> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Update an existing finding in a repository.

> # Access control rules

- The requester must have access to the repository.
- Reviewers can update findings they and their team made.
- Clients, judges, triagers and admins can update any finding.

Note that what user can update what field (and to what value) depends on the
user's role, repository kind and status.



## OpenAPI

````yaml PATCH /api/v0/repositories/{repo_id}/findings/{finding_ref}
openapi: 3.1.0
info:
  title: Cantina Client API
  description: >-
    Endpoints available to client organizations. For an overview and
    authentication, see
    https://docs.cantina.xyz/for-organizations/getting-started/api-access.
  license:
    name: Cantina
    identifier: Cantina
  version: 0.1.0
servers: []
security: []
paths:
  /api/v0/repositories/{repo_id}/findings/{finding_ref}:
    patch:
      tags:
        - repositories
      summary: Update an existing finding in a repository.
      description: >-
        # Access control rules


        - The requester must have access to the repository.

        - Reviewers can update findings they and their team made.

        - Clients, judges, triagers and admins can update any finding.


        Note that what user can update what field (and to what value) depends on
        the

        user's role, repository kind and status.
      operationId: update_finding
      parameters:
        - name: repo_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
        - name: finding_ref
          in: path
          required: true
          schema:
            $ref: '#/components/schemas/FindingRef'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateFinding'
        required: true
      responses:
        '204':
          description: Finding updated
        '400':
          description: Update is invalid
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CantinaError'
        '401':
          description: Access not authorised
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CantinaError'
        '403':
          description: Access forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CantinaError'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CantinaError'
        '500':
          description: Error updating finding
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CantinaError'
components:
  schemas:
    FindingRef:
      oneOf:
        - type: string
          format: uuid
          description: Finding id.
        - type: integer
          format: int32
          description: Finding number.
      description: Reference to a finding, either a finding id or finding number.
    UpdateFinding:
      type: object
      properties:
        title:
          type:
            - string
            - 'null'
        description:
          type:
            - string
            - 'null'
        reward:
          type:
            - string
            - 'null'
        status:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/FindingStatus'
        fixedBy:
          type:
            - array
            - 'null'
          items:
            type: string
          description: >-
            When this field is set it overwrites the existing value, i.e. all
            URLs

            must be provided.
        duplicateOf:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/FindingRef'
              description: Only valid if the `status` is set to `duplicate`.
        duplicateGroup:
          type:
            - string
            - 'null'
          format: uuid
        severity:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/FindingSeverity'
        likelihood:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/FindingLikelihood'
        impact:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/FindingImpact'
        quality:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/FindingQuality'
              description: Can only be set by judges, triagers and admins.
        category:
          type:
            - string
            - 'null'
          description: Can only be set by admins.
        relatedFiles:
          type: array
          items:
            $ref: '#/components/schemas/UpdateFindingRelatedFile'
        labels:
          type: array
          items:
            $ref: '#/components/schemas/UpdateFindingLabels'
        assetGroup:
          oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/UpdateFindingAssetGroup'
        safeHarborAssetIds:
          type:
            - array
            - 'null'
          items:
            type: string
            format: uuid
        assignedTo:
          type:
            - string
            - 'null'
          format: uuid
          description: Assign the finding to a user by id.
        locked:
          type:
            - boolean
            - 'null'
          description: Update the locked state of the finding.
        note:
          type:
            - string
            - 'null'
          description: Note field for additional finding information.
    CantinaError:
      type: object
      description: Error returned by the Cantina API.
      required:
        - type
        - msg
      properties:
        type:
          $ref: '#/components/schemas/ErrorType'
        msg:
          type: string
          description: Error message for the user.
    FindingStatus:
      type: string
      description: |-
        Status of a [`Finding`].
        Note that the `in_review` status is only applicable within bounties.
      enum:
        - new
        - in_review
        - disputed
        - rejected
        - spam
        - duplicate
        - confirmed
        - acknowledged
        - fixed
        - withdrawn
    FindingSeverity:
      type: string
      description: Severity of a [`Finding`].
      enum:
        - critical
        - high
        - medium
        - low
        - informational
        - gas_optimization
    FindingLikelihood:
      type: string
      description: Likelihood of a [`Finding`].
      enum:
        - high
        - medium
        - low
    FindingImpact:
      type: string
      description: Impact of a [`Finding`].
      enum:
        - high
        - medium
        - low
    FindingQuality:
      type: string
      description: Quality of a [`Finding`].
      enum:
        - high
        - medium
        - low
    UpdateFindingRelatedFile:
      oneOf:
        - allOf:
            - $ref: '#/components/schemas/NewFindingRelatedFile'
              description: Add a new link between the finding and file.
            - type: object
              required:
                - action
              properties:
                action:
                  type: string
                  enum:
                    - add
          description: Add a new link between the finding and file.
        - type: object
          description: Delete an existing link between the finding and a file with `id`.
          required:
            - id
            - action
          properties:
            id:
              type: string
              format: uuid
            action:
              type: string
              enum:
                - delete
      description: Delete or add a related file to a finding.
    UpdateFindingLabels:
      oneOf:
        - type: object
          description: Add existing label to finding.
          required:
            - id
            - action
          properties:
            id:
              type: string
              format: uuid
            action:
              type: string
              enum:
                - add
        - type: object
          description: Delete existing label from finding.
          required:
            - id
            - action
          properties:
            id:
              type: string
              format: uuid
            action:
              type: string
              enum:
                - delete
      description: Delete or add labels to a finding.
    UpdateFindingAssetGroup:
      oneOf:
        - type: object
          description: >-
            Replaces an asset group with the specified assets to a finding.


            - If no assets exist on the finding, update it with
              the provided asset group and assets.
            - If the asset group is already associated with the finding, it
            replaces
              all the existing assets with the new set of assets.
            - If the finding already has a different asset group, both the asset
            group,
              and assets will be replaced by the new group and assets.
          required:
            - id
            - assetIds
            - action
          properties:
            id:
              type: string
              format: uuid
            assetIds:
              type: array
              items:
                type: string
                format: uuid
            action:
              type: string
              enum:
                - replace
        - type: object
          description: |-
            Removes an entire asset group and all
            its associated assets from a finding.
          required:
            - id
            - action
          properties:
            id:
              type: string
              format: uuid
            action:
              type: string
              enum:
                - delete
        - type: object
          description: |-
            Removes only the specified assets from
            an existing asset group in a finding.
          required:
            - assetIds
            - action
          properties:
            assetIds:
              type: array
              items:
                type: string
                format: uuid
            action:
              type: string
              enum:
                - delete_assets
      description: Delete or add asset groups to a finding.
    ErrorType:
      type: string
      description: Type of error.
      enum:
        - email_not_verified
        - auth_invalid
        - auth_expired
        - auth_token_missing
        - auth_id_missing
        - invalid_password
        - disabled_user
        - tc_not_accepted
        - evicted
        - unauthorized
        - bad_request
        - not_found
        - forbidden
        - gone
        - payload_too_large
        - service_unavailable
        - internal_error
    NewFindingRelatedFile:
      type: object
      required:
        - path
        - lines
      properties:
        path:
          type: string
        lines:
          $ref: '#/components/schemas/InclusiveRangeInt'
          description: The line(s) refered to in the comment.
    InclusiveRangeInt:
      type: object
      description: >-
        Represent a range where both the start and end are included in the
        range.
      required:
        - start
        - end
      properties:
        start:
          type: integer
          format: int32
        end:
          type: integer
          format: int32

````