reopen_finding
Reopen a previously mitigated finding to indicate remediation failure. Optionally provide a reason note. Requires engagement management permission.
Instructions
Reopen a previously mitigated finding. Requires engagement_mgmt permission — reopening signals remediation failure and is gated above finding_mgmt. Rate-limited. Args: finding_id (> 0), note (optional reason for reopening). Returns JSON with updated finding.
DOM-21 (Phase 14.2): when note is provided and the reopen succeeds but
the inner note-attach fails, the response includes a structured
_warning field of shape::
{"message": "<human-readable>", "note_attach_failed": true,
"finding_id": <int>}The note-attach failure is also emitted as a structured note_attach_failure
audit event for SIEM correlation. The reopen itself succeeded — only the
note attachment failed.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| note | No | ||
| finding_id | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |