Skip to main content
POST
/
api
/
v1
/
deployments
/
{deploymentSlug}
/
triage
Bulk triage
curl --request POST \
  --url https://semgrep.dev/api/v1/deployments/{deploymentSlug}/triage \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "issue_type": "sca",
  "autotriage_verdict": "true_positive",
  "categories": [
    "security",
    "performance"
  ],
  "component_tags": [
    "user authentication",
    "user data"
  ],
  "confidence": "high",
  "dependencies": [
    "lodash",
    "express"
  ],
  "deploymentSlug": "<string>",
  "epss_probability": [
    "high",
    "medium"
  ],
  "exposures": [
    "reachable",
    "always_reachable"
  ],
  "include_historical": true,
  "issue_ids": [
    123,
    456
  ],
  "limit": 100,
  "new_note": "some note here",
  "new_triage_reason": "acceptable_risk",
  "new_triage_state": "reopened",
  "policies": [
    "rule-board-block",
    "rule-board-pr-comments",
    "rule-board-audit"
  ],
  "policy_mode": [
    "monitor",
    "block"
  ],
  "pro_only": true,
  "project_tags": [
    "my_project_tag_1",
    "my_project_tag_2"
  ],
  "ref": "refs/pull/1234/merge",
  "repos": [
    "myorg/repo1",
    "myorg/repo2"
  ],
  "repository_visibility": [
    "public",
    "private"
  ],
  "rules": [
    "typescript.react.security.audit.react-no-refs.react-no-refs",
    "ajinabraham.njsscan.hardcoded_secrets.node_username"
  ],
  "ruleset": [
    "owasp-top-ten",
    "default"
  ],
  "secret_types": [
    "Github",
    "Heroku",
    "AWS"
  ],
  "severities": [
    "low",
    "high"
  ],
  "since": 1717334400,
  "status": "open",
  "transitivities": [
    "transitive",
    "direct"
  ],
  "triage_reasons": [
    "acceptable_risk",
    "false_positive"
  ],
  "validation_state": [
    "valid",
    "invalid"
  ]
}
'
{
  "num_triaged": 123,
  "triaged_issues": [
    123
  ]
}

Documentation Index

Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
Authorization
string
header
required

Get access to data with your API token. Example header:

Authorization: Bearer 2991e2fb4b540fe75b8f90677b0b892b6314e4961cb001fe6eb452eee248a628

The token can be provisioned from the Tokens section in your Settings, and requires explicitly enabling Web API access.

Path Parameters

​
deploymentSlug
string
required

Deployment slug. Can be found at /deployments, or in your Settings in the web UI.

Body

application/json
​
issue_type
enum<string>
required

Type of findings to bulk triage.

Available options:
sast,
sca,
secrets
Example:

"sca"

​
autotriage_verdict
enum<string>

The autotriage verdict to filter by

Available options:
true_positive,
false_positive
Example:

"true_positive"

​
categories
string[]

List of categories to filter by

Example:
["security", "performance"]
​
component_tags
string[]

List of component tags to filter by

Example:
["user authentication", "user data"]
​
confidence
enum<string>

List of confidence levels to filter by

Available options:
low,
medium,
high
Example:

"high"

​
dependencies
string[]

Filter by dependency name. Only applies for sca findings.

Example:
["lodash", "express"]
​
deploymentSlug
string

Deployment slug. Can be found at /deployments, or in your Settings in the web UI.

​
epss_probability
string[]

Filter by EPSS probability (likelihood of exploit). Only applies for sca findings.

Example:
["high", "medium"]
​
exposures
string[]

Filter by exposure (reachability type). Only applies for sca findings. Reachability is the ability of an attacker to access a vulnerability in a system.

Example:
["reachable", "always_reachable"]
​
include_historical
boolean

Whether to include historical findings. Only applies for secrets findings. Defaults to true.

Example:

true

​
issue_ids
integer<uint32>[]

An array of issue IDs to act on. If this is not provided, an issue filter should be provided.

Example:
[123, 456]
​
limit
integer<uint32>
default:3000

Max number of issues to triage. Must be an integer between 1 and 3000. Defaults to 3000. When selecting findings to triage, Semgrep will also triage findings with the same fingerprint on other branches. As a result, the list of triaged issue_ids returned in the response may be higher than the specified limit.

Example:

100

​
new_note
string

The note to attach to the bulk triaged findings.

Example:

"some note here"

​
new_triage_reason
enum<string>

The reason for triaging to a given triage state.

Available options:
acceptable_risk,
false_positive,
no_time,
no_triage_reason
Example:

"acceptable_risk"

​
new_triage_state
enum<string>

The triage state you would like to bulk triage your findings to.

Available options:
ignored,
reviewing,
fixing,
reopened
Example:

"reopened"

​
policies
string[]

List of policy modes to filter by

Example:
[
  "rule-board-block",
  "rule-board-pr-comments",
  "rule-board-audit"
]
​
policy_mode
string[]

List of policy modes to filter by

Example:
["monitor", "block"]
​
pro_only
boolean

Filter by whether a finding is only available with Semgrep Pro features. Only applies for sast findings.

Example:

true

​
project_tags
string[]

List of project tags to filter by

Example:
["my_project_tag_1", "my_project_tag_2"]
​
ref
string

Branch reference to filter by

Example:

"refs/pull/1234/merge"

​
repos
string[]

List of repository names to filter by

Example:
["myorg/repo1", "myorg/repo2"]
​
repository_visibility
string[]

Filter by repository visibility. Only applies for secrets findings.

Example:
["public", "private"]
​
rules
string[]

List of rule names to filter by

Example:
[
  "typescript.react.security.audit.react-no-refs.react-no-refs",
  "ajinabraham.njsscan.hardcoded_secrets.node_username"
]
​
ruleset
string[]

List of Semgrep Registry rulesets to filter by

Example:
["owasp-top-ten", "default"]
​
secret_types
string[]

Filter by type of secret (typically provider-related). Only applies for secrets findings.

Example:
["Github", "Heroku", "AWS"]
​
severities
string[]

List of severities to filter by

Example:
["low", "high"]
​
since
string

Epoch timestamp in seconds. Filters using the relevant_since field: the timestamp when this finding was detected by Semgrep (the first time, or when reintroduced).

Example:

1717334400

​
status
enum<string>

The status to filter by

Available options:
open,
fixed,
ignored,
reviewing,
fixing
Example:

"open"

​
transitivities
string[]

Filter by transitivity of a dependency. Only applies for sca findings.

Example:
["transitive", "direct"]
​
triage_reasons
string[]

List of triage reasons to filter by

Example:
["acceptable_risk", "false_positive"]
​
validation_state
string[]

Filter by whether a secret could be validated. Only applies for secrets findings.

Example:
["valid", "invalid"]

Response

200 - application/json

OK

​
num_triaged
integer<uint32>
required

Number of items updated

​
triaged_issues
integer<uint32>[]
required

List of triaged issue IDs