> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Assign vulnerability

> Assigns or unassigns a vulnerability. Use assignee=me for the authenticated tenant user, a user id/prefixed id/email, or null/unassigned to clear assignment.



## OpenAPI

````yaml https://app.cysmiq.com/docs/tenant/openapi.json patch /{tenant_slug}/vulnerabilities/{vulnerability}/assignment
openapi: 3.1.0
info:
  title: Cysmiq
  version: v1
  description: Tenant API
servers:
  - url: https://app.cysmiq.com/api/v1
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Token
    description: Token introspection and authentication context.
  - name: Organizations
    description: Read-only organizational unit (org) data.
  - name: Repositories
    description: Read-only repository data.
  - name: Applications
    description: Read-only application data.
  - name: Scans
    description: Read-only scan status data for CI integrations.
  - name: Vulnerabilities
    description: Read-only vulnerability data for CI and reporting.
  - name: Policy Violations
    description: Read-only policy violation data for CI and reporting.
paths:
  /{tenant_slug}/vulnerabilities/{vulnerability}/assignment:
    patch:
      tags:
        - Vulnerabilities
      summary: Assign vulnerability
      description: >-
        Assigns or unassigns a vulnerability. Use assignee=me for the
        authenticated tenant user, a user id/prefixed id/email, or
        null/unassigned to clear assignment.
      operationId: assignVulnerability
      parameters:
        - name: tenant_slug
          in: path
          required: true
          description: Workspace slug for the tenant context.
          schema: {}
          example: acme
        - name: vulnerability
          in: path
          required: true
          description: Vulnerability prefixed id (vc_...).
          schema:
            type: string
          example: vc_01hxyz
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VulnerabilityAssignmentRequest'
      responses:
        '200':
          description: Updated vulnerability assignment.
          content:
            application/json:
              schema:
                type: object
                properties:
                  vulnerability:
                    type: object
                    properties:
                      id:
                        type: string
                      assignee:
                        type:
                          - object
                          - 'null'
                        properties:
                          id:
                            type: string
                          display_name:
                            type: string
                          email:
                            type: string
                        required:
                          - id
                          - display_name
                          - email
                      status_version:
                        type: string
                      updated_at:
                        type: string
                    required:
                      - id
                      - assignee
                      - status_version
                      - updated_at
                required:
                  - vulnerability
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '422':
          $ref: '#/components/responses/ValidationFailedError'
        '429':
          $ref: '#/components/responses/RateLimitedError'
        '500':
          $ref: '#/components/responses/InternalError'
        '503':
          $ref: '#/components/responses/ServiceUnavailableError'
components:
  schemas:
    VulnerabilityAssignmentRequest:
      type: object
      properties:
        assignee:
          type:
            - string
            - 'null'
          maxLength: 255
        status_version:
          type:
            - string
            - 'null'
          maxLength: 255
      required:
        - assignee
      title: VulnerabilityAssignmentRequest
    ApiError:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          description: Machine-readable error code.
        message:
          type: string
          description: Human-readable error message.
        details:
          type: object
          description: Optional structured error details.
          additionalProperties: true
  responses:
    UnauthorizedError:
      description: Authentication is required or the token is invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            authenticationRequired:
              value:
                code: AUTHENTICATION_REQUIRED
                message: Unauthenticated.
    ForbiddenError:
      description: The token is authenticated but not permitted for this tenant or action.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            tokenInvalidForTenant:
              value:
                code: TOKEN_INVALID_FOR_TENANT
                message: Token not valid for this tenant.
            tokenAbilityDenied:
              value:
                code: TOKEN_ABILITY_DENIED
                message: Forbidden.
    NotFoundError:
      description: The workspace or requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            tenantNotFound:
              value:
                code: TENANT_NOT_FOUND
                message: Workspace not found
            resourceNotFound:
              value:
                code: RESOURCE_NOT_FOUND
                message: Not found.
    ValidationFailedError:
      description: >-
        The request could not be processed because validation failed or filter
        values were unsupported.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            validationFailed:
              value:
                code: VALIDATION_FAILED
                message: The given data was invalid.
                details:
                  errors:
                    severity:
                      - The selected severity is invalid.
            invalidFilterValue:
              value:
                code: INVALID_FILTER_VALUE
                message: 'Invalid filter value(s): critical'
                details:
                  invalid_values:
                    - critical
    RateLimitedError:
      description: The request exceeded the tenant API rate limit.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            rateLimited:
              value:
                code: RATE_LIMITED
                message: Too Many Attempts.
    InternalError:
      description: The server encountered an unexpected error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            internalError:
              value:
                code: INTERNAL_ERROR
                message: Internal server error
    ServiceUnavailableError:
      description: The workspace or service is temporarily unavailable.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            serviceUnavailable:
              value:
                code: SERVICE_UNAVAILABLE
                message: Service Unavailable
  securitySchemes:
    bearerAuth:
      type: http
      description: 'Use a Cysmiq API token in the Authorization header: Bearer {token}.'
      scheme: bearer
      bearerFormat: Token

````