> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Link a pull request to a vulnerability > Stores a pull request or merge request URL as the vulnerability's fix PR. Works for every finding, including black-box findings with no repository. Accepts GitHub pull requests, GitLab merge requests and Bitbucket pull requests on any host, including self-hosted instances. Strix attaches the pull request to each Linear or Jira ticket of the finding. A previous pull request on the finding is replaced and removed from those tickets. Tickets created later pick up the stored pull request automatically. Returns 409 when the stored pull request changed while the request was in flight. ## OpenAPI ````yaml /openapi.json put /vulnerabilities/{vulnerabilityId}/fix-pr openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /vulnerabilities/{vulnerabilityId}/fix-pr: put: tags: - Vulnerabilities summary: Link a pull request to a vulnerability description: >- Stores a pull request or merge request URL as the vulnerability's fix PR. Works for every finding, including black-box findings with no repository. Accepts GitHub pull requests, GitLab merge requests and Bitbucket pull requests on any host, including self-hosted instances. Strix attaches the pull request to each Linear or Jira ticket of the finding. A previous pull request on the finding is replaced and removed from those tickets. Tickets created later pick up the stored pull request automatically. Returns 409 when the stored pull request changed while the request was in flight. operationId: linkVulnerabilityPullRequest parameters: - $ref: '#/components/parameters/VulnerabilityId' requestBody: required: true content: application/json: schema: type: object properties: url: type: string format: uri description: Pull request or merge request URL. example: https://github.com/acme/api/pull/42 expected_fix_pr_url: type: - string - 'null' format: uri description: >- The pull request the caller believes the vulnerability currently stores; null when it should have none. When present, the request only succeeds if that is still the case and returns 409 otherwise. Use it to restore a link without overwriting one added in the meantime. example: null required: - url responses: '200': description: >- Pull request linked. `ticket_links` reports the attachment to the finding's tickets. content: application/json: schema: type: object properties: fix_pr_url: type: string description: Canonical form of the stored URL. ticket_links: $ref: '#/components/schemas/PullRequestTicketLinks' replaced: type: - object - 'null' description: >- The pull request this one replaced, when the finding already had one. properties: fix_pr_url: type: string ticket_links: $ref: '#/components/schemas/PullRequestTicketUnlinks' required: - fix_pr_url - ticket_links required: - fix_pr_url - ticket_links - replaced '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/Conflict' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - vulnerabilities:write components: parameters: VulnerabilityId: description: >- ID of the vulnerability. Use the `id` field of a finding from `listVulnerabilities`. name: vulnerabilityId in: path required: true schema: type: string schemas: PullRequestTicketLinks: type: object description: >- Result of attaching the pull request to the finding's tickets. Every list is empty when the finding has no ticket. properties: attached: type: array items: type: string description: Ticket keys that now link to the pull request. unsupported: type: array items: type: string description: Tickets on connections that cannot carry pull request links. failed: type: array items: type: object properties: ticket: type: string provider: type: string enum: - jira - linear detail: type: string required: - ticket - provider - detail description: >- Tickets the operation failed for. `fix_pr_url` on the finding is already updated. error: type: string description: >- Present when the finding's tickets could not be looked up; the lists are then empty and `fix_pr_url` is already updated. required: - attached - unsupported - failed PullRequestTicketUnlinks: type: object description: >- Result of removing the pull request link from the finding's tickets. Every list is empty when the finding has no ticket. properties: detached: type: array items: type: string description: Ticket keys the pull request link was removed from. unsupported: type: array items: type: string description: Tickets on connections that cannot carry pull request links. failed: type: array items: type: object properties: ticket: type: string provider: type: string enum: - jira - linear detail: type: string required: - ticket - provider - detail description: >- Tickets the operation failed for. `fix_pr_url` on the finding is already updated. error: type: string description: >- Present when the finding's tickets could not be looked up; the lists are then empty and `fix_pr_url` is already updated. required: - detached - unsupported - failed ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Conflict: description: Conflict. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.