
},
"azure": {
"id": "text"
},
"azureEntra": {
"id": "text"
},
"bitbucket": {
"id": "text"
},
"createdAt": "text",
"createdBy": "text",
"deleted": true,
"displayName": "text",
"email": "text",
"github": {
"id": 1,
"nodeId": "text"
},
"gitlab": {
"id": 1
},
"googleWorkspace": {
"id": "text"
},
"id": "text",
"isBot": true,
"isRestricted": true,
"jira": {
"id": "text",
"name": "text"
},
"lastUpdatedBy": "text",
"linear": {
"id": "text"
},
"name": "text",
"okta": {
"id": "text"
},
"provider": {
"asana": {
"id": "text"
},
"azure": {
"id": "text"
},
"azureEntra": {
"id": "text"
},
"bitBucket": {
"id": "text"
},
"gitHub": {
"id": 1,
"nodeId": "text"
},
"gitlab": {
"id": 1
},
"googleWorkspace": {
"id": "text"
},
"id": "DX",
"jira": {
"id": "text",
"name": "text"
},
"linear": {
"id": "text"
},
"okta": {
"id": "text"
},
"slack": {
"id": "text",
"name": "text"
},
"teams": {
"id": "text",
"teamIDs": [
"text"
]
}
},
"realName": "text",
"slack": {
"id": "text",
"name": "text"
},
"slug": "text",
"teams": {
"id": "text",
"teamIDs": [
"text"
]
},
"updatedAt": "text",
"username": "text"
}
],
"force": true,
"message": "text",
"originCampaignId": "text"
}{
"autoFixState": "none",
"error": "text",
"runId": "text",
"version": "text"
}Get autofix status
Lightweight lifecycle status for polling, including state, terminal (true once the run has stopped progressing), whether the finding is auto-fixable, the autofix pull requests, and available actions. It also rescues runs stuck in an in-progress state. Poll this every few seconds until terminal is true.
Lightweight per-finding autofix lifecycle status for UI polling.
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
GET /sast/findings/{findingId}/autofix/status HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"status": {
"autofixId": "text",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"availableActions": [
{
"body": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"confirm": "text",
"href": "text",
"id": "text",
"kind": "command",
"label": "text",
"method": "text"
}
],
"coordination": {
"entries": [
{
"attemptId": "text",
"blocked": true,
"message": "text",
"prIdentifier": "text",
"reasonCode": "text",
"repositoryId": "text",
"requestId": "text",
"retryAllowed": true,
"state": "text"
}
],
"unavailable": true
},
"currentActivity": "text",
"currentPhase": "planning",
"isAutoFixable": true,
"iterations": {
"count": 1,
"durationSeconds": 1,
"lastIterationAt": "text",
"totalCostUSD": 1,
"totalInputTokens": 1,
"totalOutputTokens": 1
},
"lastActivityAt": "text",
"pullRequestState": "open",
"pullRequestUrl": "text",
"pullRequests": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "text",
"identifier": 1,
"mergedAt": "text",
"provider": "DX",
"recordId": "text",
"status": "open",
"url": "text"
}
],
"reconciliationStale": true,
"state": "none",
"terminal": true,
"updatedAt": "text"
},
"version": "text"
}Get autofix state
The authoritative autofix state. In addition to the status checks it reconciles recorded pull requests with the git platform, so it is slower; poll it on a long interval (the dashboard uses about 30 seconds) rather than in a tight loop.
Authoritative per-finding autofix state — runs stale-state rescue + live git-platform reconcile. Slow by design; the dashboard polls this on a ~30s cadence alongside the fast /autofix/status.
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
GET /sast/findings/{findingId}/autofix/state HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"status": {
"autofixId": "text",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"availableActions": [
{
"body": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"confirm": "text",
"href": "text",
"id": "text",
"kind": "command",
"label": "text",
"method": "text"
}
],
"coordination": {
"entries": [
{
"attemptId": "text",
"blocked": true,
"message": "text",
"prIdentifier": "text",
"reasonCode": "text",
"repositoryId": "text",
"requestId": "text",
"retryAllowed": true,
"state": "text"
}
],
"unavailable": true
},
"currentActivity": "text",
"currentPhase": "planning",
"isAutoFixable": true,
"iterations": {
"count": 1,
"durationSeconds": 1,
"lastIterationAt": "text",
"totalCostUSD": 1,
"totalInputTokens": 1,
"totalOutputTokens": 1
},
"lastActivityAt": "text",
"pullRequestState": "open",
"pullRequestUrl": "text",
"pullRequests": [
{
"ciCheckedAt": "2026-01-01T00:00:00.000Z",
"ciDetailUrl": "text",
"ciState": "pending",
"createdAt": "text",
"identifier": 1,
"mergedAt": "text",
"provider": "DX",
"recordId": "text",
"status": "open",
"url": "text"
}
],
"reconciliationStale": true,
"state": "none",
"terminal": true,
"updatedAt": "text"
},
"version": "text"
}List autofix activity
Cursor-paginated log of what the autofix run did, for progress displays. limit defaults to 50 and is clamped to 1 to 200. Pass the nextCursor from the previous response as since_id to fetch only newer entries. The list is empty when no run exists.
Cursor-paginated autofix activity log for UI polling. Returns empty list when no autofix run exists. limit defaults to 50 and is clamped to [1, 200]; since_id is the ID of the last entry the client has already seen (use the nextCursor value from a prior response).
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
GET /sast/findings/{findingId}/autofix/activity HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"entries": [
{
"content": "text",
"createdAt": "text",
"eventType": "text",
"id": "text",
"metadata": "text"
}
],
"nextCursor": "text"
}Get the proposed fix diff
Returns the cached fix as file diffs, with the pull request title and body, explanation and base commit. It returns 400 when no cached fix exists, so check the autofix status first.
Gets the git diffs for a finding's proposed autofix
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Precondition Failed
Internal Server Error
Service Unavailable
GET /sast/findings/{findingId}/autofix/cache/diff HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"commit": "text",
"diffs": [
{
"header": "text",
"hunks": [
{
"header": "text",
"wholeRange": {
"length": 1,
"lines": [
{
"content": "text",
"mode": 1,
"number": 1
}
],
"start": 1
}
}
],
"mode": 1,
"newName": "text",
"origName": "text"
}
],
"explanation": "text",
"pullRequestBody": "text",
"pullRequestTitle": "text",
"version": "text"
}Repositories and scan runs
List repositories
Enumerate the repositories Code Review is scanning, along with their stats. Results are returned as a map keyed by repository ID. limit defaults to 10 and the maximum is 10 (larger values return 400), so follow nextToken to read on.
Returns a map of repository stats. The map is sorted by repositoryID and contains a list of repository stats for each repositoryID.
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Internal Server Error
GET /sast/repositories HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"nextToken": "text",
"numItems": 1,
"repositories": {
"ANY_ADDITIONAL_PROPERTY": {
"codePaths": {
"exclude": [
"text"
],
"include": [
"text"
]
},
"countsBySeverity": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"countsByType": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"defaultBranch": "text",
"defaultBranchCommittedAt": "2026-01-01T00:00:00.000Z",
"defaultBranchSha": "text",
"id": "text",
"isArchived": true,
"isDefaultBranch": true,
"isEnrolled": true,
"language": "text",
"languages": [
"text"
],
"owner": "text",
"ownerType": "text",
"pii": {
"collections": [
{
"collectionId": "text",
"collections": [
{
"occurrences": [
{
"columnNumber": 1,
"excerpt": "text",
"fileName": "text",
"lineNumber": 1,
"sample": "text"
}
],
"sourceId": "text"
}
],
"isSensitive": true,
"name": "text"
}
],
"language": "text",
"probableSinks": [
"text"
],
"processing": [
{
"occurrences": [
{
"columnNumber": 1,
"excerpt": "text",
"fileName": "text",
"lineNumber": 1,
"sample": "text"
}
],
"sourceId": "text"
}
],
"sinkProcessing": [
{
"occurrences": [
{
"columnNumber": 1,
"excerpt": "text",
"fileName": "text",
"lineNumber": 1,
"sample": "text"
}
],
"sinkId": "text"
}
],
"sources": [
{
"category": "text",
"id": "text",
"isSensitive": true,
"name": "text",
"sensitivity": "LOW",
"sourceType": "text",
"tags": {
"ANY_ADDITIONAL_PROPERTY": "text"
}
}
]
},
"platform": "text",
"repoSizeBytes": 1,
"repository": "text",
"repositoryId": "text",
"sbom": "text",
"secretsEnrolled": true,
"secretsExcludes": [
"text"
],
"tenantId": "text",
"timestamp": "text",
"timestampUnix": 1
}
},
"version": "text"
}Get repository stats
Returns the stats for one repository. Take repositoryId from the list call; an unknown ID returns 404.
Returns a sorted map of repository stats. The map is sorted by repositoryID and contains a list of repository stats for each repositoryID.
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Not Found
Internal Server Error
GET /sast/repositories/{repositoryId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"repository": {
"codePaths": {
"exclude": [
"text"
],
"include": [
"text"
]
},
"countsBySeverity": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"countsByType": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"defaultBranch": "text",
"defaultBranchCommittedAt": "2026-01-01T00:00:00.000Z",
"defaultBranchSha": "text",
"id": "text",
"isArchived": true,
"isDefaultBranch": true,
"isEnrolled": true,
"language": "text",
"languages": [
"text"
],
"owner": "text",
"ownerType": "text",
"pii": {
"collections": [
{
"collectionId": "text",
"collections": [
{
"occurrences": [
{
"columnNumber": 1,
"excerpt": "text",
"fileName": "text",
"lineNumber": 1,
"sample": "text"
}
],
"sourceId": "text"
}
],
"isSensitive": true,
"name": "text"
}
],
"language": "text",
"probableSinks": [
"text"
],
"processing": [
{
"occurrences": [
{
"columnNumber": 1,
"excerpt": "text",
"fileName": "text",
"lineNumber": 1,
"sample": "text"
}
],
"sourceId": "text"
}
],
"sinkProcessing": [
{
"occurrences": [
{
"columnNumber": 1,
"excerpt": "text",
"fileName": "text",
"lineNumber": 1,
"sample": "text"
}
],
"sinkId": "text"
}
],
"sources": [
{
"category": "text",
"id": "text",
"isSensitive": true,
"name": "text",
"sensitivity": "LOW",
"sourceType": "text",
"tags": {
"ANY_ADDITIONAL_PROPERTY": "text"
}
}
]
},
"platform": "text",
"repoSizeBytes": 1,
"repository": "text",
"repositoryId": "text",
"sbom": "text",
"secretsEnrolled": true,
"secretsExcludes": [
"text"
],
"tenantId": "text",
"timestamp": "text",
"timestampUnix": 1
},
"version": "text"
}List scan runs
Lists scan runs for one repository, with status, trigger, branch, commit and counts of live, new, fixed, reintroduced and allowlisted findings plus severity totals. repositoryId is required. This list uses offset paging: limit defaults to 10 and is capped at 50, offset skips rows, sort is newest (default) or oldest, and from and to are RFC 3339 bounds on the start time. The response includes totalCount.
Repository ID to list scan runs for
Max scan runs per page (default 10, max 50)
Pagination offset (default 0)
Sort order by start time (default newest)
Only include scan runs started at or after this RFC3339 timestamp
Only include scan runs started at or before this RFC3339 timestamp
The Azure organization ID
The Bitbucket workspace ID
The Github owner ID
The GitLab group ID
The Nullify installation ID
Filter by Azure repository IDs
Filter by GitHub repository IDs
Filter by GitHub team ID
Filter by Bitbucket repository IDs
OK
Bad Request
Forbidden
Internal Server Error
GET /sast/scan-runs?repositoryId=text HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"scanRuns": [
{
"allowlistedFindingsCount": 1,
"branch": "text",
"commitHash": "text",
"completedAt": "text",
"errorMessage": "text",
"fixedFindingsCount": 1,
"isDefaultBranch": true,
"liveFindingsCount": 1,
"newFindingsCount": 1,
"reintroducedFindingsCount": 1,
"scaOutcome": {
"coverageGaps": [
{
"ecosystems": [
"text"
],
"packageAuth": [
{
"credential": "rejected",
"dir": "text",
"ecosystem": "text",
"evidence": "text",
"registry": "text",
"tool": "text",
"version": 1
}
],
"reason": "text",
"scope": "text",
"side": "source",
"source": "sbom",
"status": "text",
"suspect": {
"firstSeen": "2026-01-01T00:00:00.000Z",
"loss": "text",
"sha256": "text",
"version": 1
},
"touchedByChange": true
}
],
"degraded": true,
"failureStage": "clone",
"keptLiveCoverage": 1,
"keptLiveNotSeenInSbom": 1,
"keptLivePackageGate": 1,
"keptLiveUnchangedManifests": 1,
"sbomAuthoritative": true,
"sbomFailureClass": "oom",
"sbomIncomplete": true,
"sbomSource": "text",
"ticketsReopenSkipped": 1
},
"scanCompletedAt": "text",
"scanRunId": "text",
"severityCritical": 1,
"severityHigh": 1,
"severityLow": 1,
"severityMedium": 1,
"startedAt": "text",
"status": "text",
"triggerType": "text"
}
],
"totalCount": 1
}Published operation index
This index comes from the published specification. Check its request and response schemas before calling an operation; deployment versions and feature availability can differ.
GET
/sast/events
Get SAST Events
GET
/sast/findings
Get SAST Findings
POST
/sast/findings/allowlist
Allowlist Batch of SAST Findings
GET
/sast/findings/detailed
Get Findings Detailed
GET
/sast/findings/preview
Get SAST Findings
GET
/sast/findings/{findingId}
Get Finding
PATCH
/sast/findings/{findingId}
Update Finding
POST
/sast/findings/{findingId}/allowlist
Allowlist Finding
GET
/sast/findings/{findingId}/autofix/activity
Get SAST Finding Autofix Activity
GET
/sast/findings/{findingId}/autofix/cache/diff
Get Finding Autofix Diff
POST
/sast/findings/{findingId}/autofix/fix
Post Finding AutoFix
GET
/sast/findings/{findingId}/autofix/state
Get SAST Finding Autofix State
GET
/sast/findings/{findingId}/autofix/status
Get SAST Finding Autofix Status
GET
/sast/findings/{findingId}/events
Get Finding Events
DELETE
/sast/findings/{findingId}/ticket
Delete Ticket
POST
/sast/findings/{findingId}/ticket
Create Ticket
GET
/sast/findings/{findingId}/triage
Get Triaged Finding
POST
/sast/findings/{findingId}/unallowlist
Unallowlist Finding
GET
/sast/findings/{findingId}/users
Get Finding Users
GET
/sast/repositories
Get Repositories
GET
/sast/repositories/{repositoryId}
Get Repository Stats
GET
/sast/scan-runs
List Scan Runs
Last updated