Lomo CodeSecurity

The API reference is in English.

Immutable source snapshot

POST /v1/scans/{scan_id}/triage

Triage scan. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Current reference · Download OpenAPI specification

This address preserves one reviewed source snapshot. Use the current entry point for the selected documentation version.

Read pinned handler: apps/api/kodesec_api/main.py:5631

Triage scan

Triage scan through POST /v1/scans/{scan_id}/triage. The parameters and declared response shapes below come from this exact source snapshot.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session only at the middleware boundary. Route-specific ownership and generation checks also apply.

Browser mutations require the exact control Origin and session-bound CSRF header. IDE callers use only their admitted route scope and exact generation.

Inspect the authority source · Authentication guide

Parameters and headers

NameLocationContract
scan_idpath
Required

integer

Schema
{
  "title": "Scan Id",
  "type": "integer"
}
X-CSRF-Tokenheader
Conditional / optional

Required for browser mutations with the exact control Origin. Not an IDE capability.

Schema
{
  "type": "string"
}
Idempotency-Keyheader
Required

Required for command submission; for bulk findings, only the triage action. Stable key for the same exact command, beginning with a letter or digit. Reuse with different content conflicts.

Schema
{
  "maxLength": 160,
  "minLength": 8,
  "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$",
  "type": "string"
}

Request body

JSON body · required · ScanTriageRequest

FieldTypePresence
advisor_provider_pinAdvisorTriageProviderPinRequired
include_existingbooleanOptional
limitintegerOptional
modelstring | nullOptional
Complete declared request schema
{
  "additionalProperties": false,
  "properties": {
    "advisor_provider_pin": {
      "$ref": "#/components/schemas/AdvisorTriageProviderPin"
    },
    "include_existing": {
      "default": false,
      "title": "Include Existing",
      "type": "boolean"
    },
    "limit": {
      "default": 100,
      "maximum": 200,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    },
    "model": {
      "anyOf": [
        {
          "maxLength": 120,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Model"
    }
  },
  "required": [
    "advisor_provider_pin"
  ],
  "title": "ScanTriageRequest",
  "type": "object"
}

Responses

StatusMeaning and declared shape
202

Successful Response

application/json · JobOut
{
  "properties": {
    "activity": {
      "anyOf": [
        {
          "$ref": "#/components/schemas/JobActivityOut"
        },
        {
          "type": "null"
        }
      ]
    },
    "attempt": {
      "default": 0,
      "title": "Attempt",
      "type": "integer"
    },
    "can_cancel": {
      "default": false,
      "title": "Can Cancel",
      "type": "boolean"
    },
    "can_reconcile_cache": {
      "default": false,
      "title": "Can Reconcile Cache",
      "type": "boolean"
    },
    "can_retry": {
      "default": false,
      "title": "Can Retry",
      "type": "boolean"
    },
    "cancel_requested_at": {
      "anyOf": [
        {
          "format": "date-time",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Cancel Requested At"
    },
    "completed_at": {
      "anyOf": [
        {
          "format": "date-time",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Completed At"
    },
    "created_at": {
      "format": "date-time",
      "title": "Created At",
      "type": "string"
    },
    "detail": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Detail"
    },
    "error": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Error"
    },
    "error_code": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Error Code"
    },
    "error_detail": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Error Detail"
    },
    "finding_display_id": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Finding Display Id"
    },
    "finding_id": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "title": "Finding Id"
    },
    "finding_rule_id": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Finding Rule Id"
    },
    "finding_scan_number": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "title": "Finding Scan Number"
    },
    "heartbeat_at": {
      "anyOf": [
        {
          "format": "date-time",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Heartbeat At"
    },
    "id": {
      "title": "Id",
      "type": "integer"
    },
    "kind": {
      "title": "Kind",
      "type": "string"
    },
    "max_attempts": {
      "default": 1,
      "title": "Max Attempts",
      "type": "integer"
    },
    "original_job_id": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "title": "Original Job Id"
    },
    "progress": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "title": "Progress"
    },
    "retry_blocked_reason": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Retry Blocked Reason"
    },
    "revision": {
      "default": 1,
      "title": "Revision",
      "type": "integer"
    },
    "scan_id": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "title": "Scan Id"
    },
    "stage": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Stage"
    },
    "started_at": {
      "anyOf": [
        {
          "format": "date-time",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Started At"
    },
    "status": {
      "title": "Status",
      "type": "string"
    },
    "title": {
      "title": "Title",
      "type": "string"
    },
    "updated_at": {
      "format": "date-time",
      "title": "Updated At",
      "type": "string"
    }
  },
  "required": [
    "id",
    "kind",
    "title",
    "status",
    "stage",
    "detail",
    "progress",
    "scan_id",
    "finding_id",
    "error",
    "created_at",
    "started_at",
    "completed_at",
    "updated_at"
  ],
  "title": "JobOut",
  "type": "object"
}
400

Exact host, malformed request or URL credential refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
401

Missing or invalid membership

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
403

Exact origin, CSRF or route authority refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
404

Refresh the collection and verify the resource identity before retrying. See source-linked error catalog.

409

Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.

422

Validation Error

application/json · HTTPValidationError
{
  "properties": {
    "detail": {
      "items": {
        "$ref": "#/components/schemas/ValidationError"
      },
      "title": "Detail",
      "type": "array"
    }
  },
  "title": "HTTPValidationError",
  "type": "object"
}
429

Authentication rate or connection limit

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
503

Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness. See source-linked error catalog.

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

22 source error observations
StatusSource detailRecovery
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
404 ↗scan not foundRefresh the collection and verify the resource identity before retrying.
409 ↗advisor triage requires a terminal scan with persisted findingsRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗advisor triage requires at least one eligible active findingRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
422 ↗Dynamic detail; inspect sourceCorrect the field or semantic validation error. Input values are omitted from control validation errors.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗the selected Advisor provider no longer existsRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
503 ↗Dynamic detail; inspect sourceCheck readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
503 ↗Dynamic detail; inspect sourceCheck readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
409 ↗Idempotency-Key is already bound to a different commandRefresh current revision and identity. A conflicting command must not be blindly repeated.
422 ↗command payload must be an objectCorrect the field or semantic validation error. Input values are omitted from control validation errors.
401 ↗authentication requiredReconcile the exact browser or IDE membership through the normal owner workflow.
422 ↗Idempotency-Key must contain 8-160 ASCII letters, digits, '.', '_', ':', or '-'Correct the field or semantic validation error. Input values are omitted from control validation errors.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON
{
  "advisor_provider_pin": {
    "model": "synthetic",
    "model_digest": "0000000000000000000000000000000000000000000000000000000000000000",
    "provider_collection_revision": 1,
    "provider_config_digest": "0000000000000000000000000000000000000000000000000000000000000000",
    "provider_config_revision": 1,
    "provider_id": "a",
    "transport": "local"
  }
}
Response 202 JSON
{
  "completed_at": "2026-01-01T00:00:00Z",
  "created_at": "2026-01-01T00:00:00Z",
  "detail": "synthetic",
  "error": "synthetic",
  "finding_id": 1,
  "id": 1,
  "kind": "synthetic",
  "progress": 1,
  "scan_id": 1,
  "stage": "synthetic",
  "started_at": "2026-01-01T00:00:00Z",
  "status": "synthetic",
  "title": "synthetic",
  "updated_at": "2026-01-01T00:00:00Z"
}
Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.