Pentests API
Manage hands-off pentester engagements via the Nullify API
Endpoints live under the
/dast/pentestnamespace.
Base URL
https://api.<TENANT>.nullify.ai
List Applications
Pentests run against an application you have onboarded. List your applications (and their applicationIds) before starting a run:
Get all pentest application configs for a tenant
Query parameters
nextTokenstringOptional
limitintegerOptional
azureOrganizationIdstringOptional
The Azure organization ID
bitbucketWorkspaceIdstringOptional
The Bitbucket workspace ID
githubOwnerIdinteger · int64Optional
The Github owner ID
gitlabGroupIdinteger · int64Optional
The GitLab group ID
installationIdstringOptional
The Nullify installation ID
azureRepositoryIdstring[]Optional
Filter by Azure repository IDs
githubRepositoryIdinteger · int64[]Optional
Filter by GitHub repository IDs
githubTeamIdinteger · int64Optional
Filter by GitHub team ID
bitbucketRepositoryIdstring[]Optional
Filter by Bitbucket repository IDs
Responses
200
OK
application/json
nextTokenstringRequired
get/dast/pentest/applications
GET /dast/pentest/applications HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
200
OK
{
"applications": [
{
"createdAt": "2026-01-01T00:00:00.000Z",
"credentialIds": [
"text"
],
"defaultScanConfig": {
"apiType": "REST",
"attackMode": "text",
"attackStrength": "text",
"disabledChecks": [
"text"
],
"enabledChecks": [
"text"
],
"excludePatterns": [
"text"
],
"includePatterns": [
"text"
],
"isExternal": true,
"maxDepth": 1,
"maxDurationMinutes": 1,
"rateLimit": {
"burstSize": 1,
"requestsPerSecond": 1
},
"requestTimeoutSeconds": 1,
"scannerType": "text",
"scannerVersion": "text",
"targetUrl": "text",
"threadCount": 1,
"userAgents": [
"text"
]
},
"id": "text",
"targets": [
{
"host": "text",
"id": "text",
"name": "text",
"port": 1
}
],
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"nextToken": "text"
}Fetch a single application with GET /dast/pentest/applications/{applicationId}.
List Engagements
Returns all pentest scans for a tenant
Query parameters
nextTokenstringOptional
limitintegerOptional
offsetintegerOptional
Pagination offset; overrides nextToken when > 0
searchstringOptional
Server-side text search over app id / status
azureOrganizationIdstringOptional
The Azure organization ID
bitbucketWorkspaceIdstringOptional
The Bitbucket workspace ID
githubOwnerIdinteger · int64Optional
The Github owner ID
gitlabGroupIdinteger · int64Optional
The GitLab group ID
installationIdstringOptional
The Nullify installation ID
azureRepositoryIdstring[]Optional
Filter by Azure repository IDs
githubRepositoryIdinteger · int64[]Optional
Filter by GitHub repository IDs
githubTeamIdinteger · int64Optional
Filter by GitHub team ID
bitbucketRepositoryIdstring[]Optional
Filter by Bitbucket repository IDs
Responses
200
OK
application/json
nextTokenstringRequired
totalCountintegerRequired
versionstringOptional
400
Bad Request
application/json
500
Internal Server Error
application/json
get/dast/pentest/scans
GET /dast/pentest/scans HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"nextToken": "text",
"scans": [
{
"abortReason": {
"agentName": "text",
"category": "config_error",
"code": "credentials_invalid",
"deepLinkRef": "text",
"fixHint": "text",
"message": "text",
"timestamp": "2026-01-01T00:00:00.000Z"
},
"appId": "text",
"appName": "text",
"assessmentPhases": [
{
"durationSeconds": 1,
"endTime": "2026-01-01T00:00:00.000Z",
"groupedLogs": [
{
"logs": [],
"summary": "text"
}
],
"hypotheses": [
{
"description": "text",
"endpoint": "text",
"evidence": [
{
"notes": "text",
"request": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"method": "text",
"url": "text"
},
"response": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"statusCode": 1
}
}
],
"id": "text",
"result": "text",
"role": "text",
"severity": "CRITICAL",
"title": "text"
}
],
"logs": [],
"name": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"status": "text",
"usageMetrics": {
"cacheHitCost": 1,
"cacheHitTokenCount": 1,
"cacheWriteCost": 1,
"cacheWriteTokenCount": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
}
],
"endTime": "2026-01-01T00:00:00.000Z",
"executionArn": "text",
"failureReason": "text",
"findingIds": [
"text"
],
"id": "text",
"isExternal": true,
"networkLogs": [
{
"timestamp": "2026-01-01T00:00:00.000Z",
"transactions": [
{
"authRedacted": true,
"correlationId": "text",
"durationMs": 1,
"endTime": "2026-01-01T00:00:00.000Z",
"error": "text",
"protocol": "text",
"request": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"method": "text",
"url": "text"
},
"response": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"statusCode": 1
},
"startTime": "2026-01-01T00:00:00.000Z"
}
]
}
],
"progress": 1,
"startTime": "2026-01-01T00:00:00.000Z",
"status": "queued",
"tenantId": "text",
"totalCost": {
"costByPhase": {
"ANY_ADDITIONAL_PROPERTY": {
"cacheHitCost": 1,
"cacheHitTokenCount": 1,
"cacheWriteCost": 1,
"cacheWriteTokenCount": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
},
"totalCacheHitCost": 1,
"totalCacheHitTokens": 1,
"totalCacheWriteCost": 1,
"totalCacheWriteTokens": 1,
"totalCost": 1,
"totalInputCost": 1,
"totalInputTokens": 1,
"totalOutputCost": 1,
"totalOutputTokens": 1
}
}
],
"totalCount": 1,
"version": "text"
}Start an Engagement
Pentests run against an application you have already onboarded. Supply the applicationId (from List Applications above) and an optional configOverrides object to tune the run:
Start a new pentest scan using the supplied Application configuration. The pentest workflow runs its own preflight check internally and aborts the scan to aborted_config_error if the application is not pentestable.
Query parameters
azureOrganizationIdstringOptional
The Azure organization ID
bitbucketWorkspaceIdstringOptional
The Bitbucket workspace ID
githubOwnerIdinteger · int64Optional
The Github owner ID
gitlabGroupIdinteger · int64Optional
The GitLab group ID
installationIdstringOptional
The Nullify installation ID
azureRepositoryIdstring[]Optional
Filter by Azure repository IDs
githubRepositoryIdinteger · int64[]Optional
Filter by GitHub repository IDs
githubTeamIdinteger · int64Optional
Filter by GitHub team ID
bitbucketRepositoryIdstring[]Optional
Filter by Bitbucket repository IDs
Body
applicationIdstringRequired
onboardingDispatchbooleanOptional
Responses
200
OK
application/json
modestring · enumOptionalPossible values:
versionstringOptional
400
Bad Request
application/json
404
Not Found
application/json
409
Conflict
application/json
412
Precondition Failed
application/json
429
Too Many Requests
application/json
500
Internal Server Error
application/json
post/dast/pentest/start
POST /dast/pentest/start HTTP/1.1
Host: api.<TENANT>.nullify.ai
Content-Type: application/json
Accept: */*
Content-Length: 1485
{
"applicationId": "text",
"configOverrides": {
"apiSchema": "text",
"credentials": [
{
"config": {
"apiKey": "text",
"apiKeyParamName": "text",
"apiKeyPlacement": "header",
"audience": "text",
"auth0Tenant": "text",
"authUrl": "text",
"clientId": "text",
"clientSecret": "text",
"connection": "text",
"enableLoginOptimization": true,
"hints": "text",
"idpType": "text",
"issuer": "text",
"loginBodyFormat": "form",
"loginStrategy": "auto",
"loginUrl": "text",
"mfaType": "totp",
"oauthFlow": "client_credentials",
"password": "text",
"passwordField": "text",
"realm": "text",
"redirectUri": "text",
"refreshToken": "text",
"resource": "text",
"scope": "text",
"token": "text",
"tokenPath": "text",
"tokenType": "text",
"tokenUrl": "text",
"totp": {
"algorithm": "text",
"digits": 1,
"period": 1,
"secret": "text"
},
"username": "text",
"usernameField": "text"
},
"createdAt": "2026-01-01T00:00:00.000Z",
"deletedAt": "2026-01-01T00:00:00.000Z",
"deletedBy": "text",
"description": "text",
"id": "text",
"isDeleted": true,
"lastUsed": "2026-01-01T00:00:00.000Z",
"lastValidatedAt": "2026-01-01T00:00:00.000Z",
"name": "text",
"tenantId": "text",
"type": "username_password",
"updatedAt": "2026-01-01T00:00:00.000Z",
"usageCount": 1,
"validationEvidence": {
"duration": 1,
"error": "text",
"message": "text",
"responseHeaders": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"status": "unknown",
"statusCode": 1,
"testUrl": "text",
"validatedBy": "text"
}
}
],
"enableAuthMatrix": true,
"enableExploitAnalysis": true,
"enablePentestTools": true,
"targets": [
{
"host": "text",
"id": "text",
"name": "text",
"port": 1
}
]
},
"onboardingDispatch": true
}{
"mode": "self_serve_started",
"scan": {
"abortReason": {
"agentName": "text",
"category": "config_error",
"code": "credentials_invalid",
"deepLinkRef": "text",
"fixHint": "text",
"message": "text",
"timestamp": "2026-01-01T00:00:00.000Z"
},
"appId": "text",
"appName": "text",
"assessmentPhases": [
{
"durationSeconds": 1,
"endTime": "2026-01-01T00:00:00.000Z",
"groupedLogs": [
{
"logs": [],
"summary": "text"
}
],
"hypotheses": [
{
"description": "text",
"endpoint": "text",
"evidence": [
{
"notes": "text",
"request": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"method": "text",
"url": "text"
},
"response": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"statusCode": 1
}
}
],
"id": "text",
"result": "text",
"role": "text",
"severity": "CRITICAL",
"title": "text"
}
],
"logs": [],
"name": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"status": "text",
"usageMetrics": {
"cacheHitCost": 1,
"cacheHitTokenCount": 1,
"cacheWriteCost": 1,
"cacheWriteTokenCount": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
}
],
"endTime": "2026-01-01T00:00:00.000Z",
"executionArn": "text",
"failureReason": "text",
"findingIds": [
"text"
],
"id": "text",
"isExternal": true,
"networkLogs": [
{
"timestamp": "2026-01-01T00:00:00.000Z",
"transactions": [
{
"authRedacted": true,
"correlationId": "text",
"durationMs": 1,
"endTime": "2026-01-01T00:00:00.000Z",
"error": "text",
"protocol": "text",
"request": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"method": "text",
"url": "text"
},
"response": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"statusCode": 1
},
"startTime": "2026-01-01T00:00:00.000Z"
}
]
}
],
"progress": 1,
"startTime": "2026-01-01T00:00:00.000Z",
"status": "queued",
"tenantId": "text",
"totalCost": {
"costByPhase": {
"ANY_ADDITIONAL_PROPERTY": {
"cacheHitCost": 1,
"cacheHitTokenCount": 1,
"cacheWriteCost": 1,
"cacheWriteTokenCount": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
},
"totalCacheHitCost": 1,
"totalCacheHitTokens": 1,
"totalCacheWriteCost": 1,
"totalCacheWriteTokens": 1,
"totalCost": 1,
"totalInputCost": 1,
"totalInputTokens": 1,
"totalOutputCost": 1,
"totalOutputTokens": 1
}
},
"version": "text"
}Retrieve Engagement Status
Returns the details of a pentest scan
Path parameters
scanIdstringRequired
Query parameters
azureOrganizationIdstringOptional
The Azure organization ID
bitbucketWorkspaceIdstringOptional
The Bitbucket workspace ID
githubOwnerIdinteger · int64Optional
The Github owner ID
gitlabGroupIdinteger · int64Optional
The GitLab group ID
installationIdstringOptional
The Nullify installation ID
azureRepositoryIdstring[]Optional
Filter by Azure repository IDs
githubRepositoryIdinteger · int64[]Optional
Filter by GitHub repository IDs
githubTeamIdinteger · int64Optional
Filter by GitHub team ID
bitbucketRepositoryIdstring[]Optional
Filter by Bitbucket repository IDs
Responses
200
OK
application/json
versionstringOptional
400
Bad Request
application/json
404
Not Found
application/json
500
Internal Server Error
application/json
get/dast/pentest/scans/{scanId}
GET /dast/pentest/scans/{scanId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"scan": {
"abortReason": {
"agentName": "text",
"category": "config_error",
"code": "credentials_invalid",
"deepLinkRef": "text",
"fixHint": "text",
"message": "text",
"timestamp": "2026-01-01T00:00:00.000Z"
},
"appId": "text",
"appName": "text",
"assessmentPhases": [
{
"durationSeconds": 1,
"endTime": "2026-01-01T00:00:00.000Z",
"groupedLogs": [
{
"logs": [],
"summary": "text"
}
],
"hypotheses": [
{
"description": "text",
"endpoint": "text",
"evidence": [
{
"notes": "text",
"request": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"method": "text",
"url": "text"
},
"response": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"statusCode": 1
}
}
],
"id": "text",
"result": "text",
"role": "text",
"severity": "CRITICAL",
"title": "text"
}
],
"logs": [],
"name": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"status": "text",
"usageMetrics": {
"cacheHitCost": 1,
"cacheHitTokenCount": 1,
"cacheWriteCost": 1,
"cacheWriteTokenCount": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
}
],
"endTime": "2026-01-01T00:00:00.000Z",
"executionArn": "text",
"failureReason": "text",
"findingIds": [
"text"
],
"id": "text",
"isExternal": true,
"networkLogs": [
{
"timestamp": "2026-01-01T00:00:00.000Z",
"transactions": [
{
"authRedacted": true,
"correlationId": "text",
"durationMs": 1,
"endTime": "2026-01-01T00:00:00.000Z",
"error": "text",
"protocol": "text",
"request": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"method": "text",
"url": "text"
},
"response": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"statusCode": 1
},
"startTime": "2026-01-01T00:00:00.000Z"
}
]
}
],
"progress": 1,
"startTime": "2026-01-01T00:00:00.000Z",
"status": "queued",
"tenantId": "text",
"totalCost": {
"costByPhase": {
"ANY_ADDITIONAL_PROPERTY": {
"cacheHitCost": 1,
"cacheHitTokenCount": 1,
"cacheWriteCost": 1,
"cacheWriteTokenCount": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
},
"totalCacheHitCost": 1,
"totalCacheHitTokens": 1,
"totalCacheWriteCost": 1,
"totalCacheWriteTokens": 1,
"totalCost": 1,
"totalInputCost": 1,
"totalInputTokens": 1,
"totalOutputCost": 1,
"totalOutputTokens": 1
}
},
"version": "text"
}List Engagement Findings
Returns the list of all the pentest findings from a scan
Path parameters
scanIdstringRequired
Query parameters
azureOrganizationIdstringOptional
The Azure organization ID
bitbucketWorkspaceIdstringOptional
The Bitbucket workspace ID
githubOwnerIdinteger · int64Optional
The Github owner ID
gitlabGroupIdinteger · int64Optional
The GitLab group ID
installationIdstringOptional
The Nullify installation ID
azureRepositoryIdstring[]Optional
Filter by Azure repository IDs
githubRepositoryIdinteger · int64[]Optional
Filter by GitHub repository IDs
githubTeamIdinteger · int64Optional
Filter by GitHub team ID
bitbucketRepositoryIdstring[]Optional
Filter by Bitbucket repository IDs
Responses
200
OK
application/json
versionstringOptional
400
Bad Request
application/json
404
Not Found
application/json
500
Internal Server Error
application/json
get/dast/pentest/scans/{scanId}/findings
GET /dast/pentest/scans/{scanId}/findings HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"findings": [
{
"allowlistType": "AI",
"allowlistedReason": "text",
"api": {
"errorDescription": "text",
"errorType": "text",
"findingScope": "endpoint",
"httpVersion": "text",
"method": "text",
"path": "text",
"previousResponse": "text",
"queryParameters": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"requestBody": "text",
"requestHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"responseBody": "text",
"responseHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"severity": "CRITICAL",
"solution": "text",
"uri": "text",
"vulnerableParameterName": "text",
"vulnerableParameterValue": "text",
"zapAlertRef": "text",
"zapPluginId": "text"
},
"authMatrix": {
"hypothesis": "text",
"user": {
"roleDescription": "text",
"roleName": "text",
"userName": "text"
}
},
"autoFixCurrentActivity": "text",
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"concurrencyLimit": 1,
"createdAt": "2026-01-01T00:00:00.000Z",
"cwe": 1,
"endpoint": {
"method": "text",
"path": "text"
},
"host": "text",
"id": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixable": true,
"isAutoFixableAgentVerdict": true,
"isFalsePositive": true,
"isFixed": true,
"isLatest": true,
"priorityLabel": "URGENT",
"priorityScore": 1,
"pullRequestsAutofix": [
{
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "Nullify"
},
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"repository": "text",
"repositoryFullName": "text",
"repositoryId": "text",
"repositoryName": "text",
"repositoryPath": "text",
"scanInfo": {
"appId": "text",
"scanId": "text",
"scanType": "API",
"targetUrl": "text"
},
"source": "AIPenTester",
"summary": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "Nullify"
},
"title": "text",
"triage": {
"budgetExhausted": true,
"campaignMetadata": {
"id": "text",
"name": "text"
},
"cloudContext": {
"confidence": 1,
"mode": "MODEA",
"repos": [
"text"
],
"thoughts": "text"
},
"complianceImpact": {
"citations": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"confidence": "HIGH",
"frameworks": [
{
"clause": "text",
"framework": "CCPA",
"obligation": "text"
}
],
"rationale": "text"
},
"customerQuestions": {
"customMessage": "text",
"generatedMemoryIds": [
"text"
],
"id": "text",
"questions": [
{
"answer": null,
"answerMemoryId": "text",
"answeredAt": "2026-01-01T00:00:00.000Z",
"customMessage": "text",
"findingIds": [
"text"
],
"id": "text",
"options": [
{
"id": "text",
"label": "text",
"value": "text"
}
],
"questionText": "text",
"questionType": "FREE_TEXT",
"relatedMemoryIds": [
"text"
],
"scope": "CLOUD",
"scopeResourceId": "text",
"unknownIds": [
"text"
]
}
]
},
"description": "text",
"descriptionSummary": "text",
"devDescription": "text",
"devTitle": "text",
"evidence": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitHypothesis": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitability": {
"attackComplexity": {
"description": "text",
"exploitChainRequired": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"payloadDifficulty": {
"description": "text",
"label": "EASY"
}
},
"attackRequirements": {
"description": "text",
"environmentState": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"mitm": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"raceCondition": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"timeWindow": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"title": "text"
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVectors": [
{
"description": "text",
"otherVector": "text",
"vector": "ADJACENT_ARP_SPOOFING"
}
]
},
"confidence": "HIGH",
"description": "text",
"label": "LIKELY",
"privilegesRequired": {
"description": "text",
"label": "HIGH",
"title": "text",
"types": [
"PRIVILEGED_USER"
]
},
"title": "text",
"unknowns": [
"text"
],
"userInteraction": {
"description": "text",
"label": "ACTIVE",
"otherTypes": [
"text"
],
"title": "text",
"types": [
"BROWSING"
]
}
},
"failedTriage": true,
"fixEffort": {
"confidence": "HIGH",
"description": "text",
"label": "EASY",
"title": "text",
"unknowns": [
"text"
]
},
"id": "text",
"impact": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"COMPLETE_SERVICE_OUTAGE"
]
},
"businessCriticality": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"confidence": "HIGH",
"confidentiality": {
"dataLeaked": [
"ACCESS_TOKEN"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"DATABASE_ALTERED"
]
},
"label": "CRITICAL",
"title": "text",
"unknowns": [
"text"
]
},
"investigationConfidence": "HIGH",
"investigationId": "text",
"investigationUnknowns": [
"text"
],
"lastTriagedAt": "2026-01-01T00:00:00.000Z",
"memoriesGenerated": [
"text"
],
"memoriesUsed": [
"text"
],
"parentTriageId": "text",
"pentest": {
"attemptedCVEs": [
"text"
],
"confidence": 1,
"cost": 1,
"duration": 1,
"exploitedCVE": "text",
"logs": [
{
"logs": [],
"summary": "text"
}
],
"outcome": "CANNOT_DETERMINE",
"report": "text",
"reproductionScript": "text",
"testedEndpoints": [
{
"method": "text",
"path": "text"
}
]
},
"priority": "FALSE_POSITIVE",
"references": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"retriageComparison": {
"narrative": "text",
"newInformation": {
"cloudContextUpdated": true,
"memoryChanges": [
{
"description": "text",
"kind": "ADDED"
}
],
"pentestResultAdded": true,
"userComments": [
{
"commentId": "text",
"influence": "changed_verdict",
"keyClaim": "text"
}
]
},
"qualityAssessment": {
"remainingUncertainties": [
"text"
],
"sufficientEvidence": true
},
"verdictChanges": [
{
"current": "text",
"field": "text",
"previous": "text",
"reason": "text"
}
]
},
"retriageMetadata": {
"memoryChanges": [
{
"memoryChangeType": "MEMORY_ADDED",
"memoryId": "text"
}
],
"triggeredAt": "2026-01-01T00:00:00.000Z"
},
"retriageStatus": "NOT_RETRIAGED",
"severity": {
"confidence": "HIGH",
"label": "CRITICAL",
"score": 1,
"unknowns": [
"text"
]
},
"stopReason": "cost_cap",
"thoughts": "text",
"title": "text",
"version": 1
},
"updatedAt": "2026-01-01T00:00:00.000Z",
"userRole": "text",
"userRoleDescription": "text"
}
],
"version": "text"
}Stop an Engagement
Request to stop a pentest scan
Path parameters
scanIdstringRequired
Query parameters
azureOrganizationIdstringOptional
The Azure organization ID
bitbucketWorkspaceIdstringOptional
The Bitbucket workspace ID
githubOwnerIdinteger · int64Optional
The Github owner ID
gitlabGroupIdinteger · int64Optional
The GitLab group ID
installationIdstringOptional
The Nullify installation ID
azureRepositoryIdstring[]Optional
Filter by Azure repository IDs
githubRepositoryIdinteger · int64[]Optional
Filter by GitHub repository IDs
githubTeamIdinteger · int64Optional
Filter by GitHub team ID
bitbucketRepositoryIdstring[]Optional
Filter by Bitbucket repository IDs
Responses
200
OK
application/json
versionstringOptional
400
Bad Request
application/json
403
Forbidden
application/json
404
Not Found
application/json
412
Precondition Failed
application/json
500
Internal Server Error
application/json
post/dast/pentest/scans/{scanId}/stop
POST /dast/pentest/scans/{scanId}/stop HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"scan": {
"abortReason": {
"agentName": "text",
"category": "config_error",
"code": "credentials_invalid",
"deepLinkRef": "text",
"fixHint": "text",
"message": "text",
"timestamp": "2026-01-01T00:00:00.000Z"
},
"appId": "text",
"appName": "text",
"assessmentPhases": [
{
"durationSeconds": 1,
"endTime": "2026-01-01T00:00:00.000Z",
"groupedLogs": [
{
"logs": [],
"summary": "text"
}
],
"hypotheses": [
{
"description": "text",
"endpoint": "text",
"evidence": [
{
"notes": "text",
"request": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"method": "text",
"url": "text"
},
"response": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"statusCode": 1
}
}
],
"id": "text",
"result": "text",
"role": "text",
"severity": "CRITICAL",
"title": "text"
}
],
"logs": [],
"name": "text",
"startTime": "2026-01-01T00:00:00.000Z",
"status": "text",
"usageMetrics": {
"cacheHitCost": 1,
"cacheHitTokenCount": 1,
"cacheWriteCost": 1,
"cacheWriteTokenCount": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
}
],
"endTime": "2026-01-01T00:00:00.000Z",
"executionArn": "text",
"failureReason": "text",
"findingIds": [
"text"
],
"id": "text",
"isExternal": true,
"networkLogs": [
{
"timestamp": "2026-01-01T00:00:00.000Z",
"transactions": [
{
"authRedacted": true,
"correlationId": "text",
"durationMs": 1,
"endTime": "2026-01-01T00:00:00.000Z",
"error": "text",
"protocol": "text",
"request": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"method": "text",
"url": "text"
},
"response": {
"body": "text",
"headers": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"statusCode": 1
},
"startTime": "2026-01-01T00:00:00.000Z"
}
]
}
],
"progress": 1,
"startTime": "2026-01-01T00:00:00.000Z",
"status": "queued",
"tenantId": "text",
"totalCost": {
"costByPhase": {
"ANY_ADDITIONAL_PROPERTY": {
"cacheHitCost": 1,
"cacheHitTokenCount": 1,
"cacheWriteCost": 1,
"cacheWriteTokenCount": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
},
"totalCacheHitCost": 1,
"totalCacheHitTokens": 1,
"totalCacheWriteCost": 1,
"totalCacheWriteTokens": 1,
"totalCost": 1,
"totalInputCost": 1,
"totalInputTokens": 1,
"totalOutputCost": 1,
"totalOutputTokens": 1
}
},
"version": "text"
}Download an Engagement Report
Returns the report of a completed pentest scan
Path parameters
scanIdstringRequired
Query parameters
azureOrganizationIdstringOptional
The Azure organization ID
bitbucketWorkspaceIdstringOptional
The Bitbucket workspace ID
githubOwnerIdinteger · int64Optional
The Github owner ID
gitlabGroupIdinteger · int64Optional
The GitLab group ID
installationIdstringOptional
The Nullify installation ID
azureRepositoryIdstring[]Optional
Filter by Azure repository IDs
githubRepositoryIdinteger · int64[]Optional
Filter by GitHub repository IDs
githubTeamIdinteger · int64Optional
Filter by GitHub team ID
bitbucketRepositoryIdstring[]Optional
Filter by Bitbucket repository IDs
Responses
200
OK
application/json
partialbooleanOptional
versionstringOptional
403
Forbidden
application/json
404
Not Found
application/json
412
Precondition Failed
application/json
500
Internal Server Error
application/json
get/dast/pentest/scans/{scanId}/report
GET /dast/pentest/scans/{scanId}/report HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"partial": true,
"report": {
"appendices": {
"authMatrixHypotheses": [
{
"falseReason": "text",
"findingId": "text",
"hypothesis": "text",
"isInsecure": true
}
],
"networkLogsSummary": {
"logFileReferences": [
"text"
],
"totalRequests": 1
},
"toolOutputs": {
"rawFindingsCount": 1,
"toolsUsed": [
"text"
],
"triagedFindingsCount": 1
}
},
"assessmentPeriod": {
"endDate": "text",
"startDate": "text"
},
"authMatrixResult": {
"findings": [
{
"allowlistType": "AI",
"allowlistedReason": "text",
"api": {
"errorDescription": "text",
"errorType": "text",
"findingScope": "endpoint",
"httpVersion": "text",
"method": "text",
"path": "text",
"previousResponse": "text",
"queryParameters": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"requestBody": "text",
"requestHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"responseBody": "text",
"responseHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"severity": "CRITICAL",
"solution": "text",
"uri": "text",
"vulnerableParameterName": "text",
"vulnerableParameterValue": "text",
"zapAlertRef": "text",
"zapPluginId": "text"
},
"authMatrix": {
"hypothesis": "text",
"user": {
"roleDescription": "text",
"roleName": "text",
"userName": "text"
}
},
"autoFixCurrentActivity": "text",
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"concurrencyLimit": 1,
"createdAt": "2026-01-01T00:00:00.000Z",
"cwe": 1,
"endpoint": {
"method": "text",
"path": "text"
},
"host": "text",
"id": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixable": true,
"isAutoFixableAgentVerdict": true,
"isFalsePositive": true,
"isFixed": true,
"isLatest": true,
"priorityLabel": "URGENT",
"priorityScore": 1,
"pullRequestsAutofix": [
{
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "Nullify"
},
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"repository": "text",
"repositoryFullName": "text",
"repositoryId": "text",
"repositoryName": "text",
"repositoryPath": "text",
"scanInfo": {
"appId": "text",
"scanId": "text",
"scanType": "API",
"targetUrl": "text"
},
"source": "AIPenTester",
"summary": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "Nullify"
},
"title": "text",
"triage": {
"budgetExhausted": true,
"campaignMetadata": {
"id": "text",
"name": "text"
},
"cloudContext": {
"confidence": 1,
"mode": "MODEA",
"repos": [
"text"
],
"thoughts": "text"
},
"complianceImpact": {
"citations": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"confidence": "HIGH",
"frameworks": [
{
"clause": "text",
"framework": "CCPA",
"obligation": "text"
}
],
"rationale": "text"
},
"customerQuestions": {
"customMessage": "text",
"generatedMemoryIds": [
"text"
],
"id": "text",
"questions": [
{
"answer": null,
"answerMemoryId": "text",
"answeredAt": "2026-01-01T00:00:00.000Z",
"customMessage": "text",
"findingIds": [
"text"
],
"id": "text",
"options": [
{
"id": "text",
"label": "text",
"value": "text"
}
],
"questionText": "text",
"questionType": "FREE_TEXT",
"relatedMemoryIds": [
"text"
],
"scope": "CLOUD",
"scopeResourceId": "text",
"unknownIds": [
"text"
]
}
]
},
"description": "text",
"descriptionSummary": "text",
"devDescription": "text",
"devTitle": "text",
"evidence": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitHypothesis": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitability": {
"attackComplexity": {
"description": "text",
"exploitChainRequired": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"payloadDifficulty": {
"description": "text",
"label": "EASY"
}
},
"attackRequirements": {
"description": "text",
"environmentState": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"mitm": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"raceCondition": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"timeWindow": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"title": "text"
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVectors": [
{
"description": "text",
"otherVector": "text",
"vector": "ADJACENT_ARP_SPOOFING"
}
]
},
"confidence": "HIGH",
"description": "text",
"label": "LIKELY",
"privilegesRequired": {
"description": "text",
"label": "HIGH",
"title": "text",
"types": [
"PRIVILEGED_USER"
]
},
"title": "text",
"unknowns": [
"text"
],
"userInteraction": {
"description": "text",
"label": "ACTIVE",
"otherTypes": [
"text"
],
"title": "text",
"types": [
"BROWSING"
]
}
},
"failedTriage": true,
"fixEffort": {
"confidence": "HIGH",
"description": "text",
"label": "EASY",
"title": "text",
"unknowns": [
"text"
]
},
"id": "text",
"impact": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"COMPLETE_SERVICE_OUTAGE"
]
},
"businessCriticality": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"confidence": "HIGH",
"confidentiality": {
"dataLeaked": [
"ACCESS_TOKEN"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"DATABASE_ALTERED"
]
},
"label": "CRITICAL",
"title": "text",
"unknowns": [
"text"
]
},
"investigationConfidence": "HIGH",
"investigationId": "text",
"investigationUnknowns": [
"text"
],
"lastTriagedAt": "2026-01-01T00:00:00.000Z",
"memoriesGenerated": [
"text"
],
"memoriesUsed": [
"text"
],
"parentTriageId": "text",
"pentest": {
"attemptedCVEs": [
"text"
],
"confidence": 1,
"cost": 1,
"duration": 1,
"exploitedCVE": "text",
"logs": [
{
"logs": [],
"summary": "text"
}
],
"outcome": "CANNOT_DETERMINE",
"report": "text",
"reproductionScript": "text",
"testedEndpoints": [
{
"method": "text",
"path": "text"
}
]
},
"priority": "FALSE_POSITIVE",
"references": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"retriageComparison": {
"narrative": "text",
"newInformation": {
"cloudContextUpdated": true,
"memoryChanges": [
{
"description": "text",
"kind": "ADDED"
}
],
"pentestResultAdded": true,
"userComments": [
{
"commentId": "text",
"influence": "changed_verdict",
"keyClaim": "text"
}
]
},
"qualityAssessment": {
"remainingUncertainties": [
"text"
],
"sufficientEvidence": true
},
"verdictChanges": [
{
"current": "text",
"field": "text",
"previous": "text",
"reason": "text"
}
]
},
"retriageMetadata": {
"memoryChanges": [
{
"memoryChangeType": "MEMORY_ADDED",
"memoryId": "text"
}
],
"triggeredAt": "2026-01-01T00:00:00.000Z"
},
"retriageStatus": "NOT_RETRIAGED",
"severity": {
"confidence": "HIGH",
"label": "CRITICAL",
"score": 1,
"unknowns": [
"text"
]
},
"stopReason": "cost_cap",
"thoughts": "text",
"title": "text",
"version": 1
},
"updatedAt": "2026-01-01T00:00:00.000Z",
"userRole": "text",
"userRoleDescription": "text"
}
],
"hypotheses": [
{
"falseReason": "text",
"findingId": "text",
"hypothesis": "text",
"isInsecure": true,
"logs": []
}
]
},
"disprovenCandidates": [
{
"id": "text",
"outcome": "text",
"reason": "text",
"source": "text",
"title": "text"
}
],
"executiveSummary": {
"executiveSummaryFirstParagraph": "text",
"executiveSummaryRest": "text",
"topRecommendations": [
"text"
],
"topRisks": [
"text"
]
},
"exploitAnalysisResult": {
"sourceFindingIds": [
"text"
],
"sourceFindings": [
{
"allowlistType": "AI",
"allowlistedReason": "text",
"api": {
"errorDescription": "text",
"errorType": "text",
"findingScope": "endpoint",
"httpVersion": "text",
"method": "text",
"path": "text",
"previousResponse": "text",
"queryParameters": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"requestBody": "text",
"requestHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"responseBody": "text",
"responseHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"severity": "CRITICAL",
"solution": "text",
"uri": "text",
"vulnerableParameterName": "text",
"vulnerableParameterValue": "text",
"zapAlertRef": "text",
"zapPluginId": "text"
},
"authMatrix": {
"hypothesis": "text",
"user": {
"roleDescription": "text",
"roleName": "text",
"userName": "text"
}
},
"autoFixCurrentActivity": "text",
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"concurrencyLimit": 1,
"createdAt": "2026-01-01T00:00:00.000Z",
"cwe": 1,
"endpoint": {
"method": "text",
"path": "text"
},
"host": "text",
"id": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixable": true,
"isAutoFixableAgentVerdict": true,
"isFalsePositive": true,
"isFixed": true,
"isLatest": true,
"priorityLabel": "URGENT",
"priorityScore": 1,
"pullRequestsAutofix": [
{
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "Nullify"
},
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"repository": "text",
"repositoryFullName": "text",
"repositoryId": "text",
"repositoryName": "text",
"repositoryPath": "text",
"scanInfo": {
"appId": "text",
"scanId": "text",
"scanType": "API",
"targetUrl": "text"
},
"source": "AIPenTester",
"summary": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "Nullify"
},
"title": "text",
"triage": {
"budgetExhausted": true,
"campaignMetadata": {
"id": "text",
"name": "text"
},
"cloudContext": {
"confidence": 1,
"mode": "MODEA",
"repos": [
"text"
],
"thoughts": "text"
},
"complianceImpact": {
"citations": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"confidence": "HIGH",
"frameworks": [
{
"clause": "text",
"framework": "CCPA",
"obligation": "text"
}
],
"rationale": "text"
},
"customerQuestions": {
"customMessage": "text",
"generatedMemoryIds": [
"text"
],
"id": "text",
"questions": [
{
"answer": null,
"answerMemoryId": "text",
"answeredAt": "2026-01-01T00:00:00.000Z",
"customMessage": "text",
"findingIds": [
"text"
],
"id": "text",
"options": [
{
"id": "text",
"label": "text",
"value": "text"
}
],
"questionText": "text",
"questionType": "FREE_TEXT",
"relatedMemoryIds": [
"text"
],
"scope": "CLOUD",
"scopeResourceId": "text",
"unknownIds": [
"text"
]
}
]
},
"description": "text",
"descriptionSummary": "text",
"devDescription": "text",
"devTitle": "text",
"evidence": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitHypothesis": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitability": {
"attackComplexity": {
"description": "text",
"exploitChainRequired": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"payloadDifficulty": {
"description": "text",
"label": "EASY"
}
},
"attackRequirements": {
"description": "text",
"environmentState": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"mitm": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"raceCondition": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"timeWindow": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"title": "text"
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVectors": [
{
"description": "text",
"otherVector": "text",
"vector": "ADJACENT_ARP_SPOOFING"
}
]
},
"confidence": "HIGH",
"description": "text",
"label": "LIKELY",
"privilegesRequired": {
"description": "text",
"label": "HIGH",
"title": "text",
"types": [
"PRIVILEGED_USER"
]
},
"title": "text",
"unknowns": [
"text"
],
"userInteraction": {
"description": "text",
"label": "ACTIVE",
"otherTypes": [
"text"
],
"title": "text",
"types": [
"BROWSING"
]
}
},
"failedTriage": true,
"fixEffort": {
"confidence": "HIGH",
"description": "text",
"label": "EASY",
"title": "text",
"unknowns": [
"text"
]
},
"id": "text",
"impact": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"COMPLETE_SERVICE_OUTAGE"
]
},
"businessCriticality": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"confidence": "HIGH",
"confidentiality": {
"dataLeaked": [
"ACCESS_TOKEN"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"DATABASE_ALTERED"
]
},
"label": "CRITICAL",
"title": "text",
"unknowns": [
"text"
]
},
"investigationConfidence": "HIGH",
"investigationId": "text",
"investigationUnknowns": [
"text"
],
"lastTriagedAt": "2026-01-01T00:00:00.000Z",
"memoriesGenerated": [
"text"
],
"memoriesUsed": [
"text"
],
"parentTriageId": "text",
"pentest": {
"attemptedCVEs": [
"text"
],
"confidence": 1,
"cost": 1,
"duration": 1,
"exploitedCVE": "text",
"logs": [
{
"logs": [],
"summary": "text"
}
],
"outcome": "CANNOT_DETERMINE",
"report": "text",
"reproductionScript": "text",
"testedEndpoints": [
{
"method": "text",
"path": "text"
}
]
},
"priority": "FALSE_POSITIVE",
"references": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"retriageComparison": {
"narrative": "text",
"newInformation": {
"cloudContextUpdated": true,
"memoryChanges": [
{
"description": "text",
"kind": "ADDED"
}
],
"pentestResultAdded": true,
"userComments": [
{
"commentId": "text",
"influence": "changed_verdict",
"keyClaim": "text"
}
]
},
"qualityAssessment": {
"remainingUncertainties": [
"text"
],
"sufficientEvidence": true
},
"verdictChanges": [
{
"current": "text",
"field": "text",
"previous": "text",
"reason": "text"
}
]
},
"retriageMetadata": {
"memoryChanges": [
{
"memoryChangeType": "MEMORY_ADDED",
"memoryId": "text"
}
],
"triggeredAt": "2026-01-01T00:00:00.000Z"
},
"retriageStatus": "NOT_RETRIAGED",
"severity": {
"confidence": "HIGH",
"label": "CRITICAL",
"score": 1,
"unknowns": [
"text"
]
},
"stopReason": "cost_cap",
"thoughts": "text",
"title": "text",
"version": 1
},
"updatedAt": "2026-01-01T00:00:00.000Z",
"userRole": "text",
"userRoleDescription": "text"
}
],
"updatedCodeFindings": [
{
"aiGenerated": true,
"branch": "text",
"campaignIds": [
"text"
],
"category": "text",
"commitHash": "text",
"commitSha": "text",
"cwe": 1,
"endLine": 1,
"entrypoint": "text",
"falsePositiveReason": "text",
"filePath": "text",
"hasCachedFix": true,
"id": "text",
"isAutoFixable": true,
"isCloudTriaged": true,
"isFalsePositive": true,
"isResolved": true,
"language": "Apex",
"message": "text",
"priority": {
"description": "text",
"exploitability": {
"attackComplexity": {
"description": "text",
"label": "HIGH",
"privilegesRequired": {
"description": "text",
"label": "AUTHENTICATED"
}
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVector": [
"LOCAL_COMMAND_LINE_ARGUMENT"
]
},
"description": "text",
"evidence": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"label": "LIKELY"
},
"fixEffort": {
"description": "text",
"label": "EASY"
},
"label": "FALSE_POSITIVE",
"score": 1,
"severity": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH"
},
"businessCriticality": {
"description": "text",
"label": "HIGH"
},
"confidentiality": {
"dataLeaked": [
"ADDRESS"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"type": [
"BEHAVIOUR_MANIPULATED"
]
},
"label": "CRITICAL"
}
},
"repository": "text",
"repositoryId": "text",
"ruleConfidence": 1,
"ruleConfidenceLabel": "text",
"ruleId": "text",
"ruleImpact": 1,
"ruleImpactLabel": "text",
"ruleLikelihood": 1,
"ruleLikelihoodLabel": "text",
"ruleSeverity": 1,
"ruleSeverityLabel": "text",
"severity": "text",
"startLine": 1,
"title": "text",
"triage": {
"budgetExhausted": true,
"campaignMetadata": {
"id": "text",
"name": "text"
},
"cloudContext": {
"confidence": 1,
"mode": "MODEA",
"repos": [
"text"
],
"thoughts": "text"
},
"complianceImpact": {
"citations": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"confidence": "HIGH",
"frameworks": [
{
"clause": "text",
"framework": "CCPA",
"obligation": "text"
}
],
"rationale": "text"
},
"customerQuestions": {
"customMessage": "text",
"generatedMemoryIds": [
"text"
],
"id": "text",
"questions": [
{
"answer": null,
"answerMemoryId": "text",
"answeredAt": "2026-01-01T00:00:00.000Z",
"customMessage": "text",
"findingIds": [
"text"
],
"id": "text",
"options": [
{
"id": "text",
"label": "text",
"value": "text"
}
],
"questionText": "text",
"questionType": "FREE_TEXT",
"relatedMemoryIds": [
"text"
],
"scope": "CLOUD",
"scopeResourceId": "text",
"unknownIds": [
"text"
]
}
]
},
"description": "text",
"descriptionSummary": "text",
"devDescription": "text",
"devTitle": "text",
"evidence": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitHypothesis": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitability": {
"attackComplexity": {
"description": "text",
"exploitChainRequired": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"payloadDifficulty": {
"description": "text",
"label": "EASY"
}
},
"attackRequirements": {
"description": "text",
"environmentState": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"mitm": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"raceCondition": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"timeWindow": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"title": "text"
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVectors": [
{
"description": "text",
"otherVector": "text",
"vector": "ADJACENT_ARP_SPOOFING"
}
]
},
"confidence": "HIGH",
"description": "text",
"label": "LIKELY",
"privilegesRequired": {
"description": "text",
"label": "HIGH",
"title": "text",
"types": [
"PRIVILEGED_USER"
]
},
"title": "text",
"unknowns": [
"text"
],
"userInteraction": {
"description": "text",
"label": "ACTIVE",
"otherTypes": [
"text"
],
"title": "text",
"types": [
"BROWSING"
]
}
},
"failedTriage": true,
"fixEffort": {
"confidence": "HIGH",
"description": "text",
"label": "EASY",
"title": "text",
"unknowns": [
"text"
]
},
"id": "text",
"impact": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"COMPLETE_SERVICE_OUTAGE"
]
},
"businessCriticality": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"confidence": "HIGH",
"confidentiality": {
"dataLeaked": [
"ACCESS_TOKEN"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"DATABASE_ALTERED"
]
},
"label": "CRITICAL",
"title": "text",
"unknowns": [
"text"
]
},
"investigationConfidence": "HIGH",
"investigationId": "text",
"investigationUnknowns": [
"text"
],
"lastTriagedAt": "2026-01-01T00:00:00.000Z",
"memoriesGenerated": [
"text"
],
"memoriesUsed": [
"text"
],
"parentTriageId": "text",
"pentest": {
"attemptedCVEs": [
"text"
],
"confidence": 1,
"cost": 1,
"duration": 1,
"exploitedCVE": "text",
"logs": [
{
"logs": [],
"summary": "text"
}
],
"outcome": "CANNOT_DETERMINE",
"report": "text",
"reproductionScript": "text",
"testedEndpoints": [
{
"method": "text",
"path": "text"
}
]
},
"priority": "FALSE_POSITIVE",
"references": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"retriageComparison": {
"narrative": "text",
"newInformation": {
"cloudContextUpdated": true,
"memoryChanges": [
{
"description": "text",
"kind": "ADDED"
}
],
"pentestResultAdded": true,
"userComments": [
{
"commentId": "text",
"influence": "changed_verdict",
"keyClaim": "text"
}
]
},
"qualityAssessment": {
"remainingUncertainties": [
"text"
],
"sufficientEvidence": true
},
"verdictChanges": [
{
"current": "text",
"field": "text",
"previous": "text",
"reason": "text"
}
]
},
"retriageMetadata": {
"memoryChanges": [
{
"memoryChangeType": "MEMORY_ADDED",
"memoryId": "text"
}
],
"triggeredAt": "2026-01-01T00:00:00.000Z"
},
"retriageStatus": "NOT_RETRIAGED",
"severity": {
"confidence": "HIGH",
"label": "CRITICAL",
"score": 1,
"unknowns": [
"text"
]
},
"stopReason": "cost_cap",
"thoughts": "text",
"title": "text",
"version": 1
}
}
],
"updatedDependencyFindings": [
{
"campaignIds": [
"text"
],
"commitSha": "text",
"dossier": {
"cves": [
{
"has_fix": true,
"id": "text",
"severity": "text"
}
],
"deptree": {
"depth": 1,
"direct": true,
"scope": "DEV"
},
"emitted_at": "2026-01-01T00:00:00.000Z",
"input_hash": "text",
"package": "text",
"package_group_id": "text",
"path": {
"category": "GENERATED",
"confidence": "AMBIGUOUS",
"reason": "text"
},
"reachability": {
"called": true,
"confidence": "AMBIGUOUS",
"method": "COMBINED"
},
"scanner_version": "text",
"v": 1,
"version": "text"
},
"falsePositiveReason": "text",
"filePath": "text",
"hasCachedFix": true,
"hasReachableCVEs": true,
"id": "text",
"isAutoFixable": true,
"isCloudTriaged": true,
"isDirect": true,
"isFalsePositive": true,
"isResolved": true,
"isStaticReachabilitySupported": true,
"line": 1,
"package": "text",
"packageFilePath": "text",
"perVersionCVEStatus": {
"ANY_ADDITIONAL_PROPERTY": {
"ANY_ADDITIONAL_PROPERTY": {
"fixedVersion": "text",
"introduced": "text",
"vulnerable": true
}
}
},
"repository": "text",
"repositoryId": "text",
"resolvedWithoutLockfile": true,
"triage": {
"budgetExhausted": true,
"campaignMetadata": {
"id": "text",
"name": "text"
},
"cloudContext": {
"confidence": 1,
"mode": "MODEA",
"repos": [
"text"
],
"thoughts": "text"
},
"complianceImpact": {
"citations": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"confidence": "HIGH",
"frameworks": [
{
"clause": "text",
"framework": "CCPA",
"obligation": "text"
}
],
"rationale": "text"
},
"customerQuestions": {
"customMessage": "text",
"generatedMemoryIds": [
"text"
],
"id": "text",
"questions": [
{
"answer": null,
"answerMemoryId": "text",
"answeredAt": "2026-01-01T00:00:00.000Z",
"customMessage": "text",
"findingIds": [
"text"
],
"id": "text",
"options": [
{
"id": "text",
"label": "text",
"value": "text"
}
],
"questionText": "text",
"questionType": "FREE_TEXT",
"relatedMemoryIds": [
"text"
],
"scope": "CLOUD",
"scopeResourceId": "text",
"unknownIds": [
"text"
]
}
]
},
"description": "text",
"descriptionSummary": "text",
"devDescription": "text",
"devTitle": "text",
"evidence": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitHypothesis": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitability": {
"attackComplexity": {
"description": "text",
"exploitChainRequired": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"payloadDifficulty": {
"description": "text",
"label": "EASY"
}
},
"attackRequirements": {
"description": "text",
"environmentState": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"mitm": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"raceCondition": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"timeWindow": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"title": "text"
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVectors": [
{
"description": "text",
"otherVector": "text",
"vector": "ADJACENT_ARP_SPOOFING"
}
]
},
"confidence": "HIGH",
"description": "text",
"label": "LIKELY",
"privilegesRequired": {
"description": "text",
"label": "HIGH",
"title": "text",
"types": [
"PRIVILEGED_USER"
]
},
"title": "text",
"unknowns": [
"text"
],
"userInteraction": {
"description": "text",
"label": "ACTIVE",
"otherTypes": [
"text"
],
"title": "text",
"types": [
"BROWSING"
]
}
},
"failedTriage": true,
"fixEffort": {
"confidence": "HIGH",
"description": "text",
"label": "EASY",
"title": "text",
"unknowns": [
"text"
]
},
"id": "text",
"impact": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"COMPLETE_SERVICE_OUTAGE"
]
},
"businessCriticality": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"confidence": "HIGH",
"confidentiality": {
"dataLeaked": [
"ACCESS_TOKEN"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"DATABASE_ALTERED"
]
},
"label": "CRITICAL",
"title": "text",
"unknowns": [
"text"
]
},
"investigationConfidence": "HIGH",
"investigationId": "text",
"investigationUnknowns": [
"text"
],
"lastTriagedAt": "2026-01-01T00:00:00.000Z",
"memoriesGenerated": [
"text"
],
"memoriesUsed": [
"text"
],
"parentTriageId": "text",
"pentest": {
"attemptedCVEs": [
"text"
],
"confidence": 1,
"cost": 1,
"duration": 1,
"exploitedCVE": "text",
"logs": [
{
"logs": [],
"summary": "text"
}
],
"outcome": "CANNOT_DETERMINE",
"report": "text",
"reproductionScript": "text",
"testedEndpoints": [
{
"method": "text",
"path": "text"
}
]
},
"priority": "FALSE_POSITIVE",
"references": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"retriageComparison": {
"narrative": "text",
"newInformation": {
"cloudContextUpdated": true,
"memoryChanges": [
{
"description": "text",
"kind": "ADDED"
}
],
"pentestResultAdded": true,
"userComments": [
{
"commentId": "text",
"influence": "changed_verdict",
"keyClaim": "text"
}
]
},
"qualityAssessment": {
"remainingUncertainties": [
"text"
],
"sufficientEvidence": true
},
"verdictChanges": [
{
"current": "text",
"field": "text",
"previous": "text",
"reason": "text"
}
]
},
"retriageMetadata": {
"memoryChanges": [
{
"memoryChangeType": "MEMORY_ADDED",
"memoryId": "text"
}
],
"triggeredAt": "2026-01-01T00:00:00.000Z"
},
"retriageStatus": "NOT_RETRIAGED",
"severity": {
"confidence": "HIGH",
"label": "CRITICAL",
"score": 1,
"unknowns": [
"text"
]
},
"stopReason": "cost_cap",
"thoughts": "text",
"title": "text",
"version": 1
},
"version": "text",
"versions": [
"text"
],
"vulnerabilities": [
{
"cves": [
{
"cisaKev": true,
"cvss": 1,
"epss": 1,
"epssPercentile": 1,
"exploitability": "text",
"exploitabilityScore": 1,
"id": "text",
"impactScore": 1,
"osvReachability": {
"called": true
},
"priority": "text",
"reachabilityConfidence": "text",
"reachabilityEvidence": "text",
"reachabilityMethod": "text",
"reachable": true,
"severity": "text",
"vectorString": "text",
"version": "text"
}
],
"details": "text",
"fixed": "text",
"hasFix": true,
"id": "text",
"introduced": "text",
"severity": "text",
"title": "text",
"version": "text"
}
]
}
]
},
"findingScanCoverage": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"findingsSummary": [
{
"affectedAsset": "text",
"id": "text",
"owner": "text",
"reference": "text",
"severity": "CRITICAL",
"source": "text",
"title": "text"
}
],
"limitations": "text",
"metadata": {
"description": "text"
},
"methodology": {
"authMatrixStage": {
"approach": "text",
"description": "text",
"hypothesesGenerated": 1
},
"exploitAnalysisStage": {
"approach": "text",
"description": "text",
"findingsAnalyzed": 1
},
"toolsStage": {
"coverage": "text",
"description": "text",
"toolsUsed": [
"text"
]
}
},
"metrics": {
"endpointMetrics": {
"degraded": 1,
"failed": 1,
"fuzzed": 1,
"indeterminate": 1,
"tested": 1,
"total": 1,
"unresolved": 1,
"vulnerable": 1
},
"findingMetrics": {
"carriedForward": 1,
"fixed": 1,
"new": 1,
"reconciled": true,
"total": 1,
"unfixed": 1,
"validatedExternal": 1
},
"numUsers": 1,
"requestMetrics": {
"error": 1,
"fail": {
"ANY_ADDITIONAL_PROPERTY": 1
},
"success": 1,
"timeout": 1,
"total": 1
},
"usageMetrics": {
"cacheHitCost": 1,
"cacheWriteCost": 1,
"inputCost": 1,
"inputTokenCount": 1,
"outputCost": 1,
"outputTokenCount": 1,
"totalCost": 1
}
},
"networkTransactionsSummary": {
"logFileReferences": [
"text"
],
"totalRequests": 1
},
"pentestToolsResult": {
"findings": [
{
"allowlistType": "AI",
"allowlistedReason": "text",
"api": {
"errorDescription": "text",
"errorType": "text",
"findingScope": "endpoint",
"httpVersion": "text",
"method": "text",
"path": "text",
"previousResponse": "text",
"queryParameters": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"requestBody": "text",
"requestHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"responseBody": "text",
"responseHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"severity": "CRITICAL",
"solution": "text",
"uri": "text",
"vulnerableParameterName": "text",
"vulnerableParameterValue": "text",
"zapAlertRef": "text",
"zapPluginId": "text"
},
"authMatrix": {
"hypothesis": "text",
"user": {
"roleDescription": "text",
"roleName": "text",
"userName": "text"
}
},
"autoFixCurrentActivity": "text",
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"concurrencyLimit": 1,
"createdAt": "2026-01-01T00:00:00.000Z",
"cwe": 1,
"endpoint": {
"method": "text",
"path": "text"
},
"host": "text",
"id": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixable": true,
"isAutoFixableAgentVerdict": true,
"isFalsePositive": true,
"isFixed": true,
"isLatest": true,
"priorityLabel": "URGENT",
"priorityScore": 1,
"pullRequestsAutofix": [
{
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "Nullify"
},
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"repository": "text",
"repositoryFullName": "text",
"repositoryId": "text",
"repositoryName": "text",
"repositoryPath": "text",
"scanInfo": {
"appId": "text",
"scanId": "text",
"scanType": "API",
"targetUrl": "text"
},
"source": "AIPenTester",
"summary": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "Nullify"
},
"title": "text",
"triage": {
"budgetExhausted": true,
"campaignMetadata": {
"id": "text",
"name": "text"
},
"cloudContext": {
"confidence": 1,
"mode": "MODEA",
"repos": [
"text"
],
"thoughts": "text"
},
"complianceImpact": {
"citations": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"confidence": "HIGH",
"frameworks": [
{
"clause": "text",
"framework": "CCPA",
"obligation": "text"
}
],
"rationale": "text"
},
"customerQuestions": {
"customMessage": "text",
"generatedMemoryIds": [
"text"
],
"id": "text",
"questions": [
{
"answer": null,
"answerMemoryId": "text",
"answeredAt": "2026-01-01T00:00:00.000Z",
"customMessage": "text",
"findingIds": [
"text"
],
"id": "text",
"options": [
{
"id": "text",
"label": "text",
"value": "text"
}
],
"questionText": "text",
"questionType": "FREE_TEXT",
"relatedMemoryIds": [
"text"
],
"scope": "CLOUD",
"scopeResourceId": "text",
"unknownIds": [
"text"
]
}
]
},
"description": "text",
"descriptionSummary": "text",
"devDescription": "text",
"devTitle": "text",
"evidence": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitHypothesis": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitability": {
"attackComplexity": {
"description": "text",
"exploitChainRequired": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"payloadDifficulty": {
"description": "text",
"label": "EASY"
}
},
"attackRequirements": {
"description": "text",
"environmentState": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"mitm": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"raceCondition": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"timeWindow": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"title": "text"
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVectors": [
{
"description": "text",
"otherVector": "text",
"vector": "ADJACENT_ARP_SPOOFING"
}
]
},
"confidence": "HIGH",
"description": "text",
"label": "LIKELY",
"privilegesRequired": {
"description": "text",
"label": "HIGH",
"title": "text",
"types": [
"PRIVILEGED_USER"
]
},
"title": "text",
"unknowns": [
"text"
],
"userInteraction": {
"description": "text",
"label": "ACTIVE",
"otherTypes": [
"text"
],
"title": "text",
"types": [
"BROWSING"
]
}
},
"failedTriage": true,
"fixEffort": {
"confidence": "HIGH",
"description": "text",
"label": "EASY",
"title": "text",
"unknowns": [
"text"
]
},
"id": "text",
"impact": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"COMPLETE_SERVICE_OUTAGE"
]
},
"businessCriticality": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"confidence": "HIGH",
"confidentiality": {
"dataLeaked": [
"ACCESS_TOKEN"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"DATABASE_ALTERED"
]
},
"label": "CRITICAL",
"title": "text",
"unknowns": [
"text"
]
},
"investigationConfidence": "HIGH",
"investigationId": "text",
"investigationUnknowns": [
"text"
],
"lastTriagedAt": "2026-01-01T00:00:00.000Z",
"memoriesGenerated": [
"text"
],
"memoriesUsed": [
"text"
],
"parentTriageId": "text",
"pentest": {
"attemptedCVEs": [
"text"
],
"confidence": 1,
"cost": 1,
"duration": 1,
"exploitedCVE": "text",
"logs": [
{
"logs": [],
"summary": "text"
}
],
"outcome": "CANNOT_DETERMINE",
"report": "text",
"reproductionScript": "text",
"testedEndpoints": [
{
"method": "text",
"path": "text"
}
]
},
"priority": "FALSE_POSITIVE",
"references": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"retriageComparison": {
"narrative": "text",
"newInformation": {
"cloudContextUpdated": true,
"memoryChanges": [
{
"description": "text",
"kind": "ADDED"
}
],
"pentestResultAdded": true,
"userComments": [
{
"commentId": "text",
"influence": "changed_verdict",
"keyClaim": "text"
}
]
},
"qualityAssessment": {
"remainingUncertainties": [
"text"
],
"sufficientEvidence": true
},
"verdictChanges": [
{
"current": "text",
"field": "text",
"previous": "text",
"reason": "text"
}
]
},
"retriageMetadata": {
"memoryChanges": [
{
"memoryChangeType": "MEMORY_ADDED",
"memoryId": "text"
}
],
"triggeredAt": "2026-01-01T00:00:00.000Z"
},
"retriageStatus": "NOT_RETRIAGED",
"severity": {
"confidence": "HIGH",
"label": "CRITICAL",
"score": 1,
"unknowns": [
"text"
]
},
"stopReason": "cost_cap",
"thoughts": "text",
"title": "text",
"version": 1
},
"updatedAt": "2026-01-01T00:00:00.000Z",
"userRole": "text",
"userRoleDescription": "text"
}
],
"producersRan": [
"AIPenTester"
],
"scanComplete": true,
"scanDegraded": true
},
"producersRan": [
"AIPenTester"
],
"reportMetadata": {
"authors": [
{
"email": "text",
"name": "text",
"role": "text"
}
],
"classification": "text",
"client": "text",
"reportVersion": "text",
"title": "text"
},
"retestPolicy": "text",
"scanId": "text",
"scope": {
"targetDescription": "text",
"targetUrl": "text",
"users": [
{
"name": "text",
"roleDescription": "text"
}
]
}
},
"version": "text"
}Get a Finding
Get all the details of a pentest finding
Path parameters
findingIdstringRequired
Query parameters
azureOrganizationIdstringOptional
The Azure organization ID
bitbucketWorkspaceIdstringOptional
The Bitbucket workspace ID
githubOwnerIdinteger · int64Optional
The Github owner ID
gitlabGroupIdinteger · int64Optional
The GitLab group ID
installationIdstringOptional
The Nullify installation ID
azureRepositoryIdstring[]Optional
Filter by Azure repository IDs
githubRepositoryIdinteger · int64[]Optional
Filter by GitHub repository IDs
githubTeamIdinteger · int64Optional
Filter by GitHub team ID
bitbucketRepositoryIdstring[]Optional
Filter by Bitbucket repository IDs
Responses
200
OK
application/json
versionstringOptional
400
Bad Request
application/json
403
Forbidden
application/json
404
Not Found
application/json
500
Internal Server Error
application/json
get/dast/pentest/findings/{findingId}
GET /dast/pentest/findings/{findingId} HTTP/1.1
Host: api.<TENANT>.nullify.ai
Accept: */*
{
"finding": {
"allowlistType": "AI",
"allowlistedReason": "text",
"api": {
"errorDescription": "text",
"errorType": "text",
"findingScope": "endpoint",
"httpVersion": "text",
"method": "text",
"path": "text",
"previousResponse": "text",
"queryParameters": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"requestBody": "text",
"requestHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"responseBody": "text",
"responseHeader": {
"ANY_ADDITIONAL_PROPERTY": "text"
},
"severity": "CRITICAL",
"solution": "text",
"uri": "text",
"vulnerableParameterName": "text",
"vulnerableParameterValue": "text",
"zapAlertRef": "text",
"zapPluginId": "text"
},
"authMatrix": {
"hypothesis": "text",
"user": {
"roleDescription": "text",
"roleName": "text",
"userName": "text"
}
},
"autoFixCurrentActivity": "text",
"autoFixEndTime": "2026-01-01T00:00:00.000Z",
"autoFixStartTime": "2026-01-01T00:00:00.000Z",
"autoFixState": "none",
"autofixVerdictAt": "2026-01-01T00:00:00.000Z",
"autofixVerdictExplanation": "text",
"autofixVerdictReason": "AGENT_ERROR",
"budgetExhausted": true,
"budgetLimit": 1,
"budgetUsed": 1,
"concurrencyLimit": 1,
"createdAt": "2026-01-01T00:00:00.000Z",
"cwe": 1,
"endpoint": {
"method": "text",
"path": "text"
},
"host": "text",
"id": "text",
"isAllowlisted": true,
"isArchived": true,
"isAutoFixable": true,
"isAutoFixableAgentVerdict": true,
"isFalsePositive": true,
"isFixed": true,
"isLatest": true,
"priorityLabel": "URGENT",
"priorityScore": 1,
"pullRequestsAutofix": [
{
"createdAt": "2026-01-01T00:00:00.000Z",
"explanation": "text",
"firstReviewedAt": "2026-01-01T00:00:00.000Z",
"hasCustomerCommit": true,
"hasCustomerFeedback": true,
"id": 1,
"lastReviewedAt": "2026-01-01T00:00:00.000Z",
"link": "text",
"mergedAt": "2026-01-01T00:00:00.000Z",
"pullRequestProvider": {
"azure": {
"pullRequestId": 1
},
"bitbucket": {
"pullRequestId": 1
},
"github": {
"pullRequestNodeId": "text",
"pullRequestNumber": 1
},
"gitlab": {
"mergeRequestNumber": 1
},
"id": "Nullify"
},
"status": "open",
"title": "text",
"updatedAt": "2026-01-01T00:00:00.000Z"
}
],
"repository": "text",
"repositoryFullName": "text",
"repositoryId": "text",
"repositoryName": "text",
"repositoryPath": "text",
"scanInfo": {
"appId": "text",
"scanId": "text",
"scanType": "API",
"targetUrl": "text"
},
"source": "AIPenTester",
"summary": "text",
"ticket": {
"asana": {
"projectGid": "text",
"taskGid": "text",
"url": "text"
},
"azure": {
"url": "text",
"workItemId": 1
},
"github": {
"issueId": 1,
"nodeId": "text",
"number": 1,
"repositoryName": "text",
"url": "text"
},
"gitlab": {},
"jira": {
"issueId": "text",
"issueKey": "text",
"url": "text"
},
"linear": {
"issueId": "text",
"teamId": "text",
"url": "text"
},
"providerId": "Nullify"
},
"title": "text",
"triage": {
"budgetExhausted": true,
"campaignMetadata": {
"id": "text",
"name": "text"
},
"cloudContext": {
"confidence": 1,
"mode": "MODEA",
"repos": [
"text"
],
"thoughts": "text"
},
"complianceImpact": {
"citations": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"confidence": "HIGH",
"frameworks": [
{
"clause": "text",
"framework": "CCPA",
"obligation": "text"
}
],
"rationale": "text"
},
"customerQuestions": {
"customMessage": "text",
"generatedMemoryIds": [
"text"
],
"id": "text",
"questions": [
{
"answer": null,
"answerMemoryId": "text",
"answeredAt": "2026-01-01T00:00:00.000Z",
"customMessage": "text",
"findingIds": [
"text"
],
"id": "text",
"options": [
{
"id": "text",
"label": "text",
"value": "text"
}
],
"questionText": "text",
"questionType": "FREE_TEXT",
"relatedMemoryIds": [
"text"
],
"scope": "CLOUD",
"scopeResourceId": "text",
"unknownIds": [
"text"
]
}
]
},
"description": "text",
"descriptionSummary": "text",
"devDescription": "text",
"devTitle": "text",
"evidence": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitHypothesis": {
"edges": [
{
"explanation": "text",
"sourceId": "text",
"targetId": "text",
"type": "ABOUT"
}
],
"nodes": []
},
"exploitability": {
"attackComplexity": {
"description": "text",
"exploitChainRequired": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"payloadDifficulty": {
"description": "text",
"label": "EASY"
}
},
"attackRequirements": {
"description": "text",
"environmentState": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"label": "HIGH",
"mitm": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"raceCondition": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"timeWindow": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"title": "text"
},
"attackVector": {
"description": "text",
"label": "ADJACENT",
"subVectors": [
{
"description": "text",
"otherVector": "text",
"vector": "ADJACENT_ARP_SPOOFING"
}
]
},
"confidence": "HIGH",
"description": "text",
"label": "LIKELY",
"privilegesRequired": {
"description": "text",
"label": "HIGH",
"title": "text",
"types": [
"PRIVILEGED_USER"
]
},
"title": "text",
"unknowns": [
"text"
],
"userInteraction": {
"description": "text",
"label": "ACTIVE",
"otherTypes": [
"text"
],
"title": "text",
"types": [
"BROWSING"
]
}
},
"failedTriage": true,
"fixEffort": {
"confidence": "HIGH",
"description": "text",
"label": "EASY",
"title": "text",
"unknowns": [
"text"
]
},
"id": "text",
"impact": {
"availability": {
"cause": [
"BUFFER_OVERFLOW"
],
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"COMPLETE_SERVICE_OUTAGE"
]
},
"businessCriticality": {
"description": "text",
"label": "HIGH",
"title": "text"
},
"confidence": "HIGH",
"confidentiality": {
"dataLeaked": [
"ACCESS_TOKEN"
],
"label": "HIGH"
},
"description": "text",
"integrity": {
"description": "text",
"label": "HIGH",
"title": "text",
"type": [
"DATABASE_ALTERED"
]
},
"label": "CRITICAL",
"title": "text",
"unknowns": [
"text"
]
},
"investigationConfidence": "HIGH",
"investigationId": "text",
"investigationUnknowns": [
"text"
],
"lastTriagedAt": "2026-01-01T00:00:00.000Z",
"memoriesGenerated": [
"text"
],
"memoriesUsed": [
"text"
],
"parentTriageId": "text",
"pentest": {
"attemptedCVEs": [
"text"
],
"confidence": 1,
"cost": 1,
"duration": 1,
"exploitedCVE": "text",
"logs": [
{
"logs": [],
"summary": "text"
}
],
"outcome": "CANNOT_DETERMINE",
"report": "text",
"reproductionScript": "text",
"testedEndpoints": [
{
"method": "text",
"path": "text"
}
]
},
"priority": "FALSE_POSITIVE",
"references": [
{
"documentId": "text",
"fileName": "text",
"nodeId": "text",
"page": 1,
"quote": "text",
"score": 1,
"title": "text"
}
],
"retriageComparison": {
"narrative": "text",
"newInformation": {
"cloudContextUpdated": true,
"memoryChanges": [
{
"description": "text",
"kind": "ADDED"
}
],
"pentestResultAdded": true,
"userComments": [
{
"commentId": "text",
"influence": "changed_verdict",
"keyClaim": "text"
}
]
},
"qualityAssessment": {
"remainingUncertainties": [
"text"
],
"sufficientEvidence": true
},
"verdictChanges": [
{
"current": "text",
"field": "text",
"previous": "text",
"reason": "text"
}
]
},
"retriageMetadata": {
"memoryChanges": [
{
"memoryChangeType": "MEMORY_ADDED",
"memoryId": "text"
}
],
"triggeredAt": "2026-01-01T00:00:00.000Z"
},
"retriageStatus": "NOT_RETRIAGED",
"severity": {
"confidence": "HIGH",
"label": "CRITICAL",
"score": 1,
"unknowns": [
"text"
]
},
"stopReason": "cost_cap",
"thoughts": "text",
"title": "text",
"version": 1
},
"updatedAt": "2026-01-01T00:00:00.000Z",
"userRole": "text",
"userRoleDescription": "text"
},
"version": "text"
}Triage, Allowlist & Ticket a Finding
Individual pentest findings support the same triage, allowlisting, ticketing, and event history as the other detection APIs:
GET /dast/pentest/findings/{findingId}/triage— how Nullify triaged the finding.POST /dast/pentest/findings/{findingId}/allowlistandPOST /dast/pentest/findings/{findingId}/unallowlist— suppress or restore a finding (body:allowlistReason+allowlistType).POST /dast/pentest/findings/{findingId}/ticket— open a tracking ticket.GET /dast/pentest/findings/{findingId}/events— the finding's decision history.
Bug Hunt
A complementary, lighter-weight Bug Hunt workflow surfaces findings without a full pentest. SSR HTML apps and SPAs are evaluated by Bug Hunt (beta) rather than the standard pentest workflow.
GET /dast/bughunt/scansPOST /dast/bughunt/scans— intensity levels arelow,medium, orhighGET /dast/bughunt/findings
Last updated