curl --request POST \
--url https://api.enokilabs.ai/api/v1/findings/{finding_id}/validateimport requests
url = "https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"finding_id": "<string>",
"replay_run_id": "<string>",
"verdict": "resolved",
"finding": {
"finding_id": "<string>",
"lens": "security",
"category": "<string>",
"severity": "critical",
"description": "<string>",
"expected_behavior": "<string>",
"status": "<string>",
"created_at": "<string>",
"attacks": [
{
"attack_id": "<string>",
"score": 123,
"source": {
"source_type": "manual",
"assessment_id": "<string>",
"attack_index": 123,
"date": "<string>"
},
"replay_script": [
{
"step": "chat",
"message": "<string>",
"response": "<string>",
"session_id": "<string>",
"method": "<string>",
"url": "<string>",
"headers": {},
"body": "<string>",
"response_status": 123,
"response_body": "<string>",
"target": "<string>",
"assertion": "<string>",
"expected_behavior": "<string>",
"capture_as": "<string>"
}
],
"last_replay_status": "pending",
"created_at": "<string>",
"last_replayed_at": "<string>"
}
]
}
}Re-run a finding's attacks to confirm a fix
Re-runs every attack under the finding against the live target and drives its verification status. Call AFTER marking the finding fixed (PATCH …/close status=fixed) — validating a finding that is not marked fixed returns verdict=‘not_eligible’. Returns the terminal verdict when the re-run finishes quickly; otherwise returns verdict=‘validating’ with a replay_run_id — re-read the finding’s status via the findings list. Cross-workspace ids resolve to 404.
curl --request POST \
--url https://api.enokilabs.ai/api/v1/findings/{finding_id}/validateimport requests
url = "https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate"
response = requests.post(url)
print(response.text)const options = {method: 'POST'};
fetch('https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate"
req, _ := http.NewRequest("POST", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.enokilabs.ai/api/v1/findings/{finding_id}/validate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
response = http.request(request)
puts response.read_body{
"finding_id": "<string>",
"replay_run_id": "<string>",
"verdict": "resolved",
"finding": {
"finding_id": "<string>",
"lens": "security",
"category": "<string>",
"severity": "critical",
"description": "<string>",
"expected_behavior": "<string>",
"status": "<string>",
"created_at": "<string>",
"attacks": [
{
"attack_id": "<string>",
"score": 123,
"source": {
"source_type": "manual",
"assessment_id": "<string>",
"attack_index": 123,
"date": "<string>"
},
"replay_script": [
{
"step": "chat",
"message": "<string>",
"response": "<string>",
"session_id": "<string>",
"method": "<string>",
"url": "<string>",
"headers": {},
"body": "<string>",
"response_status": 123,
"response_body": "<string>",
"target": "<string>",
"assertion": "<string>",
"expected_behavior": "<string>",
"capture_as": "<string>"
}
],
"last_replay_status": "pending",
"created_at": "<string>",
"last_replayed_at": "<string>"
}
]
}
}Headers
Bearer token with API key
Path Parameters
Response
Successful Response
Outcome of POST /api/v1/findings/{finding_id}/validate.
Ships one derived convenience field, verdict, alongside the
embedded finding. The finding carries the durable truth -- its
fine-grained status and every attack's last_replay_status --
while verdict collapses that into the single signal a remediation
loop acts on.
The finding that was validated.
The replay run that re-ran the finding's attacks. Empty when the finding was not eligible and no run was spent.
resolved: every attack no longer reproduces (finding FIXED_VERIFIED). still_broken: at least one attack still reproduces or could not be judged. not_eligible: mark the finding fixed before validating -- it was not in a verifiable state. validating: still running -- re-read the finding's status via the findings list.
resolved, still_broken, not_eligible, validating Post-validate finding, incl. status and per-attack last_replay_status.
Show child attributes
Show child attributes