> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/api-reference/api-reference/code-review.md).

# Code Review API

> Existing endpoints retain the `/sast` prefix for backwards compatibility. New wrappers will be introduced over time without breaking the current contract.

## Base URL

All endpoints share the base URL: `https://api.<TENANT>.nullify.ai`. Replace `<TENANT>` with your tenant slug (for example `https://api.acme.nullify.ai`).

## Events

Receive a stream of notable code-review activity (new findings, fixes, suppressions, branch summaries):

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/events" method="get" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/events?githubOwnerId=1234'
```

## List Findings

List active findings with filtering by repository, severity, or status:

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings" method="get" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings?githubOwnerId=1234&severity=high'
```

## Get a Finding

Retrieve full context for a single finding, including reachability evidence and ownership metadata:

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings/{findingId}" method="get" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N?githubOwnerId=1234'
```

## Update a Finding

Override a finding's priority or severity. The request accepts `priorityOverride` (`URGENT`, `IMPORTANT`, `MEDIUM`, `LOW`) and `severityOverride` (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`):

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings/{findingId}" method="patch" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s -X PATCH \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"severityOverride": "HIGH"}' \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N?githubOwnerId=1234'
```

## Get Triage Details

Retrieve the AI triage reasoning and reachability assessment for a finding:

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings/{findingId}/triage" method="get" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/triage?githubOwnerId=1234'
```

## Allowlist a Finding

Apply a policy exception when you accept the risk for a finding. Supply an `allowlistReason` and an `allowlistType` (`AI`, `UserFixed`, `UserAssumeRisk`, `UserFalsePositive`, or `UserOther`):

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings/{findingId}/allowlist" method="post" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s -X POST \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"allowlistReason": "Risk accepted for legacy service", "allowlistType": "UserAssumeRisk"}' \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/allowlist?githubOwnerId=1234'
```

## Remove a Finding from the Allowlist

Re-activate alerting for a previously allowlisted finding:

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings/{findingId}/unallowlist" method="post" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s -X POST \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/unallowlist?githubOwnerId=1234'
```

## Allowlist Findings in Bulk

Allowlist multiple findings in a single call. The body adds a `findingIds` array alongside the standard `allowlistReason` and `allowlistType`:

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings/allowlist" method="post" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s -X POST \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
        "findingIds": ["01J6EEXK3NKYKWW9XTPQYAF41N", "01J6EFVQN34BCEAHDJTE4F9Y22"],
        "allowlistReason": "Risk accepted for legacy service",
        "allowlistType": "UserAssumeRisk"
      }' \
  'https://api.<TENANT>.nullify.ai/sast/findings/allowlist?githubOwnerId=1234'
```

## Trigger Autofix

Request a remediation patch for supported languages:

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings/{findingId}/autofix/fix" method="post" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s -X POST \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/autofix/fix?githubOwnerId=1234'
```

## Finding Events

Review every decision applied to a finding (status changes, tickets, suppressions):

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/findings/{findingId}/events" method="get" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N/events?githubOwnerId=1234'
```

## List Repositories

Enumerate the repositories Code Review is scanning, along with their scan status:

{% openapi src="/files/1NgvLK12PRq7RFdn97yd" path="/sast/repositories" method="get" %}
[nullify-openapi-bundle.yaml](https://3946391995-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FId2OtLCL6O6V3XSRYxtr%2Fuploads%2Fgit-blob-4b7b1cd7535aa66ffd67f4c0a0ee47e0e32c1cee%2Fnullify-openapi-bundle.yaml?alt=media)
{% endopenapi %}

```bash
curl -s \
  -H "Accept: application/json" \
  -H "Authorization: Bearer <TOKEN>" \
  'https://api.<TENANT>.nullify.ai/sast/repositories?githubOwnerId=1234'
```