Code Review API

Query code review findings and events via the Nullify API

Existing endpoints retain the /sast prefix for backwards compatibility. New wrappers will be introduced over time without breaking the current contract.

Base URL

All endpoints share the base URL: https://api.<TENANT>.nullify.ai. Replace <TENANT> with your tenant slug (for example https://api.acme.nullify.ai).

Events

Receive a stream of notable code-review activity (new findings, fixes, suppressions, branch summaries):

Get SAST Events

get

Returns SAST events after a specified timestamp or event ID. All events are returned if no timestamp or event ID is provided. A maximum of 100 events can be returned per request.

Query parameters

nextTokenstring · nullableOptional

limitinteger · nullableOptional

fromTimestring · nullableOptional

eventTypestring[]Optional

fileOwnerNamestring[]Optional

findingIdstring · nullableOptional

sortstring · nullableOptional

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Responses

200

OK

application/json

nextTokenstringRequired

numItemsintegerRequired

versionstringOptional

400

Bad Request

application/json

403

Forbidden

application/json

500

Internal Server Error

application/json

get/sast/events

HTTPcURLJavaScriptPython

GET /sast/events HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*

{
  "events": [
    {
      "data": null,
      "id": "text",
      "time": "text",
      "timestampUnix": 1,
      "type": "org_context_agent_started"
    }
  ],
  "nextToken": "text",
  "numItems": 1,
  "version": "text"
}

curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/events?githubOwnerId=1234'

List Findings

List active findings with filtering by repository, severity, or status:

Get SAST Findings

get

Returns a filtered set of SAST findings based on query parameters

Query parameters

nextTokenstring · nullableOptional

limitinteger · nullableOptional

priorityLabelstring · nullableOptional

severitystring · nullableOptional

fileOwnerNamestring[]Optional

hasPullRequestboolean · nullableOptional

branchstring · nullableOptional

workflowstring · nullableOptional

repositoryIdsstring[]Optional

if not provided, all repositories will be included

isResolvedboolean · nullableOptional

combination of isFixed, isFalsePositive, isAllowlisted and isArchived

isFixedboolean · nullableOptional

isFalsePositiveboolean · nullableOptional

isAllowlistedboolean · nullableOptional

isArchivedboolean · nullableOptional

aiGeneratedboolean · nullableOptional

true = AI code-review only, false = rule-only, omitted = both

isLatestboolean · nullableOptional

autoFixStatestring · nullableOptional

filter by AutoFixState (e.g. 'none' for findings with no cached fix)

sortBystring · nullableOptional

sortstring · nullableOptional

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Responses

200

OK

application/json

nextTokenstringRequired

numItemsintegerRequired

versionstringOptional

400

Bad Request

application/json

403

Forbidden

application/json

500

Internal Server Error

application/json

get/sast/findings

HTTPcURLJavaScriptPython

GET /sast/findings HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*

{
  "findings": [
    {
      "aiDevTitle": "text",
      "aiGenerated": true,
      "aiTitle": "text",
      "allowlistReason": "text",
      "allowlistState": "none",
      "allowlistType": "AI",
      "autoFixEndTime": "2026-07-13T08:45:45.187Z",
      "autoFixStartTime": "2026-07-13T08:45:45.187Z",
      "autoFixState": "none",
      "branch": "text",
      "category": "text",
      "commitHash": "text",
      "createdAt": "text",
      "cwe": 1,
      "cweIds": [
        1
      ],
      "endLine": 1,
      "endLines": [
        1
      ],
      "entrypoint": "text",
      "fileOwners": [
        {
          "name": "text",
          "type": "email"
        }
      ],
      "filePath": "text",
      "firstSeenCommit": "text",
      "graphExists": true,
      "id": "text",
      "isAllowlisted": true,
      "isArchived": true,
      "isCloudTriaged": true,
      "isFalsePositive": true,
      "isLatest": true,
      "isResolved": true,
      "language": "Apex",
      "message": "text",
      "priorityLabel": "URGENT",
      "priorityOverride": "URGENT",
      "priorityScore": 1,
      "projectId": "text",
      "projectName": "text",
      "pullRequestsAllowlist": [
        {
          "createdAt": "2026-07-13T08:45:45.187Z",
          "explanation": "text",
          "firstReviewedAt": "2026-07-13T08:45:45.187Z",
          "hasCustomerCommit": true,
          "hasCustomerFeedback": true,
          "id": 1,
          "lastReviewedAt": "2026-07-13T08:45:45.187Z",
          "link": "text",
          "mergedAt": "2026-07-13T08:45:45.187Z",
          "pullRequestProvider": {
            "azure": {
              "pullRequestId": 1
            },
            "bitbucket": {
              "pullRequestId": 1
            },
            "github": {
              "pullRequestNodeId": "text",
              "pullRequestNumber": 1
            },
            "gitlab": {
              "mergeRequestNumber": 1
            },
            "id": "Nullify"
          },
          "status": "open",
          "title": "text",
          "updatedAt": "2026-07-13T08:45:45.187Z"
        }
      ],
      "pullRequestsAutofix": [
        {
          "createdAt": "2026-07-13T08:45:45.187Z",
          "explanation": "text",
          "firstReviewedAt": "2026-07-13T08:45:45.187Z",
          "hasCustomerCommit": true,
          "hasCustomerFeedback": true,
          "id": 1,
          "lastReviewedAt": "2026-07-13T08:45:45.187Z",
          "link": "text",
          "mergedAt": "2026-07-13T08:45:45.187Z",
          "pullRequestProvider": {
            "azure": {
              "pullRequestId": 1
            },
            "bitbucket": {
              "pullRequestId": 1
            },
            "github": {
              "pullRequestNodeId": "text",
              "pullRequestNumber": 1
            },
            "gitlab": {
              "mergeRequestNumber": 1
            },
            "id": "Nullify"
          },
          "status": "open",
          "title": "text",
          "updatedAt": "2026-07-13T08:45:45.187Z"
        }
      ],
      "repository": "text",
      "repositoryId": "text",
      "ruleId": "text",
      "ruleIds": [
        "text"
      ],
      "ruleUrl": "text",
      "ruleUrls": [
        "text"
      ],
      "severity": "CRITICAL",
      "startLine": 1,
      "startLines": [
        1
      ],
      "tenantId": "text",
      "ticket": {
        "asana": {
          "projectGid": "text",
          "taskGid": "text",
          "url": "text"
        },
        "azure": {
          "url": "text",
          "workItemId": 1
        },
        "github": {
          "issueId": 1,
          "nodeId": "text",
          "number": 1,
          "repositoryName": "text",
          "url": "text"
        },
        "gitlab": {},
        "jira": {
          "issueId": "text",
          "issueKey": "text",
          "url": "text"
        },
        "linear": {
          "issueId": "text",
          "teamId": "text",
          "url": "text"
        },
        "providerId": "Nullify"
      },
      "title": "text",
      "triageEnd": "2026-07-13T08:45:45.187Z",
      "triageStart": "2026-07-13T08:45:45.187Z",
      "updatedAt": "text",
      "workflow": "text"
    }
  ],
  "nextToken": "text",
  "numItems": 1,
  "version": "text"
}

curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings?githubOwnerId=1234&severity=high'

Get a Finding

Retrieve full context for a single finding, including reachability evidence and ownership metadata:

Get Finding

get

Returns a given finding with explanation and impact

Path parameters

findingIdstringRequired

Query parameters

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Responses

200

OK

application/json

presignedUrlstringRequired

versionstringOptional

400

Bad Request

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

get/sast/findings/{findingId}

HTTPcURLJavaScriptPython

GET /sast/findings/{findingId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*

{
  "finding": {
    "aiConfidence": 1,
    "aiDevTitle": "text",
    "aiGenerated": true,
    "aiSignalCategory": "text",
    "aiTitle": "text",
    "allowlistReason": "text",
    "allowlistState": "none",
    "allowlistType": "AI",
    "autoFixCurrentActivity": "text",
    "autoFixDurationMs": 1,
    "autoFixEndTime": "2026-07-13T08:45:45.187Z",
    "autoFixLLMCostUSD": 1,
    "autoFixStartTime": "2026-07-13T08:45:45.187Z",
    "autoFixState": "none",
    "autoFixTokenCount": 1,
    "autoFixTotalDurationSecs": 1,
    "autoFixTotalInputTokens": 1,
    "autoFixTotalIterations": 1,
    "autoFixTotalOutputTokens": 1,
    "autofixVerdictAt": "2026-07-13T08:45:45.187Z",
    "autofixVerdictExplanation": "text",
    "autofixVerdictReason": "AGENT_ERROR",
    "branch": "text",
    "budgetExhausted": true,
    "budgetLimit": 1,
    "budgetUsed": 1,
    "category": "text",
    "commitHash": "text",
    "concurrencyLimit": 1,
    "createdAt": "text",
    "cwe": 1,
    "cweIds": [
      1
    ],
    "deletedAt": "2026-07-13T08:45:45.187Z",
    "description": "text",
    "devDescription": "text",
    "endLine": 1,
    "endLines": [
      1
    ],
    "entrypoint": "text",
    "exploitabilityConfidence": "text",
    "exploitabilityLabel": "text",
    "failedTriage": true,
    "fileOwners": [
      {
        "name": "text",
        "type": "email"
      }
    ],
    "filePath": "text",
    "firstSeenCommit": "text",
    "fixCommit": "text",
    "fixSource": "nullify_autofix",
    "fixedAt": "2026-07-13T08:45:45.187Z",
    "graphExists": true,
    "id": "text",
    "impactConfidence": "text",
    "impactLabel": "text",
    "installationId": "text",
    "isAllowlisted": true,
    "isArchived": true,
    "isAutoFixableAgentVerdict": true,
    "isCloudTriaged": true,
    "isFalsePositive": true,
    "isFixed": true,
    "isLatest": true,
    "isResolved": true,
    "language": "Apex",
    "message": "text",
    "owner": "text",
    "platform": "text",
    "priorityLabel": "URGENT",
    "priorityLabelReason": "text",
    "priorityOverride": "URGENT",
    "priorityScore": 1,
    "projectId": "text",
    "projectName": "text",
    "pullRequestsAllowlist": [
      {
        "createdAt": "2026-07-13T08:45:45.187Z",
        "explanation": "text",
        "firstReviewedAt": "2026-07-13T08:45:45.187Z",
        "hasCustomerCommit": true,
        "hasCustomerFeedback": true,
        "id": 1,
        "lastReviewedAt": "2026-07-13T08:45:45.187Z",
        "link": "text",
        "mergedAt": "2026-07-13T08:45:45.187Z",
        "pullRequestProvider": {
          "azure": {
            "pullRequestId": 1
          },
          "bitbucket": {
            "pullRequestId": 1
          },
          "github": {
            "pullRequestNodeId": "text",
            "pullRequestNumber": 1
          },
          "gitlab": {
            "mergeRequestNumber": 1
          },
          "id": "Nullify"
        },
        "status": "open",
        "title": "text",
        "updatedAt": "2026-07-13T08:45:45.187Z"
      }
    ],
    "pullRequestsAutofix": [
      {
        "createdAt": "2026-07-13T08:45:45.187Z",
        "explanation": "text",
        "firstReviewedAt": "2026-07-13T08:45:45.187Z",
        "hasCustomerCommit": true,
        "hasCustomerFeedback": true,
        "id": 1,
        "lastReviewedAt": "2026-07-13T08:45:45.187Z",
        "link": "text",
        "mergedAt": "2026-07-13T08:45:45.187Z",
        "pullRequestProvider": {
          "azure": {
            "pullRequestId": 1
          },
          "bitbucket": {
            "pullRequestId": 1
          },
          "github": {
            "pullRequestNodeId": "text",
            "pullRequestNumber": 1
          },
          "gitlab": {
            "mergeRequestNumber": 1
          },
          "id": "Nullify"
        },
        "status": "open",
        "title": "text",
        "updatedAt": "2026-07-13T08:45:45.187Z"
      }
    ],
    "repository": "text",
    "repositoryId": "text",
    "resolvedAt": "2026-07-13T08:45:45.187Z",
    "ruleId": "text",
    "ruleIds": [
      "text"
    ],
    "rulePriorConfidence": 1,
    "ruleUrl": "text",
    "ruleUrls": [
      "text"
    ],
    "severity": "CRITICAL",
    "severityConfidence": "text",
    "severityLabel": "CRITICAL",
    "severityOverride": "CRITICAL",
    "severityScore": 1,
    "startLine": 1,
    "startLines": [
      1
    ],
    "tenantId": "text",
    "ticket": {
      "asana": {
        "projectGid": "text",
        "taskGid": "text",
        "url": "text"
      },
      "azure": {
        "url": "text",
        "workItemId": 1
      },
      "github": {
        "issueId": 1,
        "nodeId": "text",
        "number": 1,
        "repositoryName": "text",
        "url": "text"
      },
      "gitlab": {},
      "jira": {
        "issueId": "text",
        "issueKey": "text",
        "url": "text"
      },
      "linear": {
        "issueId": "text",
        "teamId": "text",
        "url": "text"
      },
      "providerId": "Nullify"
    },
    "ticketState": "text",
    "title": "text",
    "triageAgentVersion": "text",
    "triageDurationSeconds": 1,
    "triageEnd": "2026-07-13T08:45:45.187Z",
    "triageLangfuseSessionId": "text",
    "triageLangfuseTraceId": "text",
    "triageLlmCostUsd": 1,
    "triageMaxInputTokens": 1,
    "triageStart": "2026-07-13T08:45:45.187Z",
    "triageTokenCount": 1,
    "triageTraceId": "text",
    "updatedAt": "text",
    "userNotes": "text",
    "workflow": "text"
  },
  "presignedUrl": "text",
  "version": "text"
}

curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N?githubOwnerId=1234'

Update a Finding

Override a finding's priority or severity. The request accepts priorityOverride (URGENT, IMPORTANT, MEDIUM, LOW) and severityOverride (CRITICAL, HIGH, MEDIUM, LOW):

Update Finding

patch

Update a given finding with the fields provided

Path parameters

findingIdstringRequired

Query parameters

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Body

application/json

priorityOverridestring · enum · nullableOptionalPossible values:

severityOverridestring · enum · nullableOptionalPossible values:

Responses

200

OK

application/json

versionstringOptional

400

Bad Request

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

patch/sast/findings/{findingId}

HTTPcURLJavaScriptPython

PATCH /sast/findings/{findingId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 59

{
  "priorityOverride": "URGENT",
  "severityOverride": "CRITICAL"
}

{
  "finding": {
    "aiConfidence": 1,
    "aiDevTitle": "text",
    "aiGenerated": true,
    "aiSignalCategory": "text",
    "aiTitle": "text",
    "allowlistReason": "text",
    "allowlistState": "none",
    "allowlistType": "AI",
    "autoFixCurrentActivity": "text",
    "autoFixDurationMs": 1,
    "autoFixEndTime": "2026-07-13T08:45:45.187Z",
    "autoFixLLMCostUSD": 1,
    "autoFixStartTime": "2026-07-13T08:45:45.187Z",
    "autoFixState": "none",
    "autoFixTokenCount": 1,
    "autoFixTotalDurationSecs": 1,
    "autoFixTotalInputTokens": 1,
    "autoFixTotalIterations": 1,
    "autoFixTotalOutputTokens": 1,
    "autofixVerdictAt": "2026-07-13T08:45:45.187Z",
    "autofixVerdictExplanation": "text",
    "autofixVerdictReason": "AGENT_ERROR",
    "branch": "text",
    "budgetExhausted": true,
    "budgetLimit": 1,
    "budgetUsed": 1,
    "category": "text",
    "commitHash": "text",
    "concurrencyLimit": 1,
    "createdAt": "text",
    "cwe": 1,
    "cweIds": [
      1
    ],
    "deletedAt": "2026-07-13T08:45:45.187Z",
    "description": "text",
    "devDescription": "text",
    "endLine": 1,
    "endLines": [
      1
    ],
    "entrypoint": "text",
    "exploitabilityConfidence": "text",
    "exploitabilityLabel": "text",
    "failedTriage": true,
    "fileOwners": [
      {
        "name": "text",
        "type": "email"
      }
    ],
    "filePath": "text",
    "firstSeenCommit": "text",
    "fixCommit": "text",
    "fixSource": "nullify_autofix",
    "fixedAt": "2026-07-13T08:45:45.187Z",
    "graphExists": true,
    "id": "text",
    "impactConfidence": "text",
    "impactLabel": "text",
    "installationId": "text",
    "isAllowlisted": true,
    "isArchived": true,
    "isAutoFixableAgentVerdict": true,
    "isCloudTriaged": true,
    "isFalsePositive": true,
    "isFixed": true,
    "isLatest": true,
    "isResolved": true,
    "language": "Apex",
    "message": "text",
    "owner": "text",
    "platform": "text",
    "priorityLabel": "URGENT",
    "priorityLabelReason": "text",
    "priorityOverride": "URGENT",
    "priorityScore": 1,
    "projectId": "text",
    "projectName": "text",
    "pullRequestsAllowlist": [
      {
        "createdAt": "2026-07-13T08:45:45.187Z",
        "explanation": "text",
        "firstReviewedAt": "2026-07-13T08:45:45.187Z",
        "hasCustomerCommit": true,
        "hasCustomerFeedback": true,
        "id": 1,
        "lastReviewedAt": "2026-07-13T08:45:45.187Z",
        "link": "text",
        "mergedAt": "2026-07-13T08:45:45.187Z",
        "pullRequestProvider": {
          "azure": {
            "pullRequestId": 1
          },
          "bitbucket": {
            "pullRequestId": 1
          },
          "github": {
            "pullRequestNodeId": "text",
            "pullRequestNumber": 1
          },
          "gitlab": {
            "mergeRequestNumber": 1
          },
          "id": "Nullify"
        },
        "status": "open",
        "title": "text",
        "updatedAt": "2026-07-13T08:45:45.187Z"
      }
    ],
    "pullRequestsAutofix": [
      {
        "createdAt": "2026-07-13T08:45:45.187Z",
        "explanation": "text",
        "firstReviewedAt": "2026-07-13T08:45:45.187Z",
        "hasCustomerCommit": true,
        "hasCustomerFeedback": true,
        "id": 1,
        "lastReviewedAt": "2026-07-13T08:45:45.187Z",
        "link": "text",
        "mergedAt": "2026-07-13T08:45:45.187Z",
        "pullRequestProvider": {
          "azure": {
            "pullRequestId": 1
          },
          "bitbucket": {
            "pullRequestId": 1
          },
          "github": {
            "pullRequestNodeId": "text",
            "pullRequestNumber": 1
          },
          "gitlab": {
            "mergeRequestNumber": 1
          },
          "id": "Nullify"
        },
        "status": "open",
        "title": "text",
        "updatedAt": "2026-07-13T08:45:45.187Z"
      }
    ],
    "repository": "text",
    "repositoryId": "text",
    "resolvedAt": "2026-07-13T08:45:45.187Z",
    "ruleId": "text",
    "ruleIds": [
      "text"
    ],
    "rulePriorConfidence": 1,
    "ruleUrl": "text",
    "ruleUrls": [
      "text"
    ],
    "severity": "CRITICAL",
    "severityConfidence": "text",
    "severityLabel": "CRITICAL",
    "severityOverride": "CRITICAL",
    "severityScore": 1,
    "startLine": 1,
    "startLines": [
      1
    ],
    "tenantId": "text",
    "ticket": {
      "asana": {
        "projectGid": "text",
        "taskGid": "text",
        "url": "text"
      },
      "azure": {
        "url": "text",
        "workItemId": 1
      },
      "github": {
        "issueId": 1,
        "nodeId": "text",
        "number": 1,
        "repositoryName": "text",
        "url": "text"
      },
      "gitlab": {},
      "jira": {
        "issueId": "text",
        "issueKey": "text",
        "url": "text"
      },
      "linear": {
        "issueId": "text",
        "teamId": "text",
        "url": "text"
      },
      "providerId": "Nullify"
    },
    "ticketState": "text",
    "title": "text",
    "triageAgentVersion": "text",
    "triageDurationSeconds": 1,
    "triageEnd": "2026-07-13T08:45:45.187Z",
    "triageLangfuseSessionId": "text",
    "triageLangfuseTraceId": "text",
    "triageLlmCostUsd": 1,
    "triageMaxInputTokens": 1,
    "triageStart": "2026-07-13T08:45:45.187Z",
    "triageTokenCount": 1,
    "triageTraceId": "text",
    "updatedAt": "text",
    "userNotes": "text",
    "workflow": "text"
  },
  "version": "text"
}

curl -s -X PATCH \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"severityOverride": "HIGH"}' \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N?githubOwnerId=1234'

Get Triage Details

Retrieve the AI triage reasoning and reachability assessment for a finding:

Get Triaged Finding

get

Returns the triage data for a specific finding

Path parameters

findingIdstringRequired

Query parameters

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Responses

200

OK

application/json

presignedUrlstringRequired

versionstringOptional

400

Bad Request

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

get/sast/findings/{findingId}/triage

HTTPcURLJavaScriptPython

GET /sast/findings/{findingId}/triage HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*

{
  "finding": {
    "agentVersion": "text",
    "assessmentFactors": [
      {
        "description": "text",
        "title": "text"
      }
    ],
    "codeContext": {
      "codeBlocks": [
        {
          "codeText": "text",
          "endLine": 1,
          "filePath": "text",
          "startLine": 1
        }
      ],
      "dataFlow": "text",
      "error": "text",
      "exitReason": "text",
      "summary": "text",
      "thoughts": "text"
    },
    "falsePositiveReason": "text",
    "finding": {
      "aiConfidence": 1,
      "aiDevTitle": "text",
      "aiGenerated": true,
      "aiSignalCategory": "text",
      "aiTitle": "text",
      "allowlistReason": "text",
      "allowlistState": "none",
      "allowlistType": "AI",
      "autoFixCurrentActivity": "text",
      "autoFixDurationMs": 1,
      "autoFixEndTime": "2026-07-13T08:45:45.187Z",
      "autoFixLLMCostUSD": 1,
      "autoFixStartTime": "2026-07-13T08:45:45.187Z",
      "autoFixState": "none",
      "autoFixTokenCount": 1,
      "autoFixTotalDurationSecs": 1,
      "autoFixTotalInputTokens": 1,
      "autoFixTotalIterations": 1,
      "autoFixTotalOutputTokens": 1,
      "autofixVerdictAt": "2026-07-13T08:45:45.187Z",
      "autofixVerdictExplanation": "text",
      "autofixVerdictReason": "AGENT_ERROR",
      "branch": "text",
      "budgetExhausted": true,
      "budgetLimit": 1,
      "budgetUsed": 1,
      "category": "text",
      "commitHash": "text",
      "concurrencyLimit": 1,
      "createdAt": "text",
      "cwe": 1,
      "cweIds": [
        1
      ],
      "deletedAt": "2026-07-13T08:45:45.187Z",
      "description": "text",
      "devDescription": "text",
      "endLine": 1,
      "endLines": [
        1
      ],
      "entrypoint": "text",
      "exploitabilityConfidence": "text",
      "exploitabilityLabel": "text",
      "failedTriage": true,
      "fileOwners": [
        {
          "name": "text",
          "type": "email"
        }
      ],
      "filePath": "text",
      "firstSeenCommit": "text",
      "fixCommit": "text",
      "fixSource": "nullify_autofix",
      "fixedAt": "2026-07-13T08:45:45.187Z",
      "graphExists": true,
      "id": "text",
      "impactConfidence": "text",
      "impactLabel": "text",
      "installationId": "text",
      "isAllowlisted": true,
      "isArchived": true,
      "isAutoFixableAgentVerdict": true,
      "isCloudTriaged": true,
      "isFalsePositive": true,
      "isFixed": true,
      "isLatest": true,
      "isResolved": true,
      "language": "Apex",
      "message": "text",
      "owner": "text",
      "platform": "text",
      "priorityLabel": "URGENT",
      "priorityLabelReason": "text",
      "priorityOverride": "URGENT",
      "priorityScore": 1,
      "projectId": "text",
      "projectName": "text",
      "pullRequestsAllowlist": [
        {
          "createdAt": "2026-07-13T08:45:45.187Z",
          "explanation": "text",
          "firstReviewedAt": "2026-07-13T08:45:45.187Z",
          "hasCustomerCommit": true,
          "hasCustomerFeedback": true,
          "id": 1,
          "lastReviewedAt": "2026-07-13T08:45:45.187Z",
          "link": "text",
          "mergedAt": "2026-07-13T08:45:45.187Z",
          "pullRequestProvider": {
            "azure": {
              "pullRequestId": 1
            },
            "bitbucket": {
              "pullRequestId": 1
            },
            "github": {
              "pullRequestNodeId": "text",
              "pullRequestNumber": 1
            },
            "gitlab": {
              "mergeRequestNumber": 1
            },
            "id": "Nullify"
          },
          "status": "open",
          "title": "text",
          "updatedAt": "2026-07-13T08:45:45.187Z"
        }
      ],
      "pullRequestsAutofix": [
        {
          "createdAt": "2026-07-13T08:45:45.187Z",
          "explanation": "text",
          "firstReviewedAt": "2026-07-13T08:45:45.187Z",
          "hasCustomerCommit": true,
          "hasCustomerFeedback": true,
          "id": 1,
          "lastReviewedAt": "2026-07-13T08:45:45.187Z",
          "link": "text",
          "mergedAt": "2026-07-13T08:45:45.187Z",
          "pullRequestProvider": {
            "azure": {
              "pullRequestId": 1
            },
            "bitbucket": {
              "pullRequestId": 1
            },
            "github": {
              "pullRequestNodeId": "text",
              "pullRequestNumber": 1
            },
            "gitlab": {
              "mergeRequestNumber": 1
            },
            "id": "Nullify"
          },
          "status": "open",
          "title": "text",
          "updatedAt": "2026-07-13T08:45:45.187Z"
        }
      ],
      "repository": "text",
      "repositoryId": "text",
      "resolvedAt": "2026-07-13T08:45:45.187Z",
      "ruleId": "text",
      "ruleIds": [
        "text"
      ],
      "rulePriorConfidence": 1,
      "ruleUrl": "text",
      "ruleUrls": [
        "text"
      ],
      "severity": "CRITICAL",
      "severityConfidence": "text",
      "severityLabel": "CRITICAL",
      "severityOverride": "CRITICAL",
      "severityScore": 1,
      "startLine": 1,
      "startLines": [
        1
      ],
      "tenantId": "text",
      "ticket": {
        "asana": {
          "projectGid": "text",
          "taskGid": "text",
          "url": "text"
        },
        "azure": {
          "url": "text",
          "workItemId": 1
        },
        "github": {
          "issueId": 1,
          "nodeId": "text",
          "number": 1,
          "repositoryName": "text",
          "url": "text"
        },
        "gitlab": {},
        "jira": {
          "issueId": "text",
          "issueKey": "text",
          "url": "text"
        },
        "linear": {
          "issueId": "text",
          "teamId": "text",
          "url": "text"
        },
        "providerId": "Nullify"
      },
      "ticketState": "text",
      "title": "text",
      "triageAgentVersion": "text",
      "triageDurationSeconds": 1,
      "triageEnd": "2026-07-13T08:45:45.187Z",
      "triageLangfuseSessionId": "text",
      "triageLangfuseTraceId": "text",
      "triageLlmCostUsd": 1,
      "triageMaxInputTokens": 1,
      "triageStart": "2026-07-13T08:45:45.187Z",
      "triageTokenCount": 1,
      "triageTraceId": "text",
      "updatedAt": "text",
      "userNotes": "text",
      "workflow": "text"
    },
    "fixStoryPointEstimate": 1,
    "investigationSteps": [
      {
        "details": [
          "text"
        ],
        "title": "text"
      }
    ],
    "isFalsePositive": true,
    "orgContextVersion": "text",
    "priority": {
      "description": "text",
      "exploitability": {
        "attackComplexity": {
          "description": "text",
          "label": "HIGH",
          "privilegesRequired": {
            "description": "text",
            "label": "AUTHENTICATED"
          }
        },
        "attackVector": {
          "description": "text",
          "label": "ADJACENT",
          "subVector": [
            "LOCAL_COMMAND_LINE_ARGUMENT"
          ]
        },
        "description": "text",
        "evidence": {
          "edges": [
            {
              "explanation": "text",
              "sourceId": "text",
              "targetId": "text",
              "type": "ABOUT"
            }
          ],
          "nodes": []
        },
        "label": "LIKELY"
      },
      "fixEffort": {
        "description": "text",
        "label": "EASY"
      },
      "label": "FALSE_POSITIVE",
      "score": 1,
      "severity": {
        "availability": {
          "cause": [
            "BUFFER_OVERFLOW"
          ],
          "description": "text",
          "label": "HIGH"
        },
        "businessCriticality": {
          "description": "text",
          "label": "HIGH"
        },
        "confidentiality": {
          "dataLeaked": [
            "ADDRESS"
          ],
          "label": "HIGH"
        },
        "description": "text",
        "integrity": {
          "description": "text",
          "label": "HIGH",
          "type": [
            "BEHAVIOUR_MANIPULATED"
          ]
        },
        "label": "CRITICAL"
      }
    },
    "repoContextVersion": "text",
    "triage": {
      "budgetExhausted": true,
      "campaignMetadata": {
        "id": "text",
        "name": "text"
      },
      "cloudContext": {
        "confidence": 1,
        "mode": "MODEA",
        "repos": [
          "text"
        ],
        "thoughts": "text"
      },
      "customerQuestions": {
        "customMessage": "text",
        "generatedMemoryIds": [
          "text"
        ],
        "id": "text",
        "questions": [
          {
            "answer": null,
            "answerMemoryId": "text",
            "answeredAt": "2026-07-13T08:45:45.187Z",
            "customMessage": "text",
            "findingIds": [
              "text"
            ],
            "id": "text",
            "options": [
              {
                "id": "text",
                "label": "text",
                "value": "text"
              }
            ],
            "questionText": "text",
            "questionType": "FREE_TEXT",
            "relatedMemoryIds": [
              "text"
            ],
            "scope": "CLOUD",
            "scopeResourceId": "text",
            "unknownIds": [
              "text"
            ]
          }
        ]
      },
      "description": "text",
      "descriptionSummary": "text",
      "devDescription": "text",
      "devTitle": "text",
      "evidence": {
        "edges": [
          {
            "explanation": "text",
            "sourceId": "text",
            "targetId": "text",
            "type": "ABOUT"
          }
        ],
        "nodes": []
      },
      "exploitHypothesis": {
        "edges": [
          {
            "explanation": "text",
            "sourceId": "text",
            "targetId": "text",
            "type": "ABOUT"
          }
        ],
        "nodes": []
      },
      "exploitability": {
        "attackComplexity": {
          "description": "text",
          "exploitChainRequired": {
            "description": "text",
            "label": "HIGH",
            "title": "text"
          },
          "label": "HIGH",
          "payloadDifficulty": {
            "description": "text",
            "label": "EASY"
          }
        },
        "attackRequirements": {
          "description": "text",
          "environmentState": {
            "description": "text",
            "label": "HIGH",
            "title": "text"
          },
          "label": "HIGH",
          "mitm": {
            "description": "text",
            "label": "HIGH",
            "title": "text"
          },
          "raceCondition": {
            "description": "text",
            "label": "HIGH",
            "title": "text"
          },
          "timeWindow": {
            "description": "text",
            "label": "HIGH",
            "title": "text"
          },
          "title": "text"
        },
        "attackVector": {
          "description": "text",
          "label": "ADJACENT",
          "subVectors": [
            {
              "description": "text",
              "otherVector": "text",
              "vector": "ADJACENT_ARP_SPOOFING"
            }
          ]
        },
        "confidence": "HIGH",
        "description": "text",
        "label": "LIKELY",
        "privilegesRequired": {
          "description": "text",
          "label": "HIGH",
          "title": "text",
          "types": [
            "PRIVILEGED_USER"
          ]
        },
        "title": "text",
        "unknowns": [
          "text"
        ],
        "userInteraction": {
          "description": "text",
          "label": "ACTIVE",
          "otherTypes": [
            "text"
          ],
          "title": "text",
          "types": [
            "BROWSING"
          ]
        }
      },
      "failedTriage": true,
      "fixEffort": {
        "confidence": "HIGH",
        "description": "text",
        "label": "EASY",
        "title": "text",
        "unknowns": [
          "text"
        ]
      },
      "id": "text",
      "impact": {
        "availability": {
          "cause": [
            "BUFFER_OVERFLOW"
          ],
          "description": "text",
          "label": "HIGH",
          "title": "text",
          "type": [
            "COMPLETE_SERVICE_OUTAGE"
          ]
        },
        "businessCriticality": {
          "description": "text",
          "label": "HIGH",
          "title": "text"
        },
        "confidence": "HIGH",
        "confidentiality": {
          "dataLeaked": [
            "ACCESS_TOKEN"
          ],
          "label": "HIGH"
        },
        "description": "text",
        "integrity": {
          "description": "text",
          "label": "HIGH",
          "title": "text",
          "type": [
            "DATABASE_ALTERED"
          ]
        },
        "label": "CRITICAL",
        "title": "text",
        "unknowns": [
          "text"
        ]
      },
      "investigationConfidence": "HIGH",
      "investigationId": "text",
      "investigationUnknowns": [
        "text"
      ],
      "lastTriagedAt": "2026-07-13T08:45:45.187Z",
      "memoriesGenerated": [
        "text"
      ],
      "memoriesUsed": [
        "text"
      ],
      "parentTriageId": "text",
      "pentest": {
        "attemptedCVEs": [
          "text"
        ],
        "confidence": 1,
        "cost": 1,
        "duration": 1,
        "exploitedCVE": "text",
        "logs": [
          {
            "logs": [],
            "summary": "text"
          }
        ],
        "outcome": "CANNOT_DETERMINE",
        "report": "text",
        "reproductionScript": "text",
        "testedEndpoints": [
          {
            "method": "text",
            "path": "text"
          }
        ]
      },
      "priority": "FALSE_POSITIVE",
      "retriageComparison": {
        "narrative": "text",
        "newInformation": {
          "cloudContextUpdated": true,
          "memoryChanges": [
            {
              "description": "text",
              "kind": "ADDED"
            }
          ],
          "pentestResultAdded": true,
          "userComments": [
            {
              "commentId": "text",
              "influence": "changed_verdict",
              "keyClaim": "text"
            }
          ]
        },
        "qualityAssessment": {
          "remainingUncertainties": [
            "text"
          ],
          "sufficientEvidence": true
        },
        "verdictChanges": [
          {
            "current": "text",
            "field": "text",
            "previous": "text",
            "reason": "text"
          }
        ]
      },
      "retriageMetadata": {
        "memoryChanges": [
          {
            "memoryChangeType": "MEMORY_ADDED",
            "memoryId": "text"
          }
        ],
        "triggeredAt": "2026-07-13T08:45:45.187Z"
      },
      "retriageStatus": "NOT_RETRIAGED",
      "severity": {
        "confidence": "HIGH",
        "label": "CRITICAL",
        "score": 1,
        "unknowns": [
          "text"
        ]
      },
      "thoughts": "text",
      "title": "text",
      "version": 1
    },
    "triagedCommitSha": "text"
  },
  "presignedUrl": "text",
  "version": "text",
  "vulnManagementFrameworks": {
    "results": [
      {
        "controls": [
          {
            "confidence": "exact",
            "id": "text",
            "level": "text",
            "relationship": "text",
            "title": "text",
            "url": "text"
          }
        ],
        "framework": "cvss-3.1",
        "mappingConfidence": "exact",
        "notes": [
          "text"
        ],
        "rank": "text",
        "score": {
          "baseScore": 1,
          "nomenclature": "text",
          "qualitative": "text",
          "synthesized": true,
          "vector": "text"
        },
        "version": "text"
      }
    ]
  }
}

curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/triage?githubOwnerId=1234'

Allowlist a Finding

Apply a policy exception when you accept the risk for a finding. Supply an allowlistReason and an allowlistType (AI, UserFixed, UserAssumeRisk, UserFalsePositive, or UserOther):

Allowlist Finding

post

Allowlists a finding

Path parameters

findingIdstringRequired

Query parameters

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Body

application/json

allowlistReasonstringRequired

The reason for allowlisting the finding

allowlistTypestring · enumRequiredPossible values:

Responses

200

OK

application/json

linkstringOptional

A link to the pull request

titlestringOptional

The title of the pull request

versionstringOptional

400

Bad Request

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

post/sast/findings/{findingId}/allowlist

HTTPcURLJavaScriptPython

POST /sast/findings/{findingId}/allowlist HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 47

{
  "allowlistReason": "text",
  "allowlistType": "AI"
}

{
  "link": "text",
  "title": "text",
  "version": "text"
}

curl -s -X POST \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"allowlistReason": "Risk accepted for legacy service", "allowlistType": "UserAssumeRisk"}' \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/allowlist?githubOwnerId=1234'

Remove a Finding from the Allowlist

Re-activate alerting for a previously allowlisted finding:

Unallowlist Finding

post

Unallowlists a finding

Path parameters

findingIdstringRequired

Query parameters

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Body

application/json

unallowlistReasonstringRequired

The reason for unallowlisting the finding

Responses

204

No Content

No content

400

Bad Request

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

post/sast/findings/{findingId}/unallowlist

HTTPcURLJavaScriptPython

POST /sast/findings/{findingId}/unallowlist HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 28

{
  "unallowlistReason": "text"
}

No content

curl -s -X POST \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/unallowlist?githubOwnerId=1234'

Allowlist Findings in Bulk

Allowlist multiple findings in a single call. The body adds a findingIds array alongside the standard allowlistReason and allowlistType:

Allowlist Batch of SAST Findings

post

Allowlist a list of SAST findings, by findingsID

Query parameters

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Body

application/json

allowlistReasonstringRequired

The reason for allowing the finding

allowlistTypestring · enumRequiredPossible values:

findingIdsstring[] · nullableRequired

The ID of the finding to allowlist

Responses

204

No Content

No content

400

Bad Request

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

post/sast/findings/allowlist

HTTPcURLJavaScriptPython

POST /sast/findings/allowlist HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 69

{
  "allowlistReason": "text",
  "allowlistType": "AI",
  "findingIds": [
    "text"
  ]
}

No content

curl -s -X POST \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
        "findingIds": ["01J6EEXK3NKYKWW9XTPQYAF41N", "01J6EFVQN34BCEAHDJTE4F9Y22"],
        "allowlistReason": "Risk accepted for legacy service",
        "allowlistType": "UserAssumeRisk"
      }' \
  'https://api.<TENANT>.nullify.ai/sast/findings/allowlist?githubOwnerId=1234'

Trigger Autofix

Request a remediation patch for supported languages:

Post Finding AutoFix

post

Creates a pull request to fix a given finding

Path parameters

findingIdstringRequired

Query parameters

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Body

application/json

forceboolean · nullableOptional

messagestringOptional

originCampaignIdstringOptional

Responses

200

OK

application/json

autoFixStatestring · enumRequiredPossible values:

errorstringOptional

versionstringOptional

400

Bad Request

application/json

403

Forbidden

application/json

404

Not Found

application/json

409

Conflict

application/json

500

Internal Server Error

application/json

post/sast/findings/{findingId}/autofix/fix

HTTPcURLJavaScriptPython

POST /sast/findings/{findingId}/autofix/fix HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 941

{
  "assignees": [
    {
      "asana": {
        "id": "text"
      },
      "azure": {
        "id": "text"
      },
      "azureEntra": {
        "id": "text"
      },
      "bitbucket": {
        "id": "text"
      },
      "createdAt": "text",
      "createdBy": "text",
      "email": "text",
      "github": {
        "id": 1,
        "nodeId": "text"
      },
      "gitlab": {
        "id": 1
      },
      "googleWorkspace": {
        "id": "text"
      },
      "id": "text",
      "isBot": true,
      "jira": {
        "id": "text",
        "name": "text"
      },
      "lastUpdatedBy": "text",
      "linear": {
        "id": "text"
      },
      "name": "text",
      "okta": {
        "id": "text"
      },
      "provider": {
        "asana": {
          "id": "text"
        },
        "azure": {
          "id": "text"
        },
        "azureEntra": {
          "id": "text"
        },
        "bitBucket": {
          "id": "text"
        },
        "gitHub": {
          "id": 1,
          "nodeId": "text"
        },
        "gitlab": {
          "id": 1
        },
        "googleWorkspace": {
          "id": "text"
        },
        "id": "Nullify",
        "jira": {
          "id": "text",
          "name": "text"
        },
        "linear": {
          "id": "text"
        },
        "okta": {
          "id": "text"
        },
        "slack": {
          "id": "text",
          "name": "text"
        },
        "teams": {
          "id": "text",
          "teamIDs": [
            "text"
          ]
        }
      },
      "slack": {
        "id": "text",
        "name": "text"
      },
      "slug": "text",
      "teams": {
        "id": "text",
        "teamIDs": [
          "text"
        ]
      },
      "updatedAt": "text",
      "username": "text"
    }
  ],
  "force": true,
  "message": "text",
  "originCampaignId": "text"
}

{
  "autoFixState": "none",
  "error": "text",
  "version": "text"
}

curl -s -X POST \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/autofix/fix?githubOwnerId=1234'

Finding Events

Review every decision applied to a finding (status changes, tickets, suppressions):

Get Finding Events

get

Returns a list of events for a given finding.

Path parameters

findingIdstringRequired

Query parameters

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Responses

200

OK

application/json

numItemsintegerRequired

versionstringOptional

400

Bad Request

application/json

403

Forbidden

application/json

404

Not Found

application/json

500

Internal Server Error

application/json

get/sast/findings/{findingId}/events

HTTPcURLJavaScriptPython

GET /sast/findings/{findingId}/events HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*

{
  "events": [
    {
      "data": null,
      "id": "text",
      "time": "text",
      "timestampUnix": 1,
      "type": "org_context_agent_started"
    }
  ],
  "numItems": 1,
  "version": "text"
}

curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/events?githubOwnerId=1234'

List Repositories

Enumerate the repositories Code Review is scanning, along with their scan status:

Get Repositories

get

Returns a map of repository stats. The map is sorted by repositoryID and contains a list of repository stats for each repositoryID.

Query parameters

nextTokenstring · nullableOptional

limitinteger · nullableOptional

azureOrganizationIdstringOptional

The Azure organization ID

bitbucketWorkspaceIdstringOptional

The Bitbucket workspace ID

githubOwnerIdinteger · int64Optional

The Github owner ID

gitlabGroupIdinteger · int64Optional

The GitLab group ID

installationIdstringOptional

The Nullify installation ID

azureRepositoryIdstring[]Optional

Filter by Azure repository IDs

githubRepositoryIdinteger · int64[]Optional

Filter by GitHub repository IDs

githubTeamIdinteger · int64Optional

Filter by GitHub team ID

bitbucketRepositoryIdstring[]Optional

Filter by Bitbucket repository IDs

Responses

200

OK

application/json

nextTokenstringRequired

numItemsintegerRequired

versionstringRequired

400

Bad Request

application/json

403

Forbidden

application/json

500

Internal Server Error

application/json

get/sast/repositories

HTTPcURLJavaScriptPython

GET /sast/repositories HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*

{
  "nextToken": "text",
  "numItems": 1,
  "repositories": {
    "ANY_ADDITIONAL_PROPERTY": {
      "countsBySeverity": {
        "ANY_ADDITIONAL_PROPERTY": 1
      },
      "countsByType": {
        "ANY_ADDITIONAL_PROPERTY": 1
      },
      "defaultBranch": "text",
      "defaultBranchCommittedAt": "2026-07-13T08:45:45.187Z",
      "defaultBranchSha": "text",
      "id": "text",
      "isArchived": true,
      "isDefaultBranch": true,
      "isEnrolled": true,
      "language": "text",
      "languages": [
        "text"
      ],
      "nullifyConfigFile": {
        "code": {
          "enableFailBuilds": true,
          "ignore": [
            {
              "cwes": [
                1
              ],
              "dirs": [
                "text"
              ],
              "expiry": "text",
              "paths": [
                "text"
              ],
              "reason": "text",
              "repositories": [
                "text"
              ],
              "ruleIds": [
                "text"
              ]
            }
          ]
        },
        "dependencies": {
          "enableFailBuilds": true,
          "ignore": [
            {
              "cves": [
                "text"
              ],
              "dirs": [
                "text"
              ],
              "expiry": "text",
              "paths": [
                "text"
              ],
              "reason": "text",
              "repositories": [
                "text"
              ]
            }
          ]
        },
        "enableFailBuilds": true,
        "enableIssueDashboards": true,
        "enablePullRequestReviews": true,
        "ignoreDirs": [
          "text"
        ],
        "ignorePaths": [
          "text"
        ],
        "integrations": {
          "jira": {
            "assignee": {
              "id": "text",
              "name": "text"
            },
            "commentOnClose": true,
            "descriptionTemplate": "text",
            "disabled": true,
            "enabled": true,
            "issueType": "text",
            "labels": [
              "text"
            ],
            "onFixTransition": "text",
            "priorities": {
              "critical": "text",
              "high": "text",
              "important": "text",
              "low": "text",
              "medium": "text",
              "negligible": "text",
              "urgent": "text"
            },
            "priorityThreshold": "text",
            "projectKey": "text",
            "severityThreshold": "text",
            "titleTemplate": "text"
          }
        },
        "priorityThreshold": "text",
        "secrets": {
          "customPatterns": {
            "ANY_ADDITIONAL_PROPERTY": {
              "description": "text",
              "entropy": 1,
              "keywords": [
                "text"
              ],
              "pathRegex": "text",
              "secretRegex": "text",
              "secretRegexGroup": 1
            }
          },
          "customPatternsOverrideGlobal": true,
          "enableFailBuilds": true,
          "ignore": [
            {
              "expiry": "text",
              "paths": [
                "text"
              ],
              "pattern": "text",
              "reason": "text",
              "repositories": [
                "text"
              ],
              "sha256": "text",
              "value": "text"
            }
          ]
        },
        "secretsWhitelist": [
          "text"
        ],
        "severityThreshold": "text"
      },
      "owner": "text",
      "ownerType": "text",
      "pii": {
        "collections": [
          {
            "collectionId": "text",
            "collections": [
              {
                "occurrences": [
                  {
                    "columnNumber": 1,
                    "excerpt": "text",
                    "fileName": "text",
                    "lineNumber": 1,
                    "sample": "text"
                  }
                ],
                "sourceId": "text"
              }
            ],
            "isSensitive": true,
            "name": "text"
          }
        ],
        "language": "text",
        "probableSinks": [
          "text"
        ],
        "processing": [
          {
            "occurrences": [
              {
                "columnNumber": 1,
                "excerpt": "text",
                "fileName": "text",
                "lineNumber": 1,
                "sample": "text"
              }
            ],
            "sourceId": "text"
          }
        ],
        "sinkProcessing": [
          {
            "occurrences": [
              {
                "columnNumber": 1,
                "excerpt": "text",
                "fileName": "text",
                "lineNumber": 1,
                "sample": "text"
              }
            ],
            "sinkId": "text"
          }
        ],
        "sources": [
          {
            "category": "text",
            "id": "text",
            "isSensitive": true,
            "name": "text",
            "sensitivity": "LOW",
            "sourceType": "text",
            "tags": {
              "ANY_ADDITIONAL_PROPERTY": "text"
            }
          }
        ]
      },
      "platform": "text",
      "repository": "text",
      "repositoryId": "text",
      "sbom": "text",
      "tenantId": "text",
      "timestamp": "text",
      "timestampUnix": 1
    }
  },
  "version": "text"
}

curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/repositories?githubOwnerId=1234'