API Vulnerability Workflow

POST /api/v1/(api_key)/vulnerability/(vulnerability_id)/update

New in version 1.0.

Update a vulnerability.

Example request:

POST /api/v1/44df57d3f5a479e334e622f314787dcc/vulnerability/656c83c5a79197d3b5dae238016736aa335a13f9/update HTTP/1.1
Host: api.appcheck-ng.com
Accept-Encoding: identity
Content-Length: 63
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

notes=Internal+test+network&priority=low&status=acceptable_risk

Example response:

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 86
Date: Wed, 08 May 2019 11:27:48 GMT

{
  "errors": null,
  "message": "Vulnerability has been updated",
  "success": true
}
Parameters:
  • api_key (string) – Your API key
  • vulnerability_id (string) – ID of the vulnerability
Form Parameters:
 
  • status – (optional) vulnerability status of the vulnerability
  • notes – (optional) user provided notes of the vulnerability
  • priority – (optional) priority of the vulnerability, can be changed by the user
  • suppression – (optional) suppression period in days, for the false_positive and acceptable_risk statuses. One of 14, 30, 60, 90, 180, 366 or 99999 (permanent). Can be sent with status, or on its own to change the period of a vulnerability that is already suppressed
Response Headers:
 
Response JSON Object:
 
  • success (boolean) – operation was successful
  • message (string) – human readable response
  • errors (strings) – detailed list of errors
Status Codes:

Suppressing a vulnerability

Setting the status to false_positive or acceptable_risk suppresses the vulnerability for its suppression period. Send suppression to choose the period. The same periods are available in the AppCheck web interface, and 99999 keeps the vulnerability suppressed permanently. For example, to accept a risk permanently:

status=acceptable_risk&suppression=99999

Sending suppression starts the period again from the time of the request, so it can also be used to extend or shorten an existing suppression:

suppression=180

If suppression is not sent, the vulnerability keeps its current period, or the 14-day default.

A suppression value is rejected, and nothing is changed, if it is not one of the values above, or if the vulnerability’s status after the update is not false_positive or acceptable_risk.

New in version 1.6.0: The suppression parameter. Previously the suppression period could not be set through the API, and every vulnerability suppressed through it used the 14-day default.

See also:
POST /api/v1/(api_key)/vulnerability/(vuln_id)/delete

New in version 1.0.

Delete a vulnerability

Example request:

POST /api/v1/44df57d3f5a479e334e622f314787dcc/vulnerability/656c83c5a79197d3b5dae238016736aa335a13f9/delete HTTP/1.1
Host: api.appcheck-ng.com
Accept-Encoding: identity
Content-Length: 0

Example response:

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 68
Date: Wed, 08 May 2019 11:27:59 GMT

{
  "message": "Vulnerability has been deleted",
  "success": true
}
Parameters:
  • api_key (string) – Your API key
  • vuln_id (string) – ID of the vulnerability
Response Headers:
 
Response JSON Object:
 
  • success (boolean) – operation was successful
  • message (string) – human readable response
Status Codes: