curl --request POST \
--url https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve \
--header 'CORGEA-TOKEN: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"comment": "<string>"
}
'import requests
url = "https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve"
payload = { "comment": "<string>" }
headers = {
"CORGEA-TOKEN": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'CORGEA-TOKEN': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({comment: '<string>'})
};
fetch('https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'comment' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"CORGEA-TOKEN: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve"
payload := strings.NewReader("{\n \"comment\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("CORGEA-TOKEN", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve")
.header("CORGEA-TOKEN", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"comment\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["CORGEA-TOKEN"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"comment\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"status": "ok",
"approval": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "<string>",
"source": "<string>",
"target_status": "<string>",
"justification": "<string>",
"accepted_risk_expiry_date": "2023-11-07T05:31:56Z",
"rule": {},
"source_metadata": {},
"requires_approval": true,
"requested_by": 123,
"approved_by": 123,
"rejected_by": 123,
"created_at": "2023-11-07T05:31:56Z",
"reviewed_at": "2023-11-07T05:31:56Z",
"applied_at": "2023-11-07T05:31:56Z",
"counts": {
"matched": 123,
"unmatched": 123,
"ambiguous": 123,
"applied": 123,
"conflicts": 123
},
"decision_label": "<string>",
"requester": {
"id": 123,
"name": "<string>"
},
"review_comment": "<string>",
"finding_total": 123,
"finding_previews": [
{
"kind": "sast",
"id": "<string>",
"title": "<string>",
"severity": "<string>",
"location": "<string>"
}
],
"project_names": [
"<string>"
],
"skip_count": 123,
"closed_by_rescan": true,
"can_review": true,
"is_requester": true,
"suggestion": {},
"investigation": {}
}
}Approve a triage request
Everyone sees their own requests. Reviewers with the Can approve or reject triage requests permission (heeler.approve_triage_request) also see other requests, subject to access to every project when project access control applies. Requests outside this view return 404. The reviewer must differ from the requester and have the Can approve or reject triage requests permission, status-change permissions for every finding type, and access to every project in the request. An optional comment (up to 10,000 characters) is sent to the requester. Approval applies the decision even after intervening triage changes, skipping findings fixed or deleted since submission. On 409, fetch the request again before retrying.
curl --request POST \
--url https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve \
--header 'CORGEA-TOKEN: <api-key>' \
--header 'Content-Type: application/json' \
--data '
{
"comment": "<string>"
}
'import requests
url = "https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve"
payload = { "comment": "<string>" }
headers = {
"CORGEA-TOKEN": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'CORGEA-TOKEN': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({comment: '<string>'})
};
fetch('https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'comment' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"CORGEA-TOKEN: <api-key>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve"
payload := strings.NewReader("{\n \"comment\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("CORGEA-TOKEN", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve")
.header("CORGEA-TOKEN", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"comment\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://www.corgea.app/api/v1/triage/approvals/{action_id}/approve")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["CORGEA-TOKEN"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"comment\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"status": "ok",
"approval": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"status": "<string>",
"source": "<string>",
"target_status": "<string>",
"justification": "<string>",
"accepted_risk_expiry_date": "2023-11-07T05:31:56Z",
"rule": {},
"source_metadata": {},
"requires_approval": true,
"requested_by": 123,
"approved_by": 123,
"rejected_by": 123,
"created_at": "2023-11-07T05:31:56Z",
"reviewed_at": "2023-11-07T05:31:56Z",
"applied_at": "2023-11-07T05:31:56Z",
"counts": {
"matched": 123,
"unmatched": 123,
"ambiguous": 123,
"applied": 123,
"conflicts": 123
},
"decision_label": "<string>",
"requester": {
"id": 123,
"name": "<string>"
},
"review_comment": "<string>",
"finding_total": 123,
"finding_previews": [
{
"kind": "sast",
"id": "<string>",
"title": "<string>",
"severity": "<string>",
"location": "<string>"
}
],
"project_names": [
"<string>"
],
"skip_count": 123,
"closed_by_rescan": true,
"can_review": true,
"is_requester": true,
"suggestion": {},
"investigation": {}
}
}Authorizations
API key for authentication API tokens belonging to inactive users are rejected.
Path Parameters
Body
10000Was this page helpful?
