Check connectivity to the DefectDojo instance. Returns JSON with status 'ok' or 'unhealthy' and a message.

List products in DefectDojo. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

Get a single product by ID. Args: product_id (must be > 0). Returns JSON with id, name, description, prod_type fields.

Create a new product. Requires write scope. Rate-limited. Args: name, description, prod_type_id (must be > 0). Returns JSON with created product.

List product types in DefectDojo. Use this to find valid prod_type_id values for create_product. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

List engagements for a product. Args: product_id (> 0), limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

Get a single engagement by ID. Args: engagement_id (must be > 0). Returns JSON with engagement fields.

Create a new engagement. Requires write scope. Rate-limited. Args: product_id (> 0), name, target_start (YYYY-MM-DD), target_end (YYYY-MM-DD). Returns JSON with created engagement.

List tests for an engagement. Args: engagement_id (> 0), limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

Get a single test by ID. Args: test_id (must be > 0). Returns JSON with test fields.

Create a new test. Requires write scope. Rate-limited. Args: engagement_id (> 0), test_type_id (> 0), target_start (YYYY-MM-DD), target_end (YYYY-MM-DD). Returns JSON with created test.

List test types in DefectDojo. Use this to find valid test_type_id values for create_test. Args: limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

List findings with optional filters. Args: test_id, product_id, engagement_id (all optional, > 0); severity (Critical/High/Medium/Low/Info); active, verified, duplicate, false_p, out_of_scope, is_mitigated, risk_accepted, outside_of_sla (all optional booleans); tags (optional list); component_name, title (optional strings); limit (1-100, default 20), offset (>= 0). Returns JSON with 'items' array and 'pagination' metadata.

DOM-19 (Phase 14.2): the has_jira parameter was removed from the signature entirely. Prior to v3.2.6 it was accepted-then-rejected at runtime because DefectDojo silently ignored it (F-007). Inspect jira_issue_url on each finding to determine Jira linkage.

Get a single finding by ID. Args: finding_id (must be > 0). Returns JSON with finding fields.

Create a new finding. Requires write scope. Rate-limited. Args: test_id (> 0), title, severity (Critical/High/Medium/Low/Info), description, active (default true), verified (default false). Returns JSON with created finding.

Update an existing finding. Requires write scope. Rate-limited. Args: finding_id (> 0), plus optional: title, severity (Critical/High/Medium/Low/Info), description, active, verified, false_p, duplicate, out_of_scope, is_mitigated. At least one field required. Returns JSON with updated finding. State-transition gate (F-008/F-018): mitigated→unmitigated cascades (active=true, explicit is_mitigated=false, or false_p/duplicate/out_of_scope flips) are rejected with a redirect to reopen_finding unless the caller's role bears engagement_mgmt (writer/admin).

Close a finding with a reason. Requires write scope. Rate-limited. Args: finding_id (> 0), reason (mitigated/false_positive/out_of_scope/duplicate), note (optional closure note). Returns JSON with updated finding.

DOM-21 (Phase 14.2): when note is provided and the close succeeds but the inner note-attach fails, the response includes a structured _warning field of shape::

{"message": "<human-readable>", "note_attach_failed": true,
 "finding_id": <int>}

The note-attach failure is also emitted as a structured note_attach_failure audit event for SIEM correlation. The close itself succeeded — only the note attachment failed.

Reopen a previously mitigated finding. Requires engagement_mgmt permission — reopening signals remediation failure and is gated above finding_mgmt. Rate-limited. Args: finding_id (> 0), note (optional reason for reopening). Returns JSON with updated finding.

DOM-21 (Phase 14.2): when note is provided and the reopen succeeds but the inner note-attach fails, the response includes a structured _warning field of shape::

{"message": "<human-readable>", "note_attach_failed": true,
 "finding_id": <int>}

The note-attach failure is also emitted as a structured note_attach_failure audit event for SIEM correlation. The reopen itself succeeded — only the note attachment failed.

Import a scan report into DefectDojo. Requires write scope. Rate-limited.

Add a note to a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), entry (note text), private (default false). Returns JSON with created note — the entry field is F-002 wrapped ({"value": ..., "_warning": "untrusted-content: ..."}) since Phase 12; disable via UNTRUSTED_CONTENT_WRAPPING=off (see DEC-027).

List notes for a finding. Args: finding_id (> 0). Returns universal envelope {"items": [...], "pagination": {...}} with note entry F-002 wrapped.

Add tags to a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), tags (non-empty list of strings, each <= 200 chars). Returns JSON with tags array.

Remove tags from a finding. Requires write scope. Rate-limited. Args: finding_id (> 0), tags (non-empty list of tag strings to remove). Returns JSON with tags array.

Re-import a scan report into an existing test in DefectDojo. Requires write scope. Rate-limited.