Language

English Français 日本語 한국어 Español

Datadog Site

Site help
US1 US3 US5 EU AP1 AP2 US1-FED US2-FED

Assign or unassign security findings

Note: This endpoint is in preview and is subject to change. If you have any feedback, contact Datadog support.

PATCH https://api.ap1.datadoghq.com/api/v2/security/findings/assigneehttps://api.ap2.datadoghq.com/api/v2/security/findings/assigneehttps://api.datadoghq.eu/api/v2/security/findings/assigneehttps://api.ddog-gov.com/api/v2/security/findings/assigneehttps://api.us2.ddog-gov.com/api/v2/security/findings/assigneehttps://api.datadoghq.com/api/v2/security/findings/assigneehttps://api.us3.datadoghq.com/api/v2/security/findings/assigneehttps://api.us5.datadoghq.com/api/v2/security/findings/assignee

Overview

Assign or unassign security findings. You can assign up to 100 security findings per request. Set assignee_id to the unique identifier of the Datadog user you want to assign the findings to. Omit assignee_id (or set it to null) to unassign the findings. Per-finding warnings and failures are returned in the response meta object. This endpoint requires any of the following permissions:

  • security_monitoring_findings_write
  • appsec_vm_write

    • Request

    Body Data (required)

    Expand All

    Field

    Type

    Description

    data [required]

    object

    Data of the assignee request.

    attributes

    object

    Attributes of the assignee request.

    assignee_id

    string

    Unique identifier of the Datadog user to assign the security findings to. If this field is not provided, the security findings are unassigned.

    id

    string

    Unique identifier of the assignee request.

    relationships [required]

    object

    Relationships of the assignee request.

    findings [required]

    object

    Security findings to assign or unassign.

    data

    [object]

    Array of security finding data objects.

    id [required]

    string

    Unique identifier of the security finding.

    type [required]

    enum

    Security findings resource type. Allowed enum values: findings

    default: findings

    type [required]

    enum

    Assignee resource type. Allowed enum values: assignee

    default: assignee

    {
  "data": {
    "attributes": {
      "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0"
    },
    "id": "00000000-0000-0000-0000-000000000001",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
            "type": "findings"
          }
        ]
      }
    },
    "type": "assignee"
  }
}

    Response

    Accepted

    Response for the assign or unassign request.

    Expand All

    Field

    Type

    Description

    data [required]

    object

    Data of the assignee response.

    attributes [required]

    object

    Attributes of the assignee response.

    assignee_id

    string

    Unique identifier of the Datadog user assigned to the security findings. Omitted when the findings were unassigned.

    id [required]

    string

    Unique identifier of the assignee request.

    type [required]

    enum

    Assignee resource type. Allowed enum values: assignee

    default: assignee

    meta

    object

    Per-finding warnings and failures produced while processing the bulk assignee request.

    failures

    [object]

    Findings that could not be assigned or unassigned.

    detail [required]

    string

    Human-readable explanation of the outcome.

    finding_id [required]

    string

    Unique identifier of the security finding.

    status [required]

    int32

    HTTP-like status code describing the outcome for this finding.

    title [required]

    string

    Short label describing the outcome for this finding.

    warnings

    [object]

    Findings for which the assignment succeeded but a non-critical error occurred during processing.

    detail [required]

    string

    Human-readable explanation of the outcome.

    finding_id [required]

    string

    Unique identifier of the security finding.

    status [required]

    int32

    HTTP-like status code describing the outcome for this finding.

    title [required]

    string

    Short label describing the outcome for this finding.

    {
  "data": {
    "attributes": {
      "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0"
    },
    "id": "00000000-0000-0000-0000-000000000001",
    "type": "assignee"
  },
  "meta": {
    "failures": [
      {
        "detail": "failed to update finding assignee",
        "finding_id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
        "status": 500,
        "title": "Internal Server Error"
      }
    ],
    "warnings": [
      {
        "detail": "failed to update finding assignee",
        "finding_id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
        "status": 500,
        "title": "Internal Server Error"
      }
    ]
  }
}

    Bad Request

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
  "errors": [
    "Bad Request"
  ]
}

    Not Found

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
  "errors": [
    "Bad Request"
  ]
}

    Too many requests

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [string]

    A list of errors.

    {
  "errors": [
    "Bad Request"
  ]
}

    Code Example

                      ## default
# 

    # Curl command
    curl -X PATCH "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/security/findings/assignee" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "DD-API-KEY: ${DD_API_KEY}" \
-H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "assignee_id": "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0"
    },
    "id": "00000000-0000-0000-0000-000000000001",
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
            "type": "findings"
          }
        ]
      }
    },
    "type": "assignee"
  }
}
EOF