Mute or unmute a batch of findings

Note: This endpoint is in public beta. If you have any feedback, contact Datadog support.

PATCH https://api.ap1.datadoghq.com/api/v2/posture_management/findingshttps://api.ap2.datadoghq.com/api/v2/posture_management/findingshttps://api.datadoghq.eu/api/v2/posture_management/findingshttps://api.ddog-gov.com/api/v2/posture_management/findingshttps://api.us2.ddog-gov.com/api/v2/posture_management/findingshttps://api.datadoghq.com/api/v2/posture_management/findingshttps://api.us3.datadoghq.com/api/v2/posture_management/findingshttps://api.us5.datadoghq.com/api/v2/posture_management/findings

Overview

Mute or unmute findings. This endpoint requires any of the following permissions:

  • security_monitoring_findings_write
  • appsec_vm_write

  • Request

    Body Data (required)

    Attributes

    All findings are updated with the same attributes. The request body must include at least two attributes: muted and reason. The allowed reasons depend on whether the finding is being muted or unmuted:

    • To mute a finding: PENDING_FIX, FALSE_POSITIVE, ACCEPTED_RISK, OTHER.
    • To unmute a finding : NO_PENDING_FIX, HUMAN_ERROR, NO_LONGER_ACCEPTED_RISK, OTHER.

    Meta

    The request body must include a list of the finding IDs to be updated.

    Expand All

    Field

    Type

    Description

    data [required]

    object

    Data object containing the new bulk mute properties of the finding.

    attributes [required]

    object

    The mute properties to be updated.

    mute [required]

    object

    Object containing the new mute properties of the findings.

    description

    string

    Additional information about the reason why those findings are muted or unmuted. This field has a maximum limit of 280 characters.

    expiration_date

    int64

    The expiration date of the mute or unmute action (Unix ms). It must be set to a value greater than the current timestamp. If this field is not provided, the finding will be muted or unmuted indefinitely, which is equivalent to setting the expiration date to 9999999999999.

    muted [required]

    boolean

    Whether those findings should be muted or unmuted.

    reason [required]

    enum

    The reason why this finding is muted or unmuted. Allowed enum values: PENDING_FIX,FALSE_POSITIVE,ACCEPTED_RISK,NO_PENDING_FIX,HUMAN_ERROR,NO_LONGER_ACCEPTED_RISK,OTHER

    id [required]

    string

    UUID to identify the request

    meta [required]

    object

    Meta object containing the findings to be updated.

    findings

    [object]

    Array of findings.

    finding_id

    string

    The unique ID for this finding.

    type [required]

    enum

    The JSON:API type for findings. Allowed enum values: finding

    default: finding

    {
      "data": {
        "attributes": {
          "mute": {
            "expiration_date": 1778721573794,
            "muted": true,
            "reason": "ACCEPTED_RISK"
          }
        },
        "id": "dbe5f567-192b-4404-b908-29b70e1c9f76",
        "meta": {
          "findings": [
            {
              "finding_id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw=="
            }
          ]
        },
        "type": "finding"
      }
    }

    Response

    OK

    The expected response schema.

    Expand All

    Field

    Type

    Description

    data [required]

    object

    Data object containing the ID of the request that was updated.

    id

    string

    UUID used to identify the request

    type

    enum

    The JSON:API type for findings. Allowed enum values: finding

    default: finding

    {
      "data": {
        "id": "93bfeb70-af47-424d-908a-948d3f08e37f",
        "type": "finding"
      }
    }

    Bad Request: The server cannot process the request due to invalid syntax in the request.

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
      "errors": [
        {
          "detail": "Missing required attribute in body",
          "meta": {},
          "source": {
            "header": "Authorization",
            "parameter": "limit",
            "pointer": "/data/attributes/title"
          },
          "status": "400",
          "title": "Bad Request"
        }
      ]
    }

    Forbidden: Access denied

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
      "errors": [
        {
          "detail": "Missing required attribute in body",
          "meta": {},
          "source": {
            "header": "Authorization",
            "parameter": "limit",
            "pointer": "/data/attributes/title"
          },
          "status": "400",
          "title": "Bad Request"
        }
      ]
    }

    Not Found: The requested finding cannot be found.

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
      "errors": [
        {
          "detail": "Missing required attribute in body",
          "meta": {},
          "source": {
            "header": "Authorization",
            "parameter": "limit",
            "pointer": "/data/attributes/title"
          },
          "status": "400",
          "title": "Bad Request"
        }
      ]
    }

    Invalid Request: The server understands the request syntax but cannot process it due to invalid data.

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
      "errors": [
        {
          "detail": "Missing required attribute in body",
          "meta": {},
          "source": {
            "header": "Authorization",
            "parameter": "limit",
            "pointer": "/data/attributes/title"
          },
          "status": "400",
          "title": "Bad Request"
        }
      ]
    }

    Too many requests: The rate limit set by the API has been exceeded.

    API error response.

    Expand All

    Field

    Type

    Description

    errors [required]

    [object]

    A list of errors.

    detail

    string

    A human-readable explanation specific to this occurrence of the error.

    meta

    object

    Non-standard meta-information about the error

    source

    object

    References to the source of the error.

    header

    string

    A string indicating the name of a single request header which caused the error.

    parameter

    string

    A string indicating which URI query parameter caused the error.

    pointer

    string

    A JSON pointer to the value in the request document that caused the error.

    status

    string

    Status code of the response.

    title

    string

    Short human-readable summary of the error.

    {
      "errors": [
        {
          "detail": "Missing required attribute in body",
          "meta": {},
          "source": {
            "header": "Authorization",
            "parameter": "limit",
            "pointer": "/data/attributes/title"
          },
          "status": "400",
          "title": "Bad Request"
        }
      ]
    }

    Code Example

                              ## default
    # 
    
    # Curl command
    curl -X PATCH "https://api.ap1.datadoghq.com"https://api.ap2.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.us2.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/posture_management/findings" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "data": { "attributes": { "mute": { "expiration_date": 1778721573794, "muted": true, "reason": "ACCEPTED_RISK" } }, "id": "dbe5f567-192b-4404-b908-29b70e1c9f76", "meta": { "findings": [ { "finding_id": "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" } ] }, "type": "finding" } } EOF
    // Mute or unmute a batch of findings returns "OK" response
    
    package main
    
    import (
    	"context"
    	"encoding/json"
    	"fmt"
    	"os"
    
    	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
    	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
    )
    
    func main() {
    	body := datadogV2.BulkMuteFindingsRequest{
    		Data: datadogV2.BulkMuteFindingsRequestData{
    			Attributes: datadogV2.BulkMuteFindingsRequestAttributes{
    				Mute: datadogV2.BulkMuteFindingsRequestProperties{
    					ExpirationDate: datadog.PtrInt64(1778721573794),
    					Muted:          true,
    					Reason:         datadogV2.FINDINGMUTEREASON_ACCEPTED_RISK,
    				},
    			},
    			Id: "dbe5f567-192b-4404-b908-29b70e1c9f76",
    			Meta: datadogV2.BulkMuteFindingsRequestMeta{
    				Findings: []datadogV2.BulkMuteFindingsRequestMetaFindings{
    					{
    						FindingId: datadog.PtrString("ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw=="),
    					},
    				},
    			},
    			Type: datadogV2.FINDINGTYPE_FINDING,
    		},
    	}
    	ctx := datadog.NewDefaultContext(context.Background())
    	configuration := datadog.NewConfiguration()
    	configuration.SetUnstableOperationEnabled("v2.MuteFindings", true)
    	apiClient := datadog.NewAPIClient(configuration)
    	api := datadogV2.NewSecurityMonitoringApi(apiClient)
    	resp, r, err := api.MuteFindings(ctx, body)
    
    	if err != nil {
    		fmt.Fprintf(os.Stderr, "Error when calling `SecurityMonitoringApi.MuteFindings`: %v\n", err)
    		fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
    	}
    
    	responseContent, _ := json.MarshalIndent(resp, "", "  ")
    	fmt.Fprintf(os.Stdout, "Response from `SecurityMonitoringApi.MuteFindings`:\n%s\n", responseContent)
    }
    

    Instructions

    First install the library and its dependencies and then save the example to main.go and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" go run "main.go"
    // Mute or unmute a batch of findings returns "OK" response
    
    import com.datadog.api.client.ApiClient;
    import com.datadog.api.client.ApiException;
    import com.datadog.api.client.v2.api.SecurityMonitoringApi;
    import com.datadog.api.client.v2.model.BulkMuteFindingsRequest;
    import com.datadog.api.client.v2.model.BulkMuteFindingsRequestAttributes;
    import com.datadog.api.client.v2.model.BulkMuteFindingsRequestData;
    import com.datadog.api.client.v2.model.BulkMuteFindingsRequestMeta;
    import com.datadog.api.client.v2.model.BulkMuteFindingsRequestMetaFindings;
    import com.datadog.api.client.v2.model.BulkMuteFindingsRequestProperties;
    import com.datadog.api.client.v2.model.BulkMuteFindingsResponse;
    import com.datadog.api.client.v2.model.FindingMuteReason;
    import com.datadog.api.client.v2.model.FindingType;
    import java.util.Collections;
    
    public class Example {
      public static void main(String[] args) {
        ApiClient defaultClient = ApiClient.getDefaultApiClient();
        defaultClient.setUnstableOperationEnabled("v2.muteFindings", true);
        SecurityMonitoringApi apiInstance = new SecurityMonitoringApi(defaultClient);
    
        BulkMuteFindingsRequest body =
            new BulkMuteFindingsRequest()
                .data(
                    new BulkMuteFindingsRequestData()
                        .attributes(
                            new BulkMuteFindingsRequestAttributes()
                                .mute(
                                    new BulkMuteFindingsRequestProperties()
                                        .expirationDate(1778721573794L)
                                        .muted(true)
                                        .reason(FindingMuteReason.ACCEPTED_RISK)))
                        .id("dbe5f567-192b-4404-b908-29b70e1c9f76")
                        .meta(
                            new BulkMuteFindingsRequestMeta()
                                .findings(
                                    Collections.singletonList(
                                        new BulkMuteFindingsRequestMetaFindings()
                                            .findingId(
                                                "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw=="))))
                        .type(FindingType.FINDING));
    
        try {
          BulkMuteFindingsResponse result = apiInstance.muteFindings(body);
          System.out.println(result);
        } catch (ApiException e) {
          System.err.println("Exception when calling SecurityMonitoringApi#muteFindings");
          System.err.println("Status code: " + e.getCode());
          System.err.println("Reason: " + e.getResponseBody());
          System.err.println("Response headers: " + e.getResponseHeaders());
          e.printStackTrace();
        }
      }
    }
    

    Instructions

    First install the library and its dependencies and then save the example to Example.java and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" java "Example.java"
    """
    Mute or unmute a batch of findings returns "OK" response
    """
    
    from datadog_api_client import ApiClient, Configuration
    from datadog_api_client.v2.api.security_monitoring_api import SecurityMonitoringApi
    from datadog_api_client.v2.model.bulk_mute_findings_request import BulkMuteFindingsRequest
    from datadog_api_client.v2.model.bulk_mute_findings_request_attributes import BulkMuteFindingsRequestAttributes
    from datadog_api_client.v2.model.bulk_mute_findings_request_data import BulkMuteFindingsRequestData
    from datadog_api_client.v2.model.bulk_mute_findings_request_meta import BulkMuteFindingsRequestMeta
    from datadog_api_client.v2.model.bulk_mute_findings_request_meta_findings import BulkMuteFindingsRequestMetaFindings
    from datadog_api_client.v2.model.bulk_mute_findings_request_properties import BulkMuteFindingsRequestProperties
    from datadog_api_client.v2.model.finding_mute_reason import FindingMuteReason
    from datadog_api_client.v2.model.finding_type import FindingType
    
    body = BulkMuteFindingsRequest(
        data=BulkMuteFindingsRequestData(
            attributes=BulkMuteFindingsRequestAttributes(
                mute=BulkMuteFindingsRequestProperties(
                    expiration_date=1778721573794,
                    muted=True,
                    reason=FindingMuteReason.ACCEPTED_RISK,
                ),
            ),
            id="dbe5f567-192b-4404-b908-29b70e1c9f76",
            meta=BulkMuteFindingsRequestMeta(
                findings=[
                    BulkMuteFindingsRequestMetaFindings(
                        finding_id="ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
                    ),
                ],
            ),
            type=FindingType.FINDING,
        ),
    )
    
    configuration = Configuration()
    configuration.unstable_operations["mute_findings"] = True
    with ApiClient(configuration) as api_client:
        api_instance = SecurityMonitoringApi(api_client)
        response = api_instance.mute_findings(body=body)
    
        print(response)
    

    Instructions

    First install the library and its dependencies and then save the example to example.py and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" python3 "example.py"
    # Mute or unmute a batch of findings returns "OK" response
    
    require "datadog_api_client"
    DatadogAPIClient.configure do |config|
      config.unstable_operations["v2.mute_findings".to_sym] = true
    end
    api_instance = DatadogAPIClient::V2::SecurityMonitoringAPI.new
    
    body = DatadogAPIClient::V2::BulkMuteFindingsRequest.new({
      data: DatadogAPIClient::V2::BulkMuteFindingsRequestData.new({
        attributes: DatadogAPIClient::V2::BulkMuteFindingsRequestAttributes.new({
          mute: DatadogAPIClient::V2::BulkMuteFindingsRequestProperties.new({
            expiration_date: 1778721573794,
            muted: true,
            reason: DatadogAPIClient::V2::FindingMuteReason::ACCEPTED_RISK,
          }),
        }),
        id: "dbe5f567-192b-4404-b908-29b70e1c9f76",
        meta: DatadogAPIClient::V2::BulkMuteFindingsRequestMeta.new({
          findings: [
            DatadogAPIClient::V2::BulkMuteFindingsRequestMetaFindings.new({
              finding_id: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
            }),
          ],
        }),
        type: DatadogAPIClient::V2::FindingType::FINDING,
      }),
    })
    p api_instance.mute_findings(body)
    

    Instructions

    First install the library and its dependencies and then save the example to example.rb and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" rb "example.rb"
    // Mute or unmute a batch of findings returns "OK" response
    use datadog_api_client::datadog;
    use datadog_api_client::datadogV2::api_security_monitoring::SecurityMonitoringAPI;
    use datadog_api_client::datadogV2::model::BulkMuteFindingsRequest;
    use datadog_api_client::datadogV2::model::BulkMuteFindingsRequestAttributes;
    use datadog_api_client::datadogV2::model::BulkMuteFindingsRequestData;
    use datadog_api_client::datadogV2::model::BulkMuteFindingsRequestMeta;
    use datadog_api_client::datadogV2::model::BulkMuteFindingsRequestMetaFindings;
    use datadog_api_client::datadogV2::model::BulkMuteFindingsRequestProperties;
    use datadog_api_client::datadogV2::model::FindingMuteReason;
    use datadog_api_client::datadogV2::model::FindingType;
    
    #[tokio::main]
    async fn main() {
        let body = BulkMuteFindingsRequest::new(BulkMuteFindingsRequestData::new(
            BulkMuteFindingsRequestAttributes::new(
                BulkMuteFindingsRequestProperties::new(true, FindingMuteReason::ACCEPTED_RISK)
                    .expiration_date(1778721573794),
            ),
            "dbe5f567-192b-4404-b908-29b70e1c9f76".to_string(),
            BulkMuteFindingsRequestMeta::new()
                .findings(vec![BulkMuteFindingsRequestMetaFindings::new().finding_id(
                    "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==".to_string(),
                )]),
            FindingType::FINDING,
        ));
        let mut configuration = datadog::Configuration::new();
        configuration.set_unstable_operation_enabled("v2.MuteFindings", true);
        let api = SecurityMonitoringAPI::with_config(configuration);
        let resp = api.mute_findings(body).await;
        if let Ok(value) = resp {
            println!("{:#?}", value);
        } else {
            println!("{:#?}", resp.unwrap_err());
        }
    }
    

    Instructions

    First install the library and its dependencies and then save the example to src/main.rs and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" cargo run
    /**
     * Mute or unmute a batch of findings returns "OK" response
     */
    
    import { client, v2 } from "@datadog/datadog-api-client";
    
    const configuration = client.createConfiguration();
    configuration.unstableOperations["v2.muteFindings"] = true;
    const apiInstance = new v2.SecurityMonitoringApi(configuration);
    
    const params: v2.SecurityMonitoringApiMuteFindingsRequest = {
      body: {
        data: {
          attributes: {
            mute: {
              expirationDate: 1778721573794,
              muted: true,
              reason: "ACCEPTED_RISK",
            },
          },
          id: "dbe5f567-192b-4404-b908-29b70e1c9f76",
          meta: {
            findings: [
              {
                findingId: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==",
              },
            ],
          },
          type: "finding",
        },
      },
    };
    
    apiInstance
      .muteFindings(params)
      .then((data: v2.BulkMuteFindingsResponse) => {
        console.log(
          "API called successfully. Returned data: " + JSON.stringify(data)
        );
      })
      .catch((error: any) => console.error(error));
    

    Instructions

    First install the library and its dependencies and then save the example to example.ts and run following commands:

        
    DD_SITE="datadoghq.comus3.datadoghq.comus5.datadoghq.comdatadoghq.euap1.datadoghq.comap2.datadoghq.comddog-gov.comus2.ddog-gov.com" DD_API_KEY="<DD_API_KEY>" DD_APP_KEY="<DD_APP_KEY>" tsc "example.ts"