POST /v1/findings/{finding_id}/advisor-disclosure-preview

Preview finding advisor disclosure. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Immutable snapshot · Download OpenAPI specification

Read pinned handler: apps/api/kodesec_api/main.py:5978

Preview finding advisor disclosure

Describe and hash the exact remote payload without transmitting it.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session only at the middleware boundary. Route-specific ownership and generation checks also apply.

Browser mutations require the exact control Origin and session-bound CSRF header. IDE callers use only their admitted route scope and exact generation.

Inspect the authority source · Authentication guide

Parameters and headers

Name	Location	Contract
`finding_id`	path Required	integer Schema `{ "title": "Finding Id", "type": "integer" }`
`X-CSRF-Token`	header Conditional / optional	Required for browser mutations with the exact control Origin. Not an IDE capability. Schema `{ "type": "string" }`

Request body

JSON body · required · AdvisorDisclosurePreviewRequest

Field	Type	Presence
`expected_revision`	integer	Required
`provider_id`	string \| null	Optional

Complete declared request schema

{
  "additionalProperties": false,
  "properties": {
    "expected_revision": {
      "minimum": 1,
      "title": "Expected Revision",
      "type": "integer"
    },
    "provider_id": {
      "anyOf": [
        {
          "pattern": "^[a-z][a-z0-9-]{0,39}$",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Provider Id"
    }
  },
  "required": [
    "expected_revision"
  ],
  "title": "AdvisorDisclosurePreviewRequest",
  "type": "object"
}

Responses

Status	Meaning and declared shape
`200`	Successful Response application/json · AdvisorDisclosurePreviewOut `{ "additionalProperties": false, "properties": { "confirmation": { "$ref": "#/components/schemas/AdvisorDisclosureConfirmationOut" }, "packet": { "$ref": "#/components/schemas/AdvisorDisclosurePacketOut" }, "packet_utf8_bytes": { "maximum": 262144, "minimum": 2, "title": "Packet Utf8 Bytes", "type": "integer" } }, "required": [ "confirmation", "packet", "packet_utf8_bytes" ], "title": "AdvisorDisclosurePreviewOut", "type": "object" }`
`400`	Exact host, malformed request or URL credential refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`401`	Missing or invalid membership application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`403`	Exact origin, CSRF or route authority refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`404`	Refresh the collection and verify the resource identity before retrying. See source-linked error catalog.
`409`	Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.
`422`	Validation Error application/json · HTTPValidationError `{ "properties": { "detail": { "items": { "$ref": "#/components/schemas/ValidationError" }, "title": "Detail", "type": "array" } }, "title": "HTTPValidationError", "type": "object" }`
`429`	Authentication rate or connection limit application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

11 source error observations

Status	Source detail	Recovery
404 ↗	`finding not found`	Refresh the collection and verify the resource identity before retrying.
404 ↗	`finding context not found`	Refresh the collection and verify the resource identity before retrying.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Advisor disclosure preview requires one active terminal finding`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`no remote Advisor provider is active`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`the active Advisor route is local and needs no remote disclosure`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`the remote Advisor provider is not currently active`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`the remote Advisor provider is not authorized`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`the remote Advisor provider has no current exact test receipt`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
404 ↗	`advisor provider not found`	Refresh the collection and verify the resource identity before retrying.
409 ↗	`remote Advisor consent is missing or stale`	Refresh current revision and identity. A conflicting command must not be blindly repeated.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON

{
  "expected_revision": 1
}

Response 200 JSON

{
  "confirmation": {
    "authorization_id": "00000000000000000000000000000000",
    "confirmation_digest": "0000000000000000000000000000000000000000000000000000000000000000",
    "consent_approved_at": "1111-11-11T11:11:11Z",
    "destination": "synthetic",
    "disclosure_mode": "finding_evidence",
    "finding_id": 1,
    "finding_revision": 1,
    "model": "synthetic",
    "model_digest": "0000000000000000000000000000000000000000000000000000000000000000",
    "payload_categories": [
      "synthetic",
      "synthetic",
      "synthetic",
      "synthetic",
      "synthetic"
    ],
    "prompt_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
    "provider_config_digest": "0000000000000000000000000000000000000000000000000000000000000000",
    "provider_config_revision": 1,
    "provider_id": "a",
    "schema": "lomo-advisor-run-confirmation/v1",
    "transport": "direct"
  },
  "packet": {
    "finding": {
      "display_id": "synthetic",
      "fingerprint": "synthetic",
      "id": 1,
      "message": "synthetic",
      "rule_id": "synthetic",
      "scanner": "synthetic",
      "severity": "synthetic"
    },
    "location": {
      "file_path": "/workspace/synthetic-demo"
    },
    "repo_context": {
      "mode": "synthetic",
      "project": "synthetic",
      "repo_path": "/workspace/synthetic-demo",
      "scan_id": 1
    },
    "scanner_evidence": {
      "metadata": {}
    },
    "schema_version": 1
  },
  "packet_utf8_bytes": 2
}

Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.