> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cysmiq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Triage vulnerability

> Transitions a vulnerability between triage states (open, fixed, accepted, ignored). Optionally pass the current `status_version` for optimistic-locking — when supplied, a 409 is returned if the value is stale. The response carries the new version on success.



## OpenAPI

````yaml https://app.cysmiq.com/docs/tenant/openapi.json patch /{tenant_slug}/vulnerabilities/{vulnerability}/triage
openapi: 3.1.0
info:
  title: Cysmiq
  version: v1
  description: Tenant API
servers:
  - url: https://app.cysmiq.com/api/v1
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Token
    description: Token introspection and authentication context.
  - name: Organizations
    description: Read-only organizational unit (org) data.
  - name: Repositories
    description: Read-only repository data.
  - name: Applications
    description: Read-only application data.
  - name: Scans
    description: Read-only scan status data for CI integrations.
  - name: Vulnerabilities
    description: Read-only vulnerability data for CI and reporting.
  - name: Policy Violations
    description: Read-only policy violation data for CI and reporting.
paths:
  /{tenant_slug}/vulnerabilities/{vulnerability}/triage:
    patch:
      tags:
        - Vulnerabilities
      summary: Triage vulnerability
      description: >-
        Transitions a vulnerability between triage states (open, fixed,
        accepted, ignored). Optionally pass the current `status_version` for
        optimistic-locking — when supplied, a 409 is returned if the value is
        stale. The response carries the new version on success.
      operationId: triageVulnerability
      parameters:
        - name: tenant_slug
          in: path
          required: true
          description: Workspace slug for the tenant context.
          schema: {}
          example: acme
        - name: vulnerability
          in: path
          required: true
          description: Vulnerability prefixed id (vc_...).
          schema:
            type: string
          example: vc_01hxyz
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VulnerabilityTriageRequest'
      responses:
        '200':
          description: Updated vulnerability triage state.
          content:
            application/json:
              schema:
                type: object
                required:
                  - vulnerability
                properties:
                  vulnerability:
                    type: object
                    required:
                      - id
                      - state
                      - status
                      - resolution
                      - status_version
                      - confirmed
                      - triaged
                      - resolved_at
                      - updated_at
                    properties:
                      id:
                        type: string
                      state:
                        type: string
                        enum:
                          - fixed
                          - accepted
                          - ignored
                          - open
                      status:
                        type: string
                      resolution:
                        type:
                          - string
                          - 'null'
                      status_version:
                        type: string
                      confirmed:
                        type: boolean
                      triaged:
                        type: boolean
                      resolved_at:
                        type:
                          - string
                          - 'null'
                      updated_at:
                        type: string
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
        '422':
          $ref: '#/components/responses/ValidationFailedError'
        '429':
          $ref: '#/components/responses/RateLimitedError'
        '500':
          $ref: '#/components/responses/InternalError'
        '503':
          $ref: '#/components/responses/ServiceUnavailableError'
components:
  schemas:
    VulnerabilityTriageRequest:
      type: object
      properties:
        state:
          type: string
          enum:
            - open
            - fixed
            - accepted
            - ignored
        reason:
          type:
            - string
            - 'null'
          maxLength: 1000
        status_version:
          type:
            - string
            - 'null'
          maxLength: 255
      required:
        - state
      title: VulnerabilityTriageRequest
    ApiError:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
          description: Machine-readable error code.
        message:
          type: string
          description: Human-readable error message.
        details:
          type: object
          description: Optional structured error details.
          additionalProperties: true
  responses:
    UnauthorizedError:
      description: Authentication is required or the token is invalid.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            authenticationRequired:
              value:
                code: AUTHENTICATION_REQUIRED
                message: Unauthenticated.
    ForbiddenError:
      description: The token is authenticated but not permitted for this tenant or action.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            tokenInvalidForTenant:
              value:
                code: TOKEN_INVALID_FOR_TENANT
                message: Token not valid for this tenant.
            tokenAbilityDenied:
              value:
                code: TOKEN_ABILITY_DENIED
                message: Forbidden.
    NotFoundError:
      description: The workspace or requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            tenantNotFound:
              value:
                code: TENANT_NOT_FOUND
                message: Workspace not found
            resourceNotFound:
              value:
                code: RESOURCE_NOT_FOUND
                message: Not found.
    ValidationFailedError:
      description: >-
        The request could not be processed because validation failed or filter
        values were unsupported.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            validationFailed:
              value:
                code: VALIDATION_FAILED
                message: The given data was invalid.
                details:
                  errors:
                    severity:
                      - The selected severity is invalid.
            invalidFilterValue:
              value:
                code: INVALID_FILTER_VALUE
                message: 'Invalid filter value(s): critical'
                details:
                  invalid_values:
                    - critical
    RateLimitedError:
      description: The request exceeded the tenant API rate limit.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            rateLimited:
              value:
                code: RATE_LIMITED
                message: Too Many Attempts.
    InternalError:
      description: The server encountered an unexpected error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            internalError:
              value:
                code: INTERNAL_ERROR
                message: Internal server error
    ServiceUnavailableError:
      description: The workspace or service is temporarily unavailable.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
          examples:
            serviceUnavailable:
              value:
                code: SERVICE_UNAVAILABLE
                message: Service Unavailable
  securitySchemes:
    bearerAuth:
      type: http
      description: 'Use a Cysmiq API token in the Authorization header: Bearer {token}.'
      scheme: bearer
      bearerFormat: Token

````