Chapter 67. Vulnerability Exception Service

POST /v2/vulnerability-exceptions/{id}/approve

ApproveVulnerabilityException approves a vulnerability exception. Once approved, the exception is enforced. The associated vulnerabilities are excluded from policy evaluation and risk evaluation, and the vulnerabilities may not appear in certain APIs responses by default.

POST /v2/vulnerability-exceptions/{id}/cancel

CancelVulnerabilityException cancels a vulnerability exception. Once cancelled, an approved exception is no longer enforced. Cancelled exceptions are garbage collected as per the retention configuration .expiredVulnReqRetentionDurationDays (GET /v1/config/).

POST /v2/vulnerability-exceptions/deferral

CreateDeferVulnerabilityException creates an exception request to defer specified vulnerabilities. Once an exception is created, it remains in the PENDING state until the approval. The exception is enforced only after it is approved. Once the exception expires, it is garbage collected as per the retention configuration .expiredVulnReqRetentionDurationDays (GET`/v1/config/`)

POST /v2/vulnerability-exceptions/false-positive

CreateFalsePositiveVulnerabilityException creates an exception request to mark specified vulnerabilities as false positive. Once an exception is created, it remains in the PENDING state until the approval. The exception is enforced only after it is approved.

DELETE /v2/vulnerability-exceptions/{id}

DeleteVulnerabilityException deletes a vulnerability exception. Only pending exceptions and pending updates to an enforced exception can be deleted. To revert an exception use cancel API. All exceptions are retained in the system according to the retention configuration.

POST /v2/vulnerability-exceptions/{id}/deny

DenyVulnerabilityException denies a vulnerability exception. Denied exceptions are inactive and are garbage collected as per the retention configuration .expiredVulnReqRetentionDurationDays (GET`/v1/config/`)

GET /v2/vulnerability-exceptions/{id}

GetVulnerabilityException returns the vulnerability exception with specified ID.

GET /v2/vulnerability-exceptions

ListVulnerabilityExceptions returns a list of vulnerability exceptions.

PATCH /v2/vulnerability-exceptions/{id}

UpdateVulnerabilityException updates an existing vulnerability exception. The update is enforced only once it is approved. Currently only the following can be updated: - CVEs and expiry of the deferral exceptions - CVEs of the false positive exception