Triage en masse des problèmes

curl --request PATCH \
  --url https://www.corgea.app/api/v1/triage/findings \
  --header 'CORGEA-TOKEN: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "justification": "<string>",
  "rule": {
    "statuses": [],
    "company_wide": false,
    "project_ids": [
      123
    ],
    "team_ids": [
      123
    ],
    "finding_types": [
      "sast",
      "sca"
    ],
    "cwes": [
      "CWE-79"
    ],
    "cves": [
      "CVE-2026-1000"
    ],
    "path_patterns": [
      "tests/**"
    ],
    "severities": [],
    "match": "all"
  },
  "finding_ids": [
    "3c90c3cc-0d44-4b50-8888-8dd25736052a"
  ],
  "apply": true,
  "expiry_date": "2023-11-07T05:31:56Z"
}
'

import requests

url = "https://www.corgea.app/api/v1/triage/findings"

payload = {
    "justification": "<string>",
    "rule": {
        "statuses": [],
        "company_wide": False,
        "project_ids": [123],
        "team_ids": [123],
        "finding_types": ["sast", "sca"],
        "cwes": ["CWE-79"],
        "cves": ["CVE-2026-1000"],
        "path_patterns": ["tests/**"],
        "severities": [],
        "match": "all"
    },
    "finding_ids": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
    "apply": True,
    "expiry_date": "2023-11-07T05:31:56Z"
}
headers = {
    "CORGEA-TOKEN": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {'CORGEA-TOKEN': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    justification: '<string>',
    rule: {
      statuses: [],
      company_wide: false,
      project_ids: [123],
      team_ids: [123],
      finding_types: ['sast', 'sca'],
      cwes: ['CWE-79'],
      cves: ['CVE-2026-1000'],
      path_patterns: ['tests/**'],
      severities: [],
      match: 'all'
    },
    finding_ids: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
    apply: true,
    expiry_date: '2023-11-07T05:31:56Z'
  })
};

fetch('https://www.corgea.app/api/v1/triage/findings', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://www.corgea.app/api/v1/triage/findings",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'justification' => '<string>',
    'rule' => [
        'statuses' => [
                
        ],
        'company_wide' => false,
        'project_ids' => [
                123
        ],
        'team_ids' => [
                123
        ],
        'finding_types' => [
                'sast',
                'sca'
        ],
        'cwes' => [
                'CWE-79'
        ],
        'cves' => [
                'CVE-2026-1000'
        ],
        'path_patterns' => [
                'tests/**'
        ],
        'severities' => [
                
        ],
        'match' => 'all'
    ],
    'finding_ids' => [
        '3c90c3cc-0d44-4b50-8888-8dd25736052a'
    ],
    'apply' => true,
    'expiry_date' => '2023-11-07T05:31:56Z'
  ]),
  CURLOPT_HTTPHEADER => [
    "CORGEA-TOKEN: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://www.corgea.app/api/v1/triage/findings"

	payload := strings.NewReader("{\n  \"justification\": \"<string>\",\n  \"rule\": {\n    \"statuses\": [],\n    \"company_wide\": false,\n    \"project_ids\": [\n      123\n    ],\n    \"team_ids\": [\n      123\n    ],\n    \"finding_types\": [\n      \"sast\",\n      \"sca\"\n    ],\n    \"cwes\": [\n      \"CWE-79\"\n    ],\n    \"cves\": [\n      \"CVE-2026-1000\"\n    ],\n    \"path_patterns\": [\n      \"tests/**\"\n    ],\n    \"severities\": [],\n    \"match\": \"all\"\n  },\n  \"finding_ids\": [\n    \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n  ],\n  \"apply\": true,\n  \"expiry_date\": \"2023-11-07T05:31:56Z\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("CORGEA-TOKEN", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://www.corgea.app/api/v1/triage/findings")
  .header("CORGEA-TOKEN", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"justification\": \"<string>\",\n  \"rule\": {\n    \"statuses\": [],\n    \"company_wide\": false,\n    \"project_ids\": [\n      123\n    ],\n    \"team_ids\": [\n      123\n    ],\n    \"finding_types\": [\n      \"sast\",\n      \"sca\"\n    ],\n    \"cwes\": [\n      \"CWE-79\"\n    ],\n    \"cves\": [\n      \"CVE-2026-1000\"\n    ],\n    \"path_patterns\": [\n      \"tests/**\"\n    ],\n    \"severities\": [],\n    \"match\": \"all\"\n  },\n  \"finding_ids\": [\n    \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n  ],\n  \"apply\": true,\n  \"expiry_date\": \"2023-11-07T05:31:56Z\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://www.corgea.app/api/v1/triage/findings")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["CORGEA-TOKEN"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"justification\": \"<string>\",\n  \"rule\": {\n    \"statuses\": [],\n    \"company_wide\": false,\n    \"project_ids\": [\n      123\n    ],\n    \"team_ids\": [\n      123\n    ],\n    \"finding_types\": [\n      \"sast\",\n      \"sca\"\n    ],\n    \"cwes\": [\n      \"CWE-79\"\n    ],\n    \"cves\": [\n      \"CVE-2026-1000\"\n    ],\n    \"path_patterns\": [\n      \"tests/**\"\n    ],\n    \"severities\": [],\n    \"match\": \"all\"\n  },\n  \"finding_ids\": [\n    \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n  ],\n  \"apply\": true,\n  \"expiry_date\": \"2023-11-07T05:31:56Z\"\n}"

response = http.request(request)
puts response.read_body

{
  "status": "ok",
  "action": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "status": "preview",
    "source": "api",
    "target_status": "<string>",
    "justification": "<string>",
    "accepted_risk_expiry_date": "2023-11-07T05:31:56Z",
    "rule": {},
    "source_metadata": {},
    "requires_approval": true,
    "requested_by": 123,
    "approved_by": 123,
    "rejected_by": 123,
    "created_at": "2023-11-07T05:31:56Z",
    "reviewed_at": "2023-11-07T05:31:56Z",
    "applied_at": "2023-11-07T05:31:56Z",
    "counts": {
      "matched": 123,
      "unmatched": 123,
      "ambiguous": 123,
      "applied": 123,
      "conflicts": 123
    }
  },
  "unresolved_ids": [
    "<string>"
  ]
}

{
  "status": "ok",
  "action": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "status": "preview",
    "source": "api",
    "target_status": "<string>",
    "justification": "<string>",
    "accepted_risk_expiry_date": "2023-11-07T05:31:56Z",
    "rule": {},
    "source_metadata": {},
    "requires_approval": true,
    "requested_by": 123,
    "approved_by": 123,
    "rejected_by": 123,
    "created_at": "2023-11-07T05:31:56Z",
    "reviewed_at": "2023-11-07T05:31:56Z",
    "applied_at": "2023-11-07T05:31:56Z",
    "counts": {
      "matched": 123,
      "unmatched": 123,
      "ambiguous": 123,
      "applied": 123,
      "conflicts": 123
    }
  },
  "unresolved_ids": [
    "<string>"
  ]
}

Triage

Triage en masse des problèmes

Prévisualisez ou appliquez un changement de statut fondé sur une règle à 5 000 problèmes SAST ou SCA accessibles au maximum. Pour les demandes des utilisateurs qui ne sont pas administrateurs, les actions de faux positif et de risque accepté nécessitent une approbation lorsque le paramètre d’approbation correspondant de l’entreprise est activé ; les actions de risque accepté nécessitent également une approbation lorsqu’elles atteignent le seuil de nombre de problèmes ou de gravité de l’entreprise. Ces actions renvoient 202 avec le statut pending_approval et laissent les statuts des problèmes inchangés jusqu’à ce qu’un autre administrateur de l’entreprise les approuve. Les demandes des administrateurs de l’entreprise appliquent immédiatement les actions de faux positif et de risque accepté, sans tenir compte de ces paramètres et seuils. Fournissez soit rule, soit finding_ids, jamais les deux. Chaque résultat compte une seule fois à travers les analyses.

PATCH

triage

findings

curl --request PATCH \
  --url https://www.corgea.app/api/v1/triage/findings \
  --header 'CORGEA-TOKEN: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "justification": "<string>",
  "rule": {
    "statuses": [],
    "company_wide": false,
    "project_ids": [
      123
    ],
    "team_ids": [
      123
    ],
    "finding_types": [
      "sast",
      "sca"
    ],
    "cwes": [
      "CWE-79"
    ],
    "cves": [
      "CVE-2026-1000"
    ],
    "path_patterns": [
      "tests/**"
    ],
    "severities": [],
    "match": "all"
  },
  "finding_ids": [
    "3c90c3cc-0d44-4b50-8888-8dd25736052a"
  ],
  "apply": true,
  "expiry_date": "2023-11-07T05:31:56Z"
}
'

import requests

url = "https://www.corgea.app/api/v1/triage/findings"

payload = {
    "justification": "<string>",
    "rule": {
        "statuses": [],
        "company_wide": False,
        "project_ids": [123],
        "team_ids": [123],
        "finding_types": ["sast", "sca"],
        "cwes": ["CWE-79"],
        "cves": ["CVE-2026-1000"],
        "path_patterns": ["tests/**"],
        "severities": [],
        "match": "all"
    },
    "finding_ids": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
    "apply": True,
    "expiry_date": "2023-11-07T05:31:56Z"
}
headers = {
    "CORGEA-TOKEN": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {'CORGEA-TOKEN': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    justification: '<string>',
    rule: {
      statuses: [],
      company_wide: false,
      project_ids: [123],
      team_ids: [123],
      finding_types: ['sast', 'sca'],
      cwes: ['CWE-79'],
      cves: ['CVE-2026-1000'],
      path_patterns: ['tests/**'],
      severities: [],
      match: 'all'
    },
    finding_ids: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
    apply: true,
    expiry_date: '2023-11-07T05:31:56Z'
  })
};

fetch('https://www.corgea.app/api/v1/triage/findings', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://www.corgea.app/api/v1/triage/findings",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'justification' => '<string>',
    'rule' => [
        'statuses' => [
                
        ],
        'company_wide' => false,
        'project_ids' => [
                123
        ],
        'team_ids' => [
                123
        ],
        'finding_types' => [
                'sast',
                'sca'
        ],
        'cwes' => [
                'CWE-79'
        ],
        'cves' => [
                'CVE-2026-1000'
        ],
        'path_patterns' => [
                'tests/**'
        ],
        'severities' => [
                
        ],
        'match' => 'all'
    ],
    'finding_ids' => [
        '3c90c3cc-0d44-4b50-8888-8dd25736052a'
    ],
    'apply' => true,
    'expiry_date' => '2023-11-07T05:31:56Z'
  ]),
  CURLOPT_HTTPHEADER => [
    "CORGEA-TOKEN: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://www.corgea.app/api/v1/triage/findings"

	payload := strings.NewReader("{\n  \"justification\": \"<string>\",\n  \"rule\": {\n    \"statuses\": [],\n    \"company_wide\": false,\n    \"project_ids\": [\n      123\n    ],\n    \"team_ids\": [\n      123\n    ],\n    \"finding_types\": [\n      \"sast\",\n      \"sca\"\n    ],\n    \"cwes\": [\n      \"CWE-79\"\n    ],\n    \"cves\": [\n      \"CVE-2026-1000\"\n    ],\n    \"path_patterns\": [\n      \"tests/**\"\n    ],\n    \"severities\": [],\n    \"match\": \"all\"\n  },\n  \"finding_ids\": [\n    \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n  ],\n  \"apply\": true,\n  \"expiry_date\": \"2023-11-07T05:31:56Z\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("CORGEA-TOKEN", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://www.corgea.app/api/v1/triage/findings")
  .header("CORGEA-TOKEN", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"justification\": \"<string>\",\n  \"rule\": {\n    \"statuses\": [],\n    \"company_wide\": false,\n    \"project_ids\": [\n      123\n    ],\n    \"team_ids\": [\n      123\n    ],\n    \"finding_types\": [\n      \"sast\",\n      \"sca\"\n    ],\n    \"cwes\": [\n      \"CWE-79\"\n    ],\n    \"cves\": [\n      \"CVE-2026-1000\"\n    ],\n    \"path_patterns\": [\n      \"tests/**\"\n    ],\n    \"severities\": [],\n    \"match\": \"all\"\n  },\n  \"finding_ids\": [\n    \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n  ],\n  \"apply\": true,\n  \"expiry_date\": \"2023-11-07T05:31:56Z\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://www.corgea.app/api/v1/triage/findings")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["CORGEA-TOKEN"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"justification\": \"<string>\",\n  \"rule\": {\n    \"statuses\": [],\n    \"company_wide\": false,\n    \"project_ids\": [\n      123\n    ],\n    \"team_ids\": [\n      123\n    ],\n    \"finding_types\": [\n      \"sast\",\n      \"sca\"\n    ],\n    \"cwes\": [\n      \"CWE-79\"\n    ],\n    \"cves\": [\n      \"CVE-2026-1000\"\n    ],\n    \"path_patterns\": [\n      \"tests/**\"\n    ],\n    \"severities\": [],\n    \"match\": \"all\"\n  },\n  \"finding_ids\": [\n    \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n  ],\n  \"apply\": true,\n  \"expiry_date\": \"2023-11-07T05:31:56Z\"\n}"

response = http.request(request)
puts response.read_body

{
  "status": "ok",
  "action": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "status": "preview",
    "source": "api",
    "target_status": "<string>",
    "justification": "<string>",
    "accepted_risk_expiry_date": "2023-11-07T05:31:56Z",
    "rule": {},
    "source_metadata": {},
    "requires_approval": true,
    "requested_by": 123,
    "approved_by": 123,
    "rejected_by": 123,
    "created_at": "2023-11-07T05:31:56Z",
    "reviewed_at": "2023-11-07T05:31:56Z",
    "applied_at": "2023-11-07T05:31:56Z",
    "counts": {
      "matched": 123,
      "unmatched": 123,
      "ambiguous": 123,
      "applied": 123,
      "conflicts": 123
    }
  },
  "unresolved_ids": [
    "<string>"
  ]
}

{
  "status": "ok",
  "action": {
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "status": "preview",
    "source": "api",
    "target_status": "<string>",
    "justification": "<string>",
    "accepted_risk_expiry_date": "2023-11-07T05:31:56Z",
    "rule": {},
    "source_metadata": {},
    "requires_approval": true,
    "requested_by": 123,
    "approved_by": 123,
    "rejected_by": 123,
    "created_at": "2023-11-07T05:31:56Z",
    "reviewed_at": "2023-11-07T05:31:56Z",
    "applied_at": "2023-11-07T05:31:56Z",
    "counts": {
      "matched": 123,
      "unmatched": 123,
      "ambiguous": 123,
      "applied": 123,
      "conflicts": 123
    }
  },
  "unresolved_ids": [
    "<string>"
  ]
}

Autorisations

CORGEA-TOKEN

string

header

requis

Clé API pour l'authentification Les jetons API des utilisateurs inactifs sont refusés.

Corps

application/json

Avec rule
Avec finding_ids

Sélectionnez les findings avec rule ou avec finding_ids, jamais les deux dans un même appel.

target_status

enum<string>

requis

fix_in_progress est disponible uniquement lorsque finding_types contient seulement sast.

Options disponibles:

open,

fixed,

false_positive,

accepted_risk,

duplicate,

fix_in_progress

justification

string

requis

Minimum string length: 1

rule

object

requis

Sélectionnez un périmètre avec company_wide, project_ids ou team_ids. Les filtres utilisent match pour combiner les critères applicables ; les filtres CWE s’appliquent à SAST, et les filtres CVE et d’accessibilité à SCA.

Show child attributes

finding_ids

string<uuid>[]

Identifiants de findings (issus de /findings ou du finding_id des éléments de problème) ou identifiants de problèmes. Un identifiant de finding désigne la détection la plus récente du finding, et la décision s’applique à toutes ses détections. Les identifiants qui ne correspondent à rien sont renvoyés dans unresolved_ids et comptés comme non appariés. Les findings de conteneurs et IaC sont hors du triage en masse ; leurs identifiants sont donc eux aussi renvoyés dans unresolved_ids.

apply

boolean

défaut:true

Définissez false pour créer un aperçu sans modifier les problèmes.

expiry_date

string<date-time> | null

Date d’expiration future, uniquement pour les actions accepted_risk.

Réponse

Action prévisualisée ou appliquée

status

string

Exemple:

"ok"

action

object

Show child attributes

unresolved_ids

string[]

Identifiants de finding_ids qui ne correspondent à aucun finding ni problème. Vide lorsque les findings ont été sélectionnés avec rule.

Référence API

Authentification

Analyses

Problèmes

Findings

Triage

Dépendances

Dependencies

Lancement d’une analyse Corgea

Importation d’une analyse tierce

Compétences

Projets

Politiques

Notifications

Équipes

Intégrations Harness

Users

Triage en masse des problèmes

Autorisations

Corps

Réponse