Record Finding Triage Decision
findings_triageDestructive
Record a tenant-scoped triage decision for a vulnerability, specifying decision, justification, and optional expiry to update the exception store.
Instructions
Record a tenant-scoped finding triage decision to the exception store.
Writes the same entry as the REST ``POST /v1/findings/triage`` endpoint.
Requires an admin operator + ``findings:write`` scope. A ``not_affected``
decision requires an OpenVEX ``justification``.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | Human audit reason for recording the decision. | |
| package | No | Affected package name, or '*' for all packages (default). | * |
| assignee | No | Owner recorded for the triage entry. | |
| decision | No | Decision: under_investigation, affected, or not_affected. | under_investigation |
| tenant_id | No | Tenant scope for the triage entry and audit logging. | default |
| expires_at | No | Optional ISO-8601 expiry for the triage entry. | |
| queue_state | No | Queue state: open, assigned, reviewing, or decided. | open |
| server_name | No | Optional MCP server / asset scope for the decision. | |
| justification | No | OpenVEX justification (required for not_affected), e.g. vulnerable_code_not_present. | |
| operator_role | No | Operator role for this write action (audit). | viewer |
| decision_reason | No | Free-text rationale for the decision. | |
| operator_scopes | No | Comma-separated operator scopes (audit). | |
| vulnerability_id | No | Vulnerability/advisory id being triaged (e.g. CVE-2024-1234). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |