Skip to main content
POST
Bulk-resolve open OSS findings across every project

Authorizations

Authorization
string
header
required

An Earnie API key, sent as Authorization: Bearer sk_earnie_.... Create one under Settings > API keys. The key's scopes decide which operations it may call.

Body

application/json

Organization-wide variant of BulkResolveRequest: the same selection and resolution semantics, applied across every project in the organization. Used by the Scan Configuration save offer — the explicit, user-confirmed bulk-resolve of currently open findings matching a saved org-layer Component override. Deliberately a separate endpoint from bulk-resolve so an org-wide sweep can never happen by merely omitting a project_id.

domain_slug
string
required

Producer domain_slug to filter findings (e.g. "oss").

reason
object
required

A triage resolution reason. The canonical slugs cover five families: OSS (confirm_match, mark_original, replace_component), declared dependencies (accept_dependency, dismiss_dependency), crypto (confirm_usage, false_positive, accepted_risk), AI usage (confirm_ai_usage, not_ai_usage, approve_ai_usage), and identified AI models (approve_model, reject_model, wrong_identification). Each slug decides findings of its own family only; any other finding answers 400 reason_domain_mismatch. Callers MUST supply a non-empty slug by default; the org-level triage_reason_required setting controls whether an empty slug is permitted (see CAP2). Each slug carries a gate posture, reported by the suppresses field below and applied by the resolve path: resolving with a suppressing reason drops the finding from PR-gate impact, and reopening it undoes that suppression.

scope
object
required
path_prefix
string | null

Optional folder path prefix scope filter.

purl
string | null

Optional component PURL scope filter.

justification
string | null

Optional human-readable justification for the bulk resolution.

replacement_purl
string | null

Versioned PURL required when reason.slug is replace_component.

concluded_license
string | null

Optional license the operator concluded for the component (an SPDX identifier when picked from the SPDX list). Stored on every created resolution as structured evidence.

Response

Bulk resolution result

Result of a bulk-resolve operation. affected is the count of findings newly resolved in this call. unchanged counts findings that were already non-open and skipped idempotently. skipped counts findings excluded by scope or other non-error conditions. failed counts findings that caused an error (currently at most 1 — the operation aborts on first failure).

affected
integer
required

Number of findings newly resolved in this call.

unchanged
integer
required

Number of findings already resolved or in non-open state (idempotent skip).

skipped
integer
required

Number of findings excluded by scope filter or other non-error conditions.

failed
integer
required

Number of findings that caused an error (triggers full rollback).

finding_ids
string<uuid>[]

IDs of the findings that were resolved in this call. Callers can use this list to update local state without a full re-fetch.