Record a triage decision on static-analysis issues

POST 
/api/v1/assessments/:assessment_id/codeling/sast-findings/decisions

Mark issues as a false positive or an accepted risk, or clear them.

This is the alternative to promoting. An issue a reviewer has read and dismissed should not enter the findings feed, its counts or its SLA clock, and before this route the only way to clear one was to promote it first, which spends the findings surface on noise.

Idempotent: deciding the same way twice rewrites one row. "open" deletes, because open is the absence of a decision.

Not release-gated. Scope (findings:triage), manager-or-above, the org check and verify_assessment_access are the gates, as they are for the promote route beside it.

Request

Responses

200

Successful Response

400

Bad request — malformed input or failed validation.

401

Missing, expired, or invalid credentials.

403

Authenticated but not authorized for this resource. Note: cross-organization reads return 404, not 403.

404

Resource not found, or hidden for tenant-enumeration safety (the caller lacks permission to know whether the resource exists).

409

Conflict — the current resource state does not allow this operation (e.g. assessment already started, email already in use).

422

Semantic validation failure — request shape was valid but contents were not.

429

Too many requests — rate limited. Retry after the window resets.

500

Internal server error — unexpected failure.