Modify Data

API	Description
POST /api/updateIssueStatus	Update the status of an issue or vulnerability found in scan results.
POST /api/bulkUpdateIssueStatus	Bulk updates the status of multiple issues at once.
POST /api/bulkUpdateIssueSeverity	Bulk updates the severity level of multiple issues.
POST /api/setFalsePositives	Marks one or more issues as false positives.
POST /api/updateIssueDescription	Updates the description or notes for a specific issue.
POST /api/generateThreatReport	Generates a threat report based on current scan data and filters.

POST request for endpoint /api/updateIssueStatus

post

Header parameters

content-typestringOptionalExample: application/json

X-API-KEYstringOptionalExample: YOUR_API_KEY from Settings > Integrations > Akto APIs

Body

application/json

Sample description

ignoreReasonstringOptionalExample: No time to fix

statusToBeUpdatedstringOptionalExample: IGNORED

Responses

200

description

application/json

Sample description

filterSubCategorystringOptionalExample: null

vulnerableRequestsstringOptionalExample: null

filterCollectionsIdstringOptionalExample: null

similarlyAffectedIssuesstringOptionalExample: null

filterStatusstringOptionalExample: null

skipinteger · int32OptionalExample: 0

filterSeveritystringOptionalExample: null

startEpochinteger · int32OptionalExample: 0

issueIdArraystringOptionalExample: null

testSourceConfigsstringOptionalExample: null

issuesstringOptionalExample: null

subCategoriesstringOptionalExample: null

totalIssuesCountinteger · int32OptionalExample: 0

testingRunResultstringOptionalExample: null

ignoreReasonstringOptionalExample: null

limitinteger · int32OptionalExample: 0

categoriesstringOptionalExample: null

statusToBeUpdatedstringOptionalExample: OPEN

post/api/updateIssueStatus

HTTPcURLJavaScriptPython

POST /api/updateIssueStatus HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 318

{
  "issueId": {
    "testSubCategory": "REMOVE_TOKENS",
    "testErrorSource": "AUTOMATED_TESTING",
    "testCategoryFromSourceConfig": "null",
    "apiInfoKey": {
      "method": "GET",
      "apiCollectionId": 1679462413,
      "url": "http://localhost:8080/api/updateProfile"
    },
    "testSourceConfig": "null"
  },
  "ignoreReason": "No time to fix",
  "statusToBeUpdated": "IGNORED"
}

200

description

{
  "filterSubCategory": "null",
  "vulnerableRequests": "null",
  "issueId": {
    "testSubCategory": "REMOVE_TOKENS",
    "testErrorSource": "AUTOMATED_TESTING",
    "testCategoryFromSourceConfig": "null",
    "apiInfoKey": {
      "method": "GET",
      "apiCollectionId": 1679462413,
      "url": "http://localhost:8080/api/updateProfile"
    },
    "testSourceConfig": "null"
  },
  "filterCollectionsId": "null",
  "similarlyAffectedIssues": "null",
  "filterStatus": "null",
  "skip": 0,
  "filterSeverity": "null",
  "startEpoch": 0,
  "issueIdArray": "null",
  "testSourceConfigs": "null",
  "issues": "null",
  "subCategories": "null",
  "totalIssuesCount": 0,
  "testingRunResult": "null",
  "ignoreReason": "null",
  "limit": 0,
  "categories": "null",
  "statusToBeUpdated": "OPEN"
}

Bulk update issue status

post

Updates the status (OPEN, FIXED, IGNORED) of one or more issues identified by their TestingIssuesId objects. Optionally sets an ignoreReason (required when statusToBeUpdated is IGNORED), a custom description, and a map of result hex IDs used for asynchronous summary-count recalculation.

Source: IssuesAction.bulkUpdateIssueStatus()

Body

application/json

statusToBeUpdatedstring · enumRequired

New status to set on all specified issues.

Possible values:

ignoreReasonstringRequired

Reason for ignoring the issues. Required even when statusToBeUpdated is not IGNORED (pass an empty string). Stored only when status is IGNORED.

Example: False positive — rate-limit header present in production

descriptionstringOptional

Optional free-text description to attach to the issues.

Example: Reviewed by security team on 2026-04-22

Responses

200

Status updated successfully. Response body contains no additional fields beyond the standard Struts2 action result.

No content

400

Missing required fields (issueIdArray, statusToBeUpdated, or ignoreReason is null).

post/api/bulkUpdateIssueStatus

HTTPcURLJavaScriptPython

POST /api/bulkUpdateIssueStatus HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 354

{
  "issueIdArray": [
    {
      "apiInfoKey": {
        "apiCollectionId": 1000000,
        "method": "GET",
        "url": "https://api.example.com/redirect"
      },
      "testErrorSource": "AUTOMATED_TESTING",
      "testSubCategory": "OPEN_REDIRECT"
    }
  ],
  "statusToBeUpdated": "IGNORED",
  "ignoreReason": "Not exploitable in our configuration",
  "description": "",
  "testingRunResultHexIdsMap": {
    "507f1f77bcf86cd799439011": "HIGH"
  }
}

Mark two issues as IGNOREDMark an issue as FIXED

No content

Bulk update issue severity

post

Updates the severity of one or more issues across all related collections (testing_run_issues, testing_run_result, vulnerable_testing_run_results, and testing_run_result_summaries). Processed in chunks of 1 000 records to handle large datasets safely.

Source: IssuesAction.bulkUpdateIssueSeverity()

Body

application/json

severityToBeUpdatedstring · enumRequired

New severity to assign to all specified issues.

Possible values:

Responses

200

Severity updated successfully across all related collections.

No content

400

severityToBeUpdated or issueIdArray is null / empty.

post/api/bulkUpdateIssueSeverity

HTTPcURLJavaScriptPython

POST /api/bulkUpdateIssueSeverity HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 220

{
  "issueIdArray": [
    {
      "apiInfoKey": {
        "apiCollectionId": 1000000,
        "method": "GET",
        "url": "https://api.example.com/redirect"
      },
      "testErrorSource": "AUTOMATED_TESTING",
      "testSubCategory": "OPEN_REDIRECT"
    }
  ],
  "severityToBeUpdated": "MEDIUM"
}

No content

Set false positives for sensitive data

post

Marks specific parameter keys or API-specific keys as false positives for a given sensitive data type (custom or built-in). The system removes existing SingleTypeInfo records for those keys and re-classifies them to a generic/non-sensitive sub-type asynchronously.

Source: IgnoreFalsePositivesAction.setFalsePositivesInSensitiveData()

Body

application/json

Responses

200

False positives applied. The SingleTypeInfo records are updated asynchronously.

No content

400

falsePositives is null.

post/api/setFalsePositives

HTTPcURLJavaScriptPython

POST /api/setFalsePositives HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 127

{
  "falsePositives": {
    "SOCIAL_SECURITY_NUMBER": {
      "ignoredKeysInAllAPIs": [
        "ssn",
        "social_security"
      ],
      "ignoredKeysInSelectedAPIs": {}
    }
  }
}

Mark 'ssn' as a false positive for the SOCIAL_SECURITY_NUMBER type across all APIsMark 'token' as a false positive only for a specific endpoint

No content

Update issue description

post

Sets a free-text description on a single issue identified by its TestingIssuesId. Both issueId and description are required.

Source: IssuesAction.updateIssueDescription()

Body

application/json

descriptionstringRequired

New description text to set on the issue.

Example: Confirmed exploitable via the /redirect endpoint with an unvalidated `url` parameter.

Responses

200

Description updated successfully.

No content

400

issueId or description is null.

post/api/updateIssueDescription

HTTPcURLJavaScriptPython

POST /api/updateIssueDescription HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 248

{
  "issueId": {
    "apiInfoKey": {
      "apiCollectionId": 1000000,
      "method": "GET",
      "url": "https://api.example.com/redirect"
    },
    "testErrorSource": "AUTOMATED_TESTING",
    "testSubCategory": "OPEN_REDIRECT"
  },
  "description": "Confirmed exploitable via the /redirect endpoint."
}

No content

Generate a threat report

post

Creates a new threat report document in test_reports with the provided filter criteria and threat IDs. Automatically adds {label: [THREAT]} to filtersForReport. Returns the generatedReportId (ObjectId hex) needed by getThreatReportFilters and downloadThreatReportPDF.

Source: ThreatReportAction.generateThreatReport()

Body

application/json

threatIdsForReportstring[]Optional

Optional list of specific threat event IDs (hex strings) to include in the report. Pass null or omit to include all threats matching the filters.

Example: ["507f1f77bcf86cd799439011","507f1f77bcf86cd799439012"]

Responses

200

Report created. Returns the ObjectId of the new report document.

application/json

generatedReportIdstringOptional

ObjectId hex string of the newly created threat report document.

Example: 696f83245ae7e4166f7347ae

actionErrorsstring[]Optional

post/api/generateThreatReport

HTTPcURLJavaScriptPython

POST /api/generateThreatReport HTTP/1.1
Content-Type: application/json
Accept: */*
Content-Length: 141

{
  "filtersForReport": {
    "severity": [
      "CRITICAL",
      "HIGH"
    ],
    "startTimestamp": [
      "1745000000"
    ],
    "endTimestamp": [
      "1745600000"
    ]
  },
  "threatIdsForReport": null
}

200

Report created. Returns the ObjectId of the new report document.

{
  "generatedReportId": "696f83245ae7e4166f7347ae",
  "actionErrors": [
    "text"
  ]
}