List findings with optional filters.

Args: severity: Filter by severity (Critical, High, Medium, Low, Info) active: Filter active findings only verified: Filter verified findings only is_mitigated: Filter mitigated findings duplicate: Filter duplicates false_positive: Filter false positives (false_p) out_of_scope: Filter out-of-scope findings risk_accepted: Filter findings under an active risk acceptance test_id: Filter by test ID engagement_id: Filter by engagement ID (via test__engagement) product_id: Filter by product (asset) ID (via test__engagement__product) product_name: Filter by product (asset) name (server-side contains) title: Filter by title (server-side contains) title_exact: Filter by exact title cwe: Filter by CWE number vulnerability_id: Filter by CVE/vulnerability ID (e.g. CVE-2024-1234) reporter_id: Filter by reporter user ID mitigated_by_id: Filter by the user who mitigated outside_of_sla: Filter findings outside SLA tag: Filter by tag name (contains) ordering: Ordering fields (e.g. "-severity", "created", "-date") limit: Number of results per page (default 25) offset: Pagination offset

Get a single finding by ID.

Args: finding_id: The finding ID

Create a new finding.

Args: title: Finding title severity: Severity level (Critical, High, Medium, Low, Info) test_id: ID of the test this finding belongs to description: Detailed description mitigation: Recommended mitigation impact: Impact description steps_to_reproduce: Steps to reproduce references: External references cwe: CWE identifier number active: Whether finding is active (default True) verified: Whether finding is verified (default False) numerical_severity: Numeric severity (S0-S4) line: Source code line number file_path: Source file path component_name: Affected component component_version: Component version static_finding: Is static analysis finding dynamic_finding: Is dynamic analysis finding tags: List of tags

Update an existing finding (partial update).

Args: finding_id: The finding ID title: New title severity: New severity description: New description mitigation: New mitigation text impact: New impact text active: Set active status verified: Set verified status is_mitigated: Set mitigated status tags: Replace tags

Mark a finding as verified.

Args: finding_id: The finding ID to verify

Get duplicate findings for a given finding.

Args: finding_id: The finding ID

Reset the duplicate status of a finding.

Args: finding_id: The finding ID

List notes for a finding (ordered newest first).

Args: finding_id: The finding ID

Add a note to a finding.

Args: finding_id: The finding ID entry: Note text content private: Whether the note is private (visible only to you and superusers) note_type: Note type ID (see list_note_types)

Remove a note from a finding.

Args: finding_id: The finding ID note_id: The note ID to remove (see list_finding_notes)

List metadata key-value pairs for a finding.

Args: finding_id: The finding ID

Add metadata to a finding.

Args: finding_id: The finding ID name: Metadata key name value: Metadata value

Delete a finding.

Args: finding_id: The finding ID to delete

List available note types (usable in add_finding_note / close_finding).

Args: name: Filter by name (contains) limit: Results per page (default 25) offset: Pagination offset

Close a finding. Requires closure_type; use the dedicated tools below when unsure.

Prefer the semantic aliases:

• close_finding_false_positive(finding_id, note)

• close_finding_mitigated(finding_id, note)

• close_finding_duplicate(finding_id, duplicate_of)

Args: finding_id: The finding ID to close closure_type: One of "false_positive", "mitigated", "duplicate" note: Optional note recorded on the finding at closure time note_type: Optional note type ID (see list_note_types) mitigated: Mitigation datetime (ISO 8601, defaults to now) out_of_scope: Mark finding as out of scope (only meaningful with closure_type="false_positive") duplicate: Mark finding as duplicate (only meaningful with closure_type="duplicate")

Close a finding as a false positive (and optionally out of scope).

Args: finding_id: The finding ID to close note: Why this is a false positive (recommended) note_type: Optional note type ID (see list_note_types) out_of_scope: Also mark the finding as out of scope

Close a finding because the vulnerability was remediated (fix applied).

Args: finding_id: The finding ID to close note: How/where it was fixed (recommended) note_type: Optional note type ID (see list_note_types) mitigated: Mitigation datetime (ISO 8601, defaults to now server-side)

Close a finding as duplicate of another finding.

Args: finding_id: The finding ID to close duplicate_of: The ID of the original (canonical) finding note: Optional note

Reopen (reactivate) a closed/mitigated finding.

Clears the mitigated state and any false-positive/duplicate/out-of-scope flags unless explicitly restored.

Args: finding_id: The finding ID to reopen note: Optional note explaining the reopening restore_false_positive: Keep the false_p flag as-is instead of clearing it restore_out_of_scope: Keep the out_of_scope flag as-is instead of clearing it

Accept the risk of one or more findings (risk acceptance with mandatory expiration date).

Creates a RiskAcceptance object. The expiration date is MANDATORY: findings are reactivated automatically when it passes (unless reactivate_expired=False). Risk acceptance is discouraged in favor of fixing; always require an explicit business justification and a named approver.

Args: finding_ids: List of finding IDs to accept accepted_by: Name/email of the person accepting the risk justification: Business justification for accepting expiration_date: Mandatory expiration (ISO date "YYYY-MM-DD" or full ISO datetime). Must be in the future. decision: Risk treatment by risk owner: A=Accept, V=Avoid, M=Mitigate, F=Fix, T=Transfer decision_details: Details of the decision / compensating controls recommendation: Security team recommendation: A=Accept, V=Avoid, M=Mitigate, F=Fix, T=Transfer recommendation_details: Details of the recommendation reactivate_expired: Reactivate findings when the acceptance expires (default True) restart_sla_expired: Restart SLA when the acceptance expires (default False) owner_id: Owner user ID (defaults to the authenticated user) name: Acceptance name (defaults to "Risk acceptance ( findings)")

Bulk accept risk for findings matching vulnerability IDs (CVEs).

Uses the native /findings/accept_risks/ endpoint: matches findings by vulnerability_id (CVE) inside the CURRENT engagement context. Use accept_risk() instead when you need explicit finding IDs and an expiration date.

Args: vulnerability_ids: CVE or advisory IDs (e.g. ["CVE-2024-1234"]) accepted_by: Name/email of the person accepting the risk justification: Justification for accepting findings with these vulnerability IDs

Expire a risk acceptance early (reactivates its findings).

Args: risk_acceptance_id: The risk acceptance ID reason: Optional reason for expiring

Reinstate an expired risk acceptance with a new (mandatory) expiration date.

Args: risk_acceptance_id: The risk acceptance ID expiration_date: New expiration date (YYYY-MM-DD or ISO datetime), must be in the future reason: Optional reason

List products (assets) with optional filters.

Args: name: Filter by name (contains) name_exact: Filter by exact name organization_id: Filter by organization (product type) ID lifecycle: Filter by lifecycle (construction, production, retirement) tag: Filter by tag name (contains) external_audience: Filter by external audience flag internet_accessible: Filter by internet accessible flag limit: Results per page (default 25) offset: Pagination offset

Get a single product by ID.

Args: product_id: The product ID

Create a new product (asset).

Args: name: Product name organization_id: Organization (product type) ID description: Product description lifecycle: Lifecycle stage (construction, production, retirement) platform: Platform (web service, desktop, iot, mobile, web) origin: Origin (third party library, purchased, contractor, internal, open source, outsourced) business_criticality: Business criticality (very high, high, medium, low, very low, none) external_audience: Has external audience internet_accessible: Is internet accessible tags: List of tags

Update an existing product (partial update).

Args: product_id: The product ID name: New name description: New description lifecycle: New lifecycle stage business_criticality: New business criticality tags: Replace tags

Delete a product.

Args: product_id: The product ID to delete

List engagements with optional filters.

Args: product_id: Filter by product ID name: Filter by name (contains) status: Filter by status (Not Started, In Progress, Completed) engagement_type: Filter by type (Interactive, CI/CD) tag: Filter by tag name limit: Results per page (default 25) offset: Pagination offset

Get a single engagement by ID.

Args: engagement_id: The engagement ID

Create a new engagement.

Args: name: Engagement name product_id: Product ID this engagement belongs to target_start: Target start date (YYYY-MM-DD) target_end: Target end date (YYYY-MM-DD) engagement_type: Type (Interactive or CI/CD) status: Status (Not Started, In Progress, Completed) description: Description lead_id: Lead user ID build_id: Build identifier commit_hash: Commit hash branch_tag: Branch or tag name source_code_management_uri: SCM URI deduplication_on_engagement: Dedupe scoped to engagement tags: List of tags

Update an existing engagement (partial update).

Args: engagement_id: The engagement ID name: New name status: New status (Not Started, In Progress, Completed) description: New description target_start: New target start date target_end: New target end date tags: Replace tags

Close an engagement.

Args: engagement_id: The engagement ID to close

Delete an engagement.

Args: engagement_id: The engagement ID to delete

List notes for an engagement.

Args: engagement_id: The engagement ID

Add a note to an engagement.

Args: engagement_id: The engagement ID entry: Note text content private: Whether the note is private

List tests with optional filters.

Args: engagement_id: Filter by engagement ID product_id: Filter by product ID (via engagement__product) test_type: Filter by test type ID tag: Filter by tag name (contains) title: Filter by title (contains) limit: Results per page (default 25) offset: Pagination offset

Get a single test by ID.

Args: test_id: The test ID

Create a new test.

Args: engagement_id: Engagement ID this test belongs to test_type_id: Test type ID target_start: Target start datetime (YYYY-MM-DD or ISO format) target_end: Target end datetime title: Test title description: Test description lead_id: Lead user ID environment_id: Environment ID version: Version string branch_tag: Branch or tag build_id: Build identifier commit_hash: Commit hash tags: List of tags

Update an existing test (partial update).

Args: test_id: The test ID title: New title description: New description version: New version tags: Replace tags

Delete a test.

Args: test_id: The test ID to delete

List available test types (scan types).

Args: name: Filter by name (contains) limit: Results per page offset: Pagination offset

List notes for a test.

Args: test_id: The test ID

Add a note to a test.

Args: test_id: The test ID entry: Note text content private: Whether the note is private

Import a scan report into DefectDojo.

Either engagement_id OR (product_name + auto_create_context=True) must be provided. Either file_path (local file) or scan_data (raw content) must be provided.

Args: scan_type: Scanner type (e.g., "ZAP Scan", "Nessus Scan", "SARIF", "Trivy Scan", etc.) file_path: Path to the scan results file on the local filesystem scan_data: Raw scan data as string (alternative to file_path) engagement_id: Target engagement ID product_name: Product name (for auto-create context) product_type_name: Product type name (for auto-create context) engagement_name: Engagement name (for auto-create context) test_title: Custom test title auto_create_context: Auto-create product/engagement if they don't exist active: Mark findings as active verified: Mark findings as verified close_old_findings: Close findings not present in new scan close_old_findings_product_scope: Close at product scope push_to_jira: Push findings to JIRA minimum_severity: Minimum severity to import (Info, Low, Medium, High, Critical) deduplication_on_engagement: Deduplicate within engagement environment: Environment name version: Version being scanned build_id: Build ID branch_tag: Branch or tag commit_hash: Commit hash service: Service name group_by: Group findings by (component_name, component_name+component_version, file_path) tags: Tags to apply

Reimport a scan report (update existing test with new results).

Either test_id OR (product_name + test_title + auto_create_context) must be provided. Either file_path or scan_data must be provided.

Args: scan_type: Scanner type (e.g., "ZAP Scan", "Nessus Scan", "SARIF", etc.) test_id: Existing test ID to reimport into file_path: Path to the scan results file scan_data: Raw scan data as string product_name: Product name (for auto-create context) product_type_name: Product type name (for auto-create context) engagement_name: Engagement name (for auto-create context) test_title: Test title (for matching existing test) auto_create_context: Auto-create context if it doesn't exist active: Mark findings as active verified: Mark findings as verified close_old_findings: Close findings not in new scan (default True) close_old_findings_product_scope: Close at product scope push_to_jira: Push to JIRA minimum_severity: Minimum severity do_not_reactivate: Don't reactivate closed findings environment: Environment name version: Version being scanned build_id: Build ID branch_tag: Branch or tag commit_hash: Commit hash service: Service name group_by: Group findings by field tags: Tags to apply

List organizations (product types).

Args: name: Filter by name (contains) limit: Results per page (default 25) offset: Pagination offset

Get a single organization by ID.

Args: organization_id: The organization (product type) ID

Create a new organization (product type).

Args: name: Organization name description: Description critical_product: Is critical product flag key_product: Is key product flag

Update an organization (partial update).

Args: organization_id: The organization ID name: New name description: New description

Delete an organization.

Args: organization_id: The organization ID to delete

List users with optional filters.

Args: username: Filter by username (contains) first_name: Filter by first name last_name: Filter by last name is_active: Filter by active status is_superuser: Filter by superuser status limit: Results per page offset: Pagination offset

Get a single user by ID.

Args: user_id: The user ID

Get the currently authenticated user's profile.

Create a new user.

Args: username: Username first_name: First name last_name: Last name email: Email address is_active: Active status is_superuser: Superuser status

Update a user (partial update).

Args: user_id: The user ID first_name: New first name last_name: New last name email: New email is_active: Set active status

Delete a user.

Args: user_id: The user ID to delete

List endpoints with optional filters.

Args: product_id: Filter by product ID host: Filter by host (contains) protocol: Filter by protocol path: Filter by path (contains) tag: Filter by tag limit: Results per page offset: Pagination offset

Get a single endpoint by ID.

Args: endpoint_id: The endpoint ID

List endpoint statuses (relationship between endpoints and findings).

Args: endpoint_id: Filter by endpoint ID finding_id: Filter by finding ID mitigated: Filter by mitigated status limit: Results per page offset: Pagination offset

List configured JIRA instances.

Args: limit: Results per page offset: Pagination offset

Get a JIRA instance configuration by ID.

Args: instance_id: The JIRA instance ID

List JIRA project configurations.

Args: product_id: Filter by product ID engagement_id: Filter by engagement ID limit: Results per page offset: Pagination offset

List JIRA finding mappings (links between findings and JIRA issues).

Args: finding_id: Filter by finding ID jira_key: Filter by JIRA issue key limit: Results per page offset: Pagination offset

Create a new JIRA instance configuration.

Args: url: JIRA instance URL username: JIRA username password: JIRA API token or password default_issue_type: Default issue type for new issues epic_name_id: Custom field ID for epic name open_status_key: Transition ID for opening issues close_status_key: Transition ID for closing issues info_mapping_severity: JIRA priority for Info severity low_mapping_severity: JIRA priority for Low severity medium_mapping_severity: JIRA priority for Medium severity high_mapping_severity: JIRA priority for High severity critical_mapping_severity: JIRA priority for Critical severity

Get DefectDojo system settings.

Update system settings (partial update).

Args: settings_id: Settings ID (usually 1) **kwargs: Key-value pairs of settings to update

Get Celery worker and queue status.

Returns worker liveness, pending queue length, and configuration.

Get per-task breakdown of the Celery queue.

Returns task names, counts, and queue positions. May be slow for large queues.

Purge all pending Celery tasks from the queue.

Tasks already being executed are not affected. Use with caution - this removes ALL pending tasks.

Purge all queued instances of a specific Celery task.

Args: task_name: The task name to purge (e.g., "dojo.tasks.async_update")

List risk acceptances.

Args: finding_id: Filter by an accepted finding ID owner_id: Filter by owner user ID name_contains: Filter by name (contains) accepted_by: Filter by acceptor name/email (contains) limit: Results per page offset: Pagination offset

Get a risk acceptance by ID.

Args: risk_acceptance_id: The risk acceptance ID

Create a new risk acceptance (low-level: prefer accept_risk, which enforces expiration).

Args: name: Risk acceptance name owner_id: Owner user ID accepted_findings: List of finding IDs to accept recommendation: Security recommendation code (A, V, M, F, T) recommendation_details: Details about the recommendation decision: Risk treatment decision code (A, V, M, F, T) decision_details: Details about the decision / compensating controls expiration_date: Expiration date (YYYY-MM-DD or ISO datetime; mandatory in accept_risk) accepted_by: Name/email of the person accepting the risk reactivate_expired: Reactivate findings when the acceptance expires (default True) restart_sla_expired: Restart SLA when the acceptance expires (default False)

Update a risk acceptance (partial update, e.g. extend expiration).

Args: risk_acceptance_id: The risk acceptance ID expiration_date: New expiration date (YYYY-MM-DD or ISO datetime) decision: Risk treatment decision code (A, V, M, F, T) decision_details: Details about the decision recommendation: Security recommendation code (A, V, M, F, T) recommendation_details: Details about the recommendation reactivate_expired: Reactivate findings on expiration restart_sla_expired: Restart SLA on expiration

Delete a risk acceptance.

Args: risk_acceptance_id: The risk acceptance ID

List notification configurations.

Args: limit: Results per page offset: Pagination offset

List SLA configurations.

Args: limit: Results per page offset: Pagination offset