Vulnerabilities

Update a vulnerability

Updates status, assignee, and riskAcceptance atomically. Technical findings and remediation content are maintained through authorized agent tools. Omitted fields retain their values. Assign a team member by email or an agent by its registered name; use null to unassign. Moving to in_progress requires an assignee, which can be included in the same request.

Set remediated after the fix is deployed. With the default verification hook enabled, this starts verification. The verified status is set through verification and cannot be assigned directly here. Accepting risk requires riskAcceptance with a note and future expiresAt. Moving away from accepted_risk clears riskAcceptance.

Changes to status or assignee emit their respective events after the update is saved. Sending an unchanged value emits no event. Work started by hooks runs separately. The SDK’s updateStatus() and updateAssignee() methods call this endpoint.

PATCH

vulnerabilities

{id}

curl --request PATCH \
  --url https://api.antigen.sh/v1/vulnerabilities/{id} \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "assignee": "remediation-agent"
}
'

{
  "id": "vuln_123",
  "title": "Cross-account invoice access",
  "description": "An authenticated account can retrieve another account’s invoice by changing its ID.",
  "severity": "high",
  "target": "api.example.com",
  "runId": "run_123",
  "remediation": "Check that the authenticated account owns the invoice before returning it.",
  "status": "open",
  "assignee": null,
  "riskAcceptance": null,
  "createdAt": "2026-09-13T10:00:00.000Z",
  "updatedAt": "2026-09-13T10:00:00.000Z"
}

{
  "error": {
    "code": "invalid_request",
    "message": "Check the request fields and values."
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Supply a valid API key."
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "The API key does not permit this operation or requested scope."
  }
}

{
  "error": {
    "code": "not_found",
    "message": "The resource does not exist in this organization."
  }
}

{
  "error": {
    "code": "conflict",
    "message": "The resource’s current state does not allow this operation."
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Retry after the interval in Retry-After."
  }
}

Authorizations

x-api-key

string

header

required

API key from your organization. Supply the value directly, without a Bearer prefix.

Path Parameters

string

required

Opaque resource identifier.

Minimum string length: 1

Body

application/json

Updates workflow fields only. Technical findings and remediation content are maintained through authorized agent tools.

status

enum<string>

verified is set by verification, not by this endpoint.

Available options:

open,

in_progress,

remediated,

accepted_risk

assignee

string | null

Team member email, registered agent name, or null to remove the assignment.

riskAcceptance

object

Show child attributes

Response

Successful response.

string

required

Minimum string length: 1

title

string

required

Short description of the weakness.

Minimum string length: 1

description

string

required

Affected behavior, reproduction steps, and impact.

Minimum string length: 1

severity

enum<string>

required

Available options:

critical,

high,

medium,

low

remediation

string

required

Proposed remediation steps. May include links to pull requests or infrastructure recommendations.

target

string

required

runId

string | null

required

Run that originally discovered the vulnerability, if any.

status

enum<string>

required

Available options:

open,

in_progress,

remediated,

verified,

accepted_risk

assignee

string | null

required

Team member email or registered agent name. Null means unassigned.

riskAcceptance

object | null

required

Show child attributes

createdAt

string<date-time>

required

updatedAt

string<date-time>

required

curl --request PATCH \
  --url https://api.antigen.sh/v1/vulnerabilities/{id} \
  --header 'Content-Type: application/json' \
  --header 'x-api-key: <api-key>' \
  --data '
{
  "assignee": "remediation-agent"
}
'

{
  "id": "vuln_123",
  "title": "Cross-account invoice access",
  "description": "An authenticated account can retrieve another account’s invoice by changing its ID.",
  "severity": "high",
  "target": "api.example.com",
  "runId": "run_123",
  "remediation": "Check that the authenticated account owns the invoice before returning it.",
  "status": "open",
  "assignee": null,
  "riskAcceptance": null,
  "createdAt": "2026-09-13T10:00:00.000Z",
  "updatedAt": "2026-09-13T10:00:00.000Z"
}

{
  "error": {
    "code": "invalid_request",
    "message": "Check the request fields and values."
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Supply a valid API key."
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "The API key does not permit this operation or requested scope."
  }
}

{
  "error": {
    "code": "not_found",
    "message": "The resource does not exist in this organization."
  }
}

{
  "error": {
    "code": "conflict",
    "message": "The resource’s current state does not allow this operation."
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Retry after the interval in Retry-After."
  }
}

Getting started

Endpoints

Update a vulnerability

Authorizations

Path Parameters

Body

Response