> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Update vulnerability status, severity, or CVSS

> Change status and/or severity, or adjust the CVSS v3.1 base metrics with a required reason. CVSS adjustments cannot be combined with status or severity. The server calculates the score, vector and severity, and preserves the manual rating when scans update the same issue.



## OpenAPI

````yaml /openapi.json patch /vulnerabilities/{vulnerabilityId}
openapi: 3.1.0
info:
  title: Strix API
  version: 1.0.0
  description: >-
    Public REST API for the Strix autonomous penetration testing platform.
    Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks.
servers:
  - url: /api/v1
    description: Strix v1 API
security:
  - BearerAuth: []
tags:
  - name: Scans
    description: Launch, monitor, and manage security scans.
  - name: Vulnerabilities
    description: View and triage discovered vulnerabilities.
  - name: Assets
    description: Domains and repositories registered for scanning.
  - name: Schedules
    description: Recurring scan schedules (Pro plan).
  - name: Search
    description: Search across issues, pentests, PR reviews, chats, assets and schedules.
  - name: Tokens
    description: Manage API tokens for authentication.
  - name: Webhooks
    description: Configure webhook subscriptions for real-time event notifications.
  - name: Organization
    description: Workspace configuration for the authenticated organization.
  - name: Members
    description: Manage organization members and roles.
  - name: Invitations
    description: List and revoke organization invitations.
  - name: PR Reviews
    description: Automated security review of pull requests.
  - name: Connectors
    description: Network connectors for scanning internal/private targets.
  - name: Knowledge
    description: >-
      Organization knowledge base: documents, policies, and repo profiles that
      steer the agent.
  - name: Uploads
    description: Upload source/code/documentation archives for whitebox scans.
  - name: Integrations
    description: Third-party integrations (GitLab, Bitbucket, ticketing).
  - name: Chat
    description: Conversational agent sessions.
  - name: Analytics
    description: Aggregate dashboard analytics.
  - name: Test Users
    description: >-
      Per-domain test accounts (with optional MFA) the agent authenticates as
      during scans.
  - name: License
    description: Self-hosted license state, entitlements, and aggregate usage.
  - name: Supply Chain
    description: >-
      SBOM inventory, supply-chain findings, scans, and policy for connected
      repositories.
  - name: CLI
    description: >-
      Device authorization endpoints that let the Strix CLI and coding agents
      sign in and receive an API token.
  - name: Billing
    description: Credit balance, agent-payable top-ups, and automatic top-up settings.
  - name: Workspaces
    description: List, create, and switch workspaces.
  - name: Asset Discovery
    description: >-
      Passive reconnaissance runs that map the organization's external attack
      surface, and the discovered-asset inventory they fill.
  - name: Containers
    description: >-
      Container registries, tracked images, image scans, findings, and SBOM
      components.
  - name: Run Logs
    description: Persisted engine logs and the diagnostics bundle of a self-hosted install.
paths:
  /vulnerabilities/{vulnerabilityId}:
    patch:
      tags:
        - Vulnerabilities
      summary: Update vulnerability status, severity, or CVSS
      description: >-
        Change status and/or severity, or adjust the CVSS v3.1 base metrics with
        a required reason. CVSS adjustments cannot be combined with status or
        severity. The server calculates the score, vector and severity, and
        preserves the manual rating when scans update the same issue.
      operationId: updateVulnerability
      parameters:
        - $ref: '#/components/parameters/VulnerabilityId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateVulnerabilityRequest'
      responses:
        '200':
          description: Updated vulnerability.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Vulnerability'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalError'
      security:
        - BearerAuth:
            - vulnerabilities:write
components:
  parameters:
    VulnerabilityId:
      description: >-
        ID of the vulnerability. Use the `id` field of a finding from
        `listVulnerabilities`.
      name: vulnerabilityId
      in: path
      required: true
      schema:
        type: string
  schemas:
    UpdateVulnerabilityRequest:
      type: object
      description: >-
        Provide status and/or severity, or cvss_breakdown plus severity_reason.
        All eight CVSS v3.1 base metrics and a nonblank reason are required for
        CVSS adjustments.
      properties:
        status:
          $ref: '#/components/schemas/VulnerabilityStatus'
          description: New triage status of the finding.
        note:
          type: string
          description: Optional note when changing status.
        snoozed_until:
          type: string
          format: date-time
          description: Required when `status` is `snoozed`. The date must be in the future.
        severity:
          $ref: '#/components/schemas/VulnerabilitySeverity'
          description: New severity of the finding.
        severity_reason:
          type: string
          maxLength: 1000
          description: >-
            Optional for label-only severity changes; required and nonblank when
            adjusting CVSS.
        cvss_breakdown:
          $ref: '#/components/schemas/CvssV31BaseMetrics'
      anyOf:
        - required:
            - status
          not:
            required:
              - cvss_breakdown
        - required:
            - severity
          not:
            required:
              - cvss_breakdown
        - required:
            - cvss_breakdown
            - severity_reason
          not:
            anyOf:
              - required:
                  - status
              - required:
                  - severity
    Vulnerability:
      type: object
      properties:
        id:
          type: string
        scan_id:
          type:
            - string
            - 'null'
          format: uuid
        pr_review_id:
          type:
            - string
            - 'null'
          format: uuid
        title:
          type: string
        description:
          type: string
        cve:
          type:
            - string
            - 'null'
        cvss:
          type:
            - number
            - 'null'
        created_at:
          type: string
          format: date-time
        potential_risk_saving:
          type:
            - number
            - 'null'
        risk_saving_description:
          type:
            - string
            - 'null'
        status:
          $ref: '#/components/schemas/VulnerabilityStatus'
        severity:
          $ref: '#/components/schemas/VulnerabilitySeverity'
        impact:
          type:
            - string
            - 'null'
        endpoint:
          type:
            - string
            - 'null'
        method:
          type:
            - string
            - 'null'
        target:
          type:
            - string
            - 'null'
        technical_analysis:
          type:
            - string
            - 'null'
        poc_description:
          type:
            - string
            - 'null'
        poc_script_code:
          type:
            - string
            - 'null'
        code_diff:
          type:
            - string
            - 'null'
        code_file:
          type:
            - string
            - 'null'
        code_before:
          type:
            - string
            - 'null'
        code_after:
          type:
            - string
            - 'null'
        cwe:
          type:
            - array
            - 'null'
          items:
            type: string
        code_locations:
          type:
            - array
            - 'null'
          items:
            $ref: '#/components/schemas/CodeLocation'
        remediation_steps:
          type:
            - string
            - 'null'
        fix_pr_body:
          type:
            - string
            - 'null'
        evidence:
          type:
            - string
            - 'null'
        assumptions:
          type:
            - string
            - 'null'
        fix_effort:
          $ref: '#/components/schemas/FixEffort'
        cvss_breakdown:
          oneOf:
            - $ref: '#/components/schemas/CVSSBreakdown'
            - type: 'null'
        status_changed_at:
          type:
            - string
            - 'null'
          format: date-time
        status_changed_by:
          type:
            - string
            - 'null'
        status_note:
          type:
            - string
            - 'null'
        original_severity:
          $ref: '#/components/schemas/VulnerabilitySeverity'
        severity_changed_at:
          type:
            - string
            - 'null'
          format: date-time
        severity_changed_by:
          type:
            - string
            - 'null'
        severity_override_reason:
          type:
            - string
            - 'null'
        retest_of_vulnerability_id:
          type:
            - string
            - 'null'
        display_number:
          type:
            - integer
            - 'null'
          description: Human-readable STRIX-ID number.
        location_meta:
          $ref: '#/components/schemas/LocationMeta'
        latest_retest:
          $ref: '#/components/schemas/VulnerabilityRetest'
        fix_pr_eligible:
          type: boolean
        fix_pr_reason:
          type:
            - string
            - 'null'
        fix_pr_url:
          type:
            - string
            - 'null'
        cvss_adjustment:
          oneOf:
            - $ref: '#/components/schemas/CvssAdjustment'
            - type: 'null'
      required:
        - id
        - title
        - description
        - status
        - severity
        - created_at
    VulnerabilityStatus:
      type: string
      enum:
        - open
        - in_progress
        - snoozed
        - fixed
        - ignored
        - not_affected
    VulnerabilitySeverity:
      type: string
      enum:
        - critical
        - high
        - medium
        - low
    CvssV31BaseMetrics:
      type: object
      description: The eight CVSS v3.1 base metric selections.
      required:
        - attack_vector
        - attack_complexity
        - privileges_required
        - user_interaction
        - scope
        - confidentiality
        - integrity
        - availability
      properties:
        attack_vector:
          type: string
          enum:
            - 'N'
            - A
            - L
            - P
        attack_complexity:
          type: string
          enum:
            - L
            - H
        privileges_required:
          type: string
          enum:
            - 'N'
            - L
            - H
        user_interaction:
          type: string
          enum:
            - 'N'
            - R
        scope:
          type: string
          enum:
            - U
            - C
        confidentiality:
          type: string
          enum:
            - 'N'
            - L
            - H
        integrity:
          type: string
          enum:
            - 'N'
            - L
            - H
        availability:
          type: string
          enum:
            - 'N'
            - L
            - H
    CodeLocation:
      type: object
      properties:
        file:
          type: string
        start_line:
          type: integer
        end_line:
          type: integer
        snippet:
          type: string
        label:
          type: string
        fix_before:
          type: string
        fix_after:
          type: string
      required:
        - file
        - start_line
    FixEffort:
      type: string
      enum:
        - trivial
        - low
        - medium
        - high
    CVSSBreakdown:
      type: object
      properties:
        attack_vector:
          type:
            - string
            - 'null'
        attack_complexity:
          type:
            - string
            - 'null'
        privileges_required:
          type:
            - string
            - 'null'
        user_interaction:
          type:
            - string
            - 'null'
        scope:
          type:
            - string
            - 'null'
        confidentiality:
          type:
            - string
            - 'null'
        integrity:
          type:
            - string
            - 'null'
        availability:
          type:
            - string
            - 'null'
    LocationMeta:
      type:
        - object
        - 'null'
      properties:
        branch:
          type: string
        provider:
          type: string
        repo_url:
          type: string
    VulnerabilityRetest:
      type:
        - object
        - 'null'
      description: >-
        The newest retest of the issue. The value is null when nobody retested
        the issue.
      properties:
        scan_id:
          type: string
          description: The retest scan. Read it with `GET /scans/{scanId}`.
        outcome:
          $ref: '#/components/schemas/RetestOutcome'
        inconclusive_reason:
          type:
            - string
            - 'null'
          description: >-
            Why an `inconclusive` retest could not verify the issue, in the
            retest agent's words. Null for every other outcome, and when the
            retest gave no reason; the retest scan's trace has the details.
        started_at:
          type: string
          format: date-time
      required:
        - scan_id
        - outcome
        - inconclusive_reason
        - started_at
    CvssAdjustment:
      type: object
      description: >-
        Manual CVSS adjustment and the rating before the first adjustment. A
        label-only severity change clears this record without changing the
        numeric score.
      properties:
        breakdown:
          oneOf:
            - $ref: '#/components/schemas/CvssV31BaseMetrics'
            - type: 'null'
        score:
          type:
            - number
            - 'null'
        vector:
          type:
            - string
            - 'null'
        severity:
          oneOf:
            - $ref: '#/components/schemas/VulnerabilitySeverity'
            - type: 'null'
        reason:
          type:
            - string
            - 'null'
        adjusted_by:
          type:
            - string
            - 'null'
        adjusted_at:
          type:
            - string
            - 'null'
          format: date-time
        original:
          oneOf:
            - type: object
              properties:
                score:
                  type:
                    - number
                    - 'null'
                vector:
                  type:
                    - string
                    - 'null'
                severity:
                  type:
                    - string
                    - 'null'
            - type: 'null'
    ErrorResponse:
      type: object
      properties:
        detail:
          type: string
          description: Human-readable explanation of the error.
        code:
          type: string
          description: >-
            Stable machine-readable error code. `insufficient_scope` means the
            token does not hold the scope that this endpoint requires.
        required_scope:
          $ref: '#/components/schemas/ApiV1Scope'
          description: >-
            Scope that the caller must add to the token. Returned with the
            `insufficient_scope` code.
        docs:
          type: string
          format: uri
          description: Documentation page that explains how to resolve the error.
        hint:
          type: string
          description: >-
            One instruction that resolves the error. For `insufficient_scope`, a
            CLI session gets the `strix cloud session scopes set full` or `strix
            cloud login --scope-profile full` command, and an API token gets the
            settings page where the user creates a token with the scope. When
            the owner's role cannot hold the scope, the hint asks for a role
            change instead.
      required:
        - detail
    RetestOutcome:
      type: string
      enum:
        - running
        - still_present
        - inconclusive
        - not_reproduced
        - failed
        - cancelled
      description: >-
        The state of a retest. `running` means the retest scan is pending or
        running. `still_present` means the retest reproduced the issue.
        `inconclusive` means the retest completed but could not verify the
        issue, for example because the target did not respond; the issue keeps
        its status. If the service was taken down on purpose, close these issues
        with `POST /vulnerabilities/bulk-update` and `status: fixed`.
        `not_reproduced` means the retest completed and did not find the issue.
        `failed` and `cancelled` mirror the retest scan status.
    ApiV1Scope:
      type: string
      enum:
        - scans:read
        - scans:write
        - vulnerabilities:read
        - vulnerabilities:write
        - dependencies:read
        - schedules:read
        - schedules:write
        - assets:read
        - assets:write
        - organizations:read
        - organizations:write
        - members:read
        - members:write
        - invitations:read
        - invitations:write
        - webhooks:read
        - webhooks:write
        - tokens:write
        - audit:read
        - pr_reviews:read
        - pr_reviews:write
        - connectors:read
        - connectors:write
        - knowledge:read
        - knowledge:write
        - uploads:write
        - integrations:read
        - integrations:write
        - chat:read
        - chat:write
        - scans:message
        - analytics:read
        - llm:read
        - llm:write
        - test_users:read
        - test_users:write
        - discovery:read
        - discovery:write
        - license:read
        - supply_chain:read
        - supply_chain:write
        - billing:read
        - billing:write
        - containers:read
        - containers:write
        - logs:read
  responses:
    BadRequest:
      description: Bad request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Missing or invalid API token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: Resource not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: >-
        API token obtained from the Tokens endpoint or CLI device login. Include
        as `Authorization: Bearer <token>`. Requests made with a managed CLI
        session also include `X-Strix-Workspace: <organization_id>` to pin a
        process to the workspace it started in; recovery endpoints report the
        current workspace after a concurrent switch.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.