{"info":{"_postman_id":"cb72ac78-9f59-4348-88a5-9296a535807c","name":"NopSec API Documentation v2 - Prod","description":"

Welcome to the NopSec API!

\n

Using the NopSec API, you can have visibility into your scanned targets and vulnerabilities, kick off remediation workflows by creating remediation plans, or submit exception requests to formally exclude vulnerabilities from remediation.

\n

Quick start

\n
    \n

  1. Get an API key, submit a Support Ticket or contact your Customer Success team.

    \n
    2. \n

  2. Pick the base URL, https://us2.nopsec.com/api

    \n
    3. \n

  3. Send the key on every request, as the X-NOPSEC-API-KEY header:

    \n
    4. \n
\n
curl https://us2.nopsec.com/api/remediate/exceptionplan \\\n  -H \"X-NOPSEC-API-KEY: <your-api-key>\"\n\n

What you can do

\n\n

Prerequisites

\n

To begin using the NopSec API, you need an active NopSec Account that has been given API access, the API endpoint URL, and the correct credentials and permissions.

\n

Active Account

\n

A NopSec Account is used to authenticate with the NopSec API.

\n

Please submit a Service Request or contact your Customer Success team to receive your API Key.

\n

Permissions

\n

Each user account within the NopSec platform is assigned to one or more Teams. Each Team is assigned a role which the user inherits. These roles dictate the permissions a user has within the platform. Your API Key will inherit the same permissions your user account has and will utilize the highest level of access for each API call.

\n

You may create a new local user manually or ask your Customer Success team to do so with limited permissions if you prefer to use a service account for your API calls.

\n

API Server

\n

The NopSec API has a single endpoint:

\n\n

API Key

\n

Please submit a Support Ticket or contact your Customer Success Team directly and request an API key.

\n

You will need to provide this key with all of your API requests via the X-NOPSEC-API-KEY header.

\n

Rate Limits

\n

The API allows up to 5 requests per second. Exceeding this returns a 429 Too Many Requests — back off and retry rather than hammering the API.

\n

Error Codes

\n

HTTP status codes will be returned in the response header in the event there is an error or unaccepted parameter in the api call. An error message (JSON formatted) will be returned in the response body to help guide you towards creating an acceptable request.

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CodeMeaning
102Processing
200OK
201Created
204No Content
400Bad Request
401Unauthorized
404Not Found
409Conflict
412Precondition Failed
422Unprocessable Entity
429Too Many Requests (more than 5 per second)
500Internal Server Error
\n

Limitations

\n

Contact your Customer Success Team for details regarding your plan.

\n

Troubleshooting

\n

Before using NopSec APIs, we recommend that you familiarize yourself with the user documentation. There is a strong correlation between the business logic of NopSec Platform UI and the API.

\n

You will also find detailed step-by-step instructions for specific use cases, for example, importing asset data and importing scan data.

\n

If you experience any errors please submit a support ticket in your customer portal.

\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","toc":[{"content":"Quick start","slug":"quick-start"},{"content":"What you can do","slug":"what-you-can-do"},{"content":"Prerequisites","slug":"prerequisites"},{"content":"Rate Limits","slug":"rate-limits"},{"content":"Error Codes","slug":"error-codes"},{"content":"Limitations","slug":"limitations"},{"content":"Troubleshooting","slug":"troubleshooting"}],"owner":"56962595","collectionId":"cb72ac78-9f59-4348-88a5-9296a535807c","publishedId":"2sBY4Wpca4","public":true,"customColor":{"top-bar":"FFFFFF","right-sidebar":"303030","highlight":"FF6C37"},"publishDate":"2026-08-12T16:00:04.000Z"},"item":[{"name":"Prioritize","item":[{"name":"Get Saved Column Presets","id":"05e8d9a7-4099-436c-9312-edf019a6411b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/prioritize/saved-column-group-by","description":"

Last reviewed: 2026-07-31

\n

Retrieve your saved Column Presets - which columns appear in your Prioritize/Reports view, in what order, and how each one is rendered. You either created these yourself on the Prioritize page, or an Admin assigned them to you.

\n
{\n    \"id\": \"8cca18cf-978d-4651-80ee-4a728fd23f1d\",\n    \"client\": null,\n    \"owner\": null,\n    \"name\": \"ASSET\",\n    \"group_by\": \"ASSET\",\n    \"columns\": [\n        {\n            \"id\": \"1ae9fcc9-7f96-409a-a63f-fd403948e264\",\n            \"column\": {\n                \"id\": \"b41d9ecc-e50e-46da-a1d1-9a5ba0b80b4a\",\n                \"group_by\": \"ASSET\",\n                \"is_active\": true,\n                \"is_sortable\": false,\n                \"display_name\": \"Asset Tags\",\n                \"column\": \"target_data.derived.combined_tags.tag_name\",\n                \"rendering_type\": \"TAGS\"\n            }\n        }\n    ]\n}\n\n
\n

A few things worth knowing before you use this:

\n\n","urlObject":{"path":["prioritize","saved-column-group-by"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":""},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":""}],"variable":[]}},"response":[{"id":"67942b76-3fa6-403e-8931-02f10e126dab","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/prioritize/saved-column-group-by?limit=&offset=","host":["{{baseUrl}}"],"path":["prioritize","saved-column-group-by"],"query":[{"description":"Number of results to return per page.","key":"limit","value":""},{"description":"The initial index from which to return the results.","key":"offset","value":""}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": \"\",\n \"next\": \"\",\n \"previous\": \"\",\n \"results\": [\n {\n \"client\": \"\",\n \"columns\": [\n {\n \"column\": {\n \"column\": \"\",\n \"display_name\": \"\",\n \"id\": \"\",\n \"group_by\": \"TARGET\",\n \"is_active\": \"\",\n \"rendering_type\": \"DEFAULT\"\n },\n \"id\": \"\",\n \"order\": \"\"\n },\n {\n \"column\": {\n \"column\": \"\",\n \"display_name\": \"\",\n \"id\": \"\",\n \"group_by\": \"TARGET\",\n \"is_active\": \"\",\n \"rendering_type\": \"DEFAULT\"\n },\n \"id\": \"\",\n \"order\": \"\"\n }\n ],\n \"id\": \"\",\n \"is_default\": \"\",\n \"name\": \"\",\n \"owner\": \"\",\n \"group_by\": \"TARGET\",\n \"column_ids\": [\n \"\",\n \"\"\n ],\n \"sort_by\": \"\",\n \"is_favorite\": \"\"\n },\n {\n \"client\": \"\",\n \"columns\": [\n {\n \"column\": {\n \"column\": \"\",\n \"display_name\": \"\",\n \"id\": \"\",\n \"group_by\": \"TARGET\",\n \"is_active\": \"\",\n \"rendering_type\": \"TAGS\"\n },\n \"id\": \"\",\n \"order\": \"\"\n },\n {\n \"column\": {\n \"column\": \"\",\n \"display_name\": \"\",\n \"id\": \"\",\n \"group_by\": \"TARGET\",\n \"is_active\": \"\",\n \"rendering_type\": \"DEFAULT\"\n },\n \"id\": \"\",\n \"order\": \"\"\n }\n ],\n \"id\": \"\",\n \"is_default\": \"\",\n \"name\": \"\",\n \"owner\": \"\",\n \"group_by\": \"TARGET\",\n \"column_ids\": [\n \"\",\n \"\"\n ],\n \"sort_by\": \"\",\n \"is_favorite\": \"\"\n }\n ]\n}"}],"_postman_id":"05e8d9a7-4099-436c-9312-edf019a6411b"},{"name":"Get Saved Queries","id":"0c0ee99a-8f7a-48ef-b08e-aa711ffce09c","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/prioritize/saved-query","description":"

Last reviewed: 2026-07-31

\n

Retrieve a list of your Saved Queries - the filters you built on the Prioritize page (or that your Admin team assigned to you). Each one is a JSON filter tree: combinator (\"and\"/\"or\"), not for negation, and rules holding the actual conditions.

\n
{\n    \"id\": \"3138b4f8-13e1-42ef-914f-5443763401bc\",\n    \"client\": null,\n    \"owner\": null,\n    \"is_default\": true,\n    \"name\": \"ALL DATA\",\n    \"query\": {\n        \"not\": false,\n        \"rules\": [],\n        \"combinator\": \"and\"\n    },\n    \"version\": \"v1\",\n    \"is_favorite\": true\n}\n\n
\n

The id here is what you pass as saved_query_id to the Reports download endpoints to filter a CSV export by this query.

\n","urlObject":{"path":["prioritize","saved-query"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":""},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":""}],"variable":[]}},"response":[{"id":"d7c00d52-c50b-40df-b28d-fab64e745982","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/prioritize/saved-query?limit=&offset=","host":["{{baseUrl}}"],"path":["prioritize","saved-query"],"query":[{"description":"Number of results to return per page.","key":"limit","value":""},{"description":"The initial index from which to return the results.","key":"offset","value":""}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": \"\",\n \"next\": \"\",\n \"previous\": \"\",\n \"results\": [\n {\n \"client\": \"\",\n \"id\": \"\",\n \"is_default\": \"\",\n \"name\": \"\",\n \"owner\": \"\",\n \"query\": {\n \"description\": \"Query Builder query\"\n },\n \"version\": \"\",\n \"is_favorite\": \"\"\n },\n {\n \"client\": \"\",\n \"id\": \"\",\n \"is_default\": \"\",\n \"name\": \"\",\n \"owner\": \"\",\n \"query\": {\n \"description\": \"Query Builder query\"\n },\n \"version\": \"\",\n \"is_favorite\": \"\"\n }\n ]\n}"}],"_postman_id":"0c0ee99a-8f7a-48ef-b08e-aa711ffce09c"}],"id":"ee7842ba-1f14-41b3-819d-eb6a7d707b5a","_postman_id":"ee7842ba-1f14-41b3-819d-eb6a7d707b5a","description":""},{"name":"Exception Plans","item":[{"name":"Get Exception Plans","id":"d2ea11e4-12c4-4562-a47f-4956c8093159","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/exceptionplan","description":"

Last reviewed: 2026-07-31

\n

Lists Exception Plans for your client. An Exception Plan is a formal request to exclude specific vulnerabilities from remediation - someone submits it, it goes to an approver, and it tracks approval state over time.

\n

This is a plain paginated list - filter with the query params below rather than pulling everything and filtering client-side. Values below are illustrative, not the real record.

\n
{\n    \"id\": \"a1b2c3d4-e5f6-4567-90ab-cdef01234567\",\n    \"plan_id\": \"011\",\n    \"approval_date\": \"2026-07-02T12:57:19.746565Z\",\n    \"approval_url\": \"\",\n    \"approver\": {\n        \"id\": 1313,\n        \"username\": \"jsmith\",\n        \"full_name\": \"Jane Smith\",\n        \"email\": \"jane.smith@example.com\",\n        \"first_name\": \"Jane\",\n        \"last_name\": \"Smith\",\n        \"department\": \"\",\n        \"job_title\": \"\",\n        \"is_active\": true\n    },\n    \"exceptionplan_attachments\": [],\n    \"created_at\": \"2026-07-02T12:56:10.236759Z\",\n    \"updated_at\": \"2026-07-23T00:00:50.469144Z\",\n    \"creation_method\": \"MANUAL\",\n    \"details\": \"<p class=&#x27;preserveHtml&#x27; class=&#x27;preserveHtml&#x27; class=&#x27;preserveHtml&#x27;>Vendor patch scheduled for next maintenance window</p>\",\n    \"status\": \"EXPIRED\"\n}\n\n
\n

A few things worth knowing:

\n
    \n

  • status is what tells you where the plan stands - this one is EXPIRED. Filter by it with the status query param when you only care about plans in a particular state.

    \n
    • \n

  • details comes back as raw HTML (rich text from whoever created the plan), not plain text - render it accordingly if you're displaying it, don't just print it as a string.

    \n
    • \n

  • approver is a full nested user object, not just an id - useful if you want to show who needs to act without a second lookup.

    \n
    • \n

  • id (a UUID) is the field to use for GET /remediate/exceptionplan/{id} and the other single-plan endpoints below. plan_id is a separate, human-readable short code (like \"011\") - don't confuse the two.

    \n
    • \n
\n

Query params (all optional):

\n
    \n

  • created_at - filter by creation date

    \n
    • \n

  • creation_method - how the plan was created

    \n
    • \n

  • limit / offset - pagination

    \n
    • \n

  • ordering - which field to sort by

    \n
    • \n

  • search - free text search term

    \n
    • \n

  • status - filter by plan status

    \n
    • \n
\n

Response shape: standard paginated envelope (count, next, previous, results).

\n","urlObject":{"path":["remediate","exceptionplan"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"key":"created_at","value":""},{"disabled":true,"key":"creation_method","value":""},{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":""},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":""},{"disabled":true,"description":{"content":"

Which field to use when ordering the results.

\n","type":"text/plain"},"key":"ordering","value":""},{"disabled":true,"description":{"content":"

A search term.

\n","type":"text/plain"},"key":"search","value":""},{"disabled":true,"key":"status","value":""}],"variable":[]}},"response":[{"id":"ed23a91b-dcf0-4c30-8b9b-fe3639258c67","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/remediate/exceptionplan?created_at=&creation_method=&limit=&offset=&ordering=&search=&status=","host":["{{baseUrl}}"],"path":["remediate","exceptionplan"],"query":[{"key":"created_at","value":""},{"key":"creation_method","value":""},{"description":"Number of results to return per page.","key":"limit","value":""},{"description":"The initial index from which to return the results.","key":"offset","value":""},{"description":"Which field to use when ordering the results.","key":"ordering","value":""},{"description":"A search term.","key":"search","value":""},{"key":"status","value":""}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": \"\",\n \"next\": \"\",\n \"previous\": \"\",\n \"results\": [\n {\n \"action_request_ids\": [],\n \"approval_date\": \"\",\n \"approver\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"+hA\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"created_at\": \"\",\n \"creation_method\": \"AUTO\",\n \"id\": \"\",\n \"plan_id\": \"\",\n \"reason\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"8aDdegxnpc-\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"updated_at\": \"\",\n \"approval_url\": \"\",\n \"approver_id\": \"\",\n \"exceptionplan_attachments\": [\n {\n \"exceptionplan_id\": \"\",\n \"filename\": \"\",\n \"id\": \"\",\n \"url\": \"\",\n \"s3_path\": \"\"\n },\n {\n \"exceptionplan_id\": \"\",\n \"filename\": \"\",\n \"id\": \"\",\n \"url\": \"\",\n \"s3_path\": \"\"\n }\n ],\n \"details\": \"\",\n \"status\": \"EXPIRED\",\n \"type\": \"RISK_MITIGATED\",\n \"expiration_date\": \"\",\n \"vuln_instance_ids\": [\n \"\",\n \"\"\n ],\n \"query_data\": {\n \"grouping\": \"VULN_INSTANCE\",\n \"query\": {\n \"description\": \"Either query or selected ids must be provided. If no query is provided, all vuln instances for selected ids will be included.\"\n },\n \"selected_ids\": [\n \"\",\n \"\"\n ]\n }\n },\n {\n \"action_request_ids\": [],\n \"approval_date\": \"\",\n \"approver\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"Eph55\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"created_at\": \"\",\n \"creation_method\": \"THIRD_PARTY_INGEST\",\n \"id\": \"\",\n \"plan_id\": \"\",\n \"reason\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"iJ-AK6GI\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"updated_at\": \"\",\n \"approval_url\": \"\",\n \"approver_id\": \"\",\n \"exceptionplan_attachments\": [\n {\n \"exceptionplan_id\": \"\",\n \"filename\": \"\",\n \"id\": \"\",\n \"url\": \"\",\n \"s3_path\": \"\"\n },\n {\n \"exceptionplan_id\": \"\",\n \"filename\": \"\",\n \"id\": \"\",\n \"url\": \"\",\n \"s3_path\": \"\"\n }\n ],\n \"details\": \"\",\n \"status\": \"SUBMITTED\",\n \"type\": \"FALSE_POSITIVE\",\n \"expiration_date\": \"\",\n \"vuln_instance_ids\": [\n \"\",\n \"\"\n ],\n \"query_data\": {\n \"grouping\": \"VULN_INSTANCE\",\n \"query\": {\n \"description\": \"Either query or selected ids must be provided. If no query is provided, all vuln instances for selected ids will be included.\"\n },\n \"selected_ids\": [\n \"\",\n \"\"\n ]\n }\n }\n ]\n}"}],"_postman_id":"d2ea11e4-12c4-4562-a47f-4956c8093159"},{"name":"Create Exception Plan","id":"818abe13-fa22-4be0-b42d-5f90f1efbd52","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"POST","header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"},{"key":"Accept","value":"application/json"}],"body":{"mode":"urlencoded","urlencoded":[{"description":"

(Required)

\n","key":"reason","value":""},{"key":"approval_url","value":""},{"key":"exceptionplan_attachments","value":"[object Object]"},{"key":"details","value":""},{"description":"
    \n
  • FALSE_POSITIVE - False Positive
    • \n
  • RISK_ACCEPTED - Risk Accepted
    • \n
  • RISK_MITIGATED - Risk Mitigated
    • \n
  • NONE - None
    • \n
\n","key":"type","value":"FALSE_POSITIVE"},{"key":"expiration_date","value":""},{"description":"

Must pass either vuln instance ids or query_data field. If vuln_instance_ids are passed they will be used over query_data.

\n","key":"vuln_instance_ids","value":""},{"key":"grouping","value":"VULN_INSTANCE"},{"key":"query","value":"[object Object]"},{"key":"selected_ids","value":","}]},"url":"{{baseUrl}}/remediate/exceptionplan?created_at=&creation_method=&status=","description":"

Last reviewed: 2026-08-02

\n

Creates an Exception Plan - a request to exclude specific vulnerabilities from remediation, subject to approval.

\n

A few things worth knowing:

\n
    \n

  • reason (required) is a string, not free text - values come from Get Reasons for Exception Plans, which lists what your Admin team has configured.

    \n
    • \n

  • type is one of FALSE_POSITIVE, RISK_ACCEPTED, RISK_MITIGATED, NONE.

    \n
    • \n

  • vuln_instance_ids vs query / grouping / selected_ids: pass one or the other per the field description.

    \n
    • \n

  • The query params on the URL (created_at, creation_method, status) seems similar to Get Exception Plans.

    \n
    • \n
\n

Example body:

\n
reason=Vendor patch scheduled for next maintenance window&type=RISK_ACCEPTED&vuln_instance_ids=a1b2c3d4-e5f6-4789-90ab-cdef01234567&expiration_date=2026-09-01T00:00:00Z\n\n
","urlObject":{"path":["remediate","exceptionplan"],"host":["{{baseUrl}}"],"query":[{"key":"created_at","value":""},{"key":"creation_method","value":""},{"key":"status","value":""}],"variable":[]}},"response":[{"id":"047d2445-5eb5-4620-833a-9951940fc85e","name":"Untitled Response","originalRequest":{"method":"POST","header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"},{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"body":{"mode":"urlencoded","urlencoded":[{"description":"(Required) ","key":"id","value":""},{"description":"(Required) ","key":"reason","value":""},{"key":"approval_url","value":""},{"key":"exceptionplan_attachments","value":"[object Object]"},{"key":"exceptionplan_attachments","value":"[object Object]"},{"key":"details","value":""},{"description":"* `FALSE_POSITIVE` - False Positive\n* `RISK_ACCEPTED` - Risk Accepted\n* `RISK_MITIGATED` - Risk Mitigated\n* `NONE` - None","key":"type","value":"FALSE_POSITIVE"},{"key":"expiration_date","value":""},{"description":"Must pass either vuln instance ids or query_data field. If vuln_instance_ids are passed they will be used over query_data.","key":"vuln_instance_ids","value":""},{"description":"Must pass either vuln instance ids or query_data field. If vuln_instance_ids are passed they will be used over query_data.","key":"vuln_instance_ids","value":""},{"key":"grouping","value":"VULN_INSTANCE"},{"key":"query","value":"[object Object]"},{"key":"selected_ids","value":","}]},"url":{"raw":"{{baseUrl}}/remediate/exceptionplan?created_at=&creation_method=&status=","host":["{{baseUrl}}"],"path":["remediate","exceptionplan"],"query":[{"key":"created_at","value":""},{"key":"creation_method","value":""},{"key":"status","value":""}]}},"status":"Created","code":201,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"action_request_ids\": [],\n \"id\": \"\",\n \"reason\": \"\",\n \"approval_url\": \"\",\n \"exceptionplan_attachments\": [\n {\n \"exceptionplan_id\": \"\",\n \"filename\": \"\",\n \"id\": \"\",\n \"url\": \"\",\n \"s3_path\": \"\"\n },\n {\n \"exceptionplan_id\": \"\",\n \"filename\": \"\",\n \"id\": \"\",\n \"url\": \"\",\n \"s3_path\": \"\"\n }\n ],\n \"details\": \"\",\n \"type\": \"FALSE_POSITIVE\",\n \"expiration_date\": \"\",\n \"vuln_instance_ids\": [\n \"\",\n \"\"\n ],\n \"query_data\": {\n \"grouping\": \"VULN_INSTANCE\",\n \"query\": {\n \"description\": \"Either query or selected ids must be provided. If no query is provided, all vuln instances for selected ids will be included.\"\n },\n \"selected_ids\": [\n \"\",\n \"\"\n ]\n }\n}"}],"_postman_id":"818abe13-fa22-4be0-b42d-5f90f1efbd52"},{"name":"Get Exception Plan Details","id":"2f5059bf-826b-437f-802e-f751151ce0d6","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/exceptionplan/:id","description":"

Last reviewed: 2026-08-02

\n

Get a single Exception Plan by ID.

\n

Returns everything Get Exception Plans does, plus fields the list endpoint omits: type, expiration_date, reason, submitter, owner, action_request_ids, comment.

\n

A few things worth knowing:

\n
    \n

  • submitter, owner, and approver are three separate full user objects, not always the same person - don't assume one implies another.

    \n
    • \n

  • comment is raw HTML, same as details - render accordingly.

    \n
    • \n

  • action_request_ids are internal tracking IDs for the async job(s) linked to this plan (same ID family documented on Create Remediation Action) - not vuln instance or plan IDs.

    \n
    • \n

  • reason is one of the strings from Get Reasons for Exception Plans, not free text.

    \n
    • \n
\n

Additional fields beyond the Get Exception Plans example (illustrative, not the real record):

\n
\"type\": \"RISK_ACCEPTED\",\n\"expiration_date\": \"2026-07-22T19:00:00Z\",\n\"reason\": \"Vendor patch scheduled for next maintenance window\",\n\"submitter\": { ...same shape as approver... },\n\"owner\": { ...same shape as approver... },\n\"action_request_ids\": [\"d8d671d5-6045-4066-9da2-441116687e98\"],\n\"comment\": \"<p class=&#x27;preserveHtml&#x27; class=&#x27;preserveHtml&#x27;>Approved pending vendor confirmation</p>\"\n\n
","urlObject":{"path":["remediate","exceptionplan",":id"],"host":["{{baseUrl}}"],"query":[],"variable":[{"id":"bd9f62b5-8fc0-4035-b822-b3f34f5f695d","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"","key":"id"}]}},"response":[{"id":"9894c8d3-5ee3-4410-bb82-5726bb0c3648","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/remediate/exceptionplan/:id","host":["{{baseUrl}}"],"path":["remediate","exceptionplan",":id"],"variable":[{"key":"id"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"action_request_ids\": [],\n \"approval_date\": \"\",\n \"approver\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"QkRA@h9FvcX\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"created_at\": \"\",\n \"creation_method\": \"AUTO\",\n \"id\": \"\",\n \"plan_id\": \"\",\n \"reason\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"kTG.z7JXrr\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"updated_at\": \"\",\n \"approval_url\": \"\",\n \"approver_id\": \"\",\n \"exceptionplan_attachments\": [\n {\n \"exceptionplan_id\": \"\",\n \"filename\": \"\",\n \"id\": \"\",\n \"url\": \"\",\n \"s3_path\": \"\"\n },\n {\n \"exceptionplan_id\": \"\",\n \"filename\": \"\",\n \"id\": \"\",\n \"url\": \"\",\n \"s3_path\": \"\"\n }\n ],\n \"details\": \"\",\n \"status\": \"CANCELLED\",\n \"type\": \"FALSE_POSITIVE\",\n \"expiration_date\": \"\",\n \"vuln_instance_ids\": [\n \"\",\n \"\"\n ],\n \"query_data\": {\n \"grouping\": \"TARGET\",\n \"query\": {\n \"description\": \"Either query or selected ids must be provided. If no query is provided, all vuln instances for selected ids will be included.\"\n },\n \"selected_ids\": [\n \"\",\n \"\"\n ]\n }\n}"}],"_postman_id":"2f5059bf-826b-437f-802e-f751151ce0d6"},{"name":"Get Exception Plan Vuln Instances","id":"fb335a9f-356f-49ad-a56e-c0471acbec49","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/exceptionplan/:plan_id/vuln_instance","description":"

Last reviewed: 2026-08-02

\n

Retrieve the vuln instances covered by a specific Exception Plan, with target and vulnerability detail attached.

\n

Standard paginated envelope, but the objects inside results are flat with dotted-string keys (e.g. \"vuln_instance_data.derived.combined_status\"), not nested JSON like every other endpoint in this collection. Parse accordingly - don't assume you can walk result.vuln_instance_data.derived.combined_status as nested objects.

\n

A few things worth knowing:

\n
    \n

  • No id or vuln_instance_id field anywhere in the response, despite the endpoint name. If you need to reference these instances elsewhere (e.g. vuln_instance_ids on Create Exception Plan), there's nothing here to grab - vulnerability_data.scanner_vuln_id (a CVE) plus target name/location is the closest thing to an identifier.

    \n
    • \n

  • Each result embeds its own vuln_instance_data.exception_plan.\\* fields (type, reason, expiration_date, status, approval_date).

    \n
    • \n

  • vulnerability_data.vuln_info.description is a long summary/impact/remediation blob, not a short string - plan for it in UI layouts.

    \n
    • \n
\n","urlObject":{"path":["remediate","exceptionplan",":plan_id","vuln_instance"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":""},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":""}],"variable":[{"id":"e8605746-6225-4707-9f3c-055ee6960642","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"","key":"plan_id"}]}},"response":[{"id":"aa79d7a9-a278-4023-96fc-c2074bc15fcb","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"key":"X-NOPSEC-API-KEY","value":"","description":"Added as a part of security scheme: apikey"}],"url":{"raw":"{{baseUrl}}/remediate/exceptionplan/:plan_id/vuln_instance?limit=&offset=","host":["{{baseUrl}}"],"path":["remediate","exceptionplan",":plan_id","vuln_instance"],"query":[{"key":"limit","value":"","description":"Number of results to return per page."},{"key":"offset","value":"","description":"The initial index from which to return the results."}],"variable":[{"key":"plan_id","value":""}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": \"\",\n \"next\": \"\",\n \"previous\": \"\",\n \"results\": [\n {\n \"derived_target_criticality\": \"HIGH\",\n \"derived_target_division\": \"\",\n \"derived_target_risk_grade\": \"\",\n \"derived_target_risk_score\": \"\",\n \"derived_vuln_cve_list\": [\n \"\",\n \"\"\n ],\n \"derived_vuln_risk_grade\": \"\",\n \"derived_vuln_risk_score\": \"\",\n \"exceptionplan_status\": \"\",\n \"first_detected_date\": \"\",\n \"id\": \"\",\n \"remediation_date\": \"\",\n \"status\": \"\",\n \"target_id\": \"\",\n \"target_location\": \"\",\n \"target_name\": \"\",\n \"target_type\": \"\",\n \"vuln_cves\": [],\n \"vuln_cwes\": [],\n \"vuln_description\": \"\",\n \"vuln_id\": \"\",\n \"vuln_max_cvssv3\": \"\",\n \"vuln_title\": \"\"\n },\n {\n \"derived_target_criticality\": \"CRITICAL\",\n \"derived_target_division\": \"\",\n \"derived_target_risk_grade\": \"\",\n \"derived_target_risk_score\": \"\",\n \"derived_vuln_cve_list\": [\n \"\",\n \"\"\n ],\n \"derived_vuln_risk_grade\": \"\",\n \"derived_vuln_risk_score\": \"\",\n \"exceptionplan_status\": \"\",\n \"first_detected_date\": \"\",\n \"id\": \"\",\n \"remediation_date\": \"\",\n \"status\": \"\",\n \"target_id\": \"\",\n \"target_location\": \"\",\n \"target_name\": \"\",\n \"target_type\": \"\",\n \"vuln_cves\": [],\n \"vuln_cwes\": [],\n \"vuln_description\": \"\",\n \"vuln_id\": \"\",\n \"vuln_max_cvssv3\": \"\",\n \"vuln_title\": \"\"\n }\n ]\n}"}],"_postman_id":"fb335a9f-356f-49ad-a56e-c0471acbec49"},{"name":"Get Reasons for Exception Plans","id":"942d3120-75d1-4de3-b686-978b0f3c2dd3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/exceptionplan/client-setting","description":"

Last reviewed: 2026-08-02

\n

A Reason is required to create an Exception Plan. Reasons are configured per-client by your Admin team - use this to get the valid strings and pass one verbatim as reason in Create Exception Plan.

\n

Response is {\"exceptionplan_reasons\": [...]} - a flat array of strings, not objects, and not wrapped in the standard paginated envelope.

\n","urlObject":{"path":["remediate","exceptionplan","client-setting"],"host":["{{baseUrl}}"],"query":[],"variable":[]}},"response":[{"id":"e6c66d3c-8424-4580-be00-8e17f13395ee","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":"{{baseUrl}}/remediate/exceptionplan/client-setting"},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"exceptionplan_reasons\": [\n \"\",\n \"\"\n ]\n}"}],"_postman_id":"942d3120-75d1-4de3-b686-978b0f3c2dd3"}],"id":"60d87982-d2f0-474f-aebf-dfc3861126fb","_postman_id":"60d87982-d2f0-474f-aebf-dfc3861126fb","description":""},{"name":"Remediation Actions","item":[{"name":"Get ITSM Destination Setting Detail","id":"a3dfb8f9-0d0f-4761-9bab-828d0ca6d619","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/itsm/:group_by/destination","description":"

Last reviewed: 2026-08-02

\n

Lists the active ITSM destinations available for a given group_by value.

\n

A few things worth knowing:

\n
    \n

  • Each result has two IDs: the top-level id (this group_by-to-destination association) and the nested itsm_destination.id (the destination itself). This nested itsm_destination.id is the value that shows up as itsm_destination_id on Get Remediation Action Details for a real action pointed at this destination - matching id, name, and destination exactly.

    \n
    • \n

  • group_by in the path must be a valid grouping value (e.g. TARGET, ASSET) - untested whether other values return different or empty destination lists for this client.

    \n
    • \n
\n

Example (illustrative, not the real record):

\n
{\n  \"count\": 1,\n  \"results\": [{\n    \"id\": \"a1b2c3d4-e5f6-4789-90ab-cdef01234567\",\n    \"group_by\": \"VULNERABILITY\",\n    \"is_active\": true,\n    \"itsm_destination\": {\n      \"id\": \"b2c3d4e5-f6a7-4861-91bc-def012345678\",\n      \"name\": \"UVRM\",\n      \"destination\": \"UVRM\",\n      \"is_active\": true,\n      \"itsm_integration_name\": \"Jira Test 01\",\n      \"itsm_product_name\": \"JIRA\",\n      \"itsm_product_logo\": \"https://assets.nopsec.com/assets/jira_logo.png\"\n    }\n  }]\n}\n\n
","urlObject":{"path":["remediate","itsm",":group_by","destination"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":""},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":""}],"variable":[{"id":"645ad82b-db66-4dff-8041-481bdcdccfe3","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"TARGET","key":"group_by"}]}},"response":[{"id":"e870d331-323b-4e46-b4fd-50a15eab25a4","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/remediate/itsm/:group_by/destination?limit=&offset=","host":["{{baseUrl}}"],"path":["remediate","itsm",":group_by","destination"],"query":[{"description":"Number of results to return per page.","key":"limit","value":""},{"description":"The initial index from which to return the results.","key":"offset","value":""}],"variable":[{"key":"group_by"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": \"\",\n \"next\": \"\",\n \"previous\": \"\",\n \"results\": [\n {\n \"group_by\": \"TARGET\",\n \"id\": \"\",\n \"itsm_destination\": {\n \"destination\": \"\",\n \"id\": \"\",\n \"itsm_integration_name\": \"\",\n \"itsm_product_logo\": \"\",\n \"itsm_product_name\": \"\",\n \"name\": \"\",\n \"is_active\": \"\"\n },\n \"is_active\": \"\"\n },\n {\n \"group_by\": \"VULN\",\n \"id\": \"\",\n \"itsm_destination\": {\n \"destination\": \"\",\n \"id\": \"\",\n \"itsm_integration_name\": \"\",\n \"itsm_product_logo\": \"\",\n \"itsm_product_name\": \"\",\n \"name\": \"\",\n \"is_active\": \"\"\n },\n \"is_active\": \"\"\n }\n ]\n}"}],"_postman_id":"a3dfb8f9-0d0f-4761-9bab-828d0ca6d619"},{"name":"Get Remediation Actions","id":"835e9e57-35db-49f3-94cb-b3d321528d1a","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/remediationplan/action","description":"

Last reviewed: 2026-08-02

\n

Lists remediation actions you have access to. An Action holds one or more Plans depending on the group_by used to create it; each Plan tracks one or more vuln instances.

\n

A few things worth knowing:

\n
    \n

  • Each action has two IDs: action_id (a short numeric string, e.g. \"424\") and id (a UUID). Use id for the path on Get Remediation Action Details and Get Plans in Remediation Action.

    \n
    • \n

  • Ownership is represented three different ways on the same object: owner (full user object), owner_id (duplicate of owner.id), and owners (an array with a different, flatter shape that includes type: \"user\" - implying it may also support type: \"team\", untested). submitter is yet another full user object, and can differ from owner.

    \n
    • \n

  • itsm_destination_id / itsm_destination follow the same pattern as Get ITSM Destination Setting Detail - both null here since this action has no ITSM destination set.

    \n
    • \n

  • total_plans_count / total_vuln_instances_count and remediated_vuln_instances_count / excepted_vuln_instances_count give you action-level rollups without needing to call Get Plans in Remediation Action separately.

    \n
    • \n
\n

Query params (all optional): created_at, creation_method, due_date, is_canceled, limit, offset, ordering, search, team_id.

\n

Example (illustrative, PII scrubbed - real record had a real employee's name/email in owner/submitter/owners):

\n
{\n  \"action_id\": \"424\",\n  \"id\": \"a1b2c3d4-e5f6-4789-90ab-cdef01234567\",\n  \"name\": \"Example Action - 20260801 1353\",\n  \"group_by\": \"VULN_INSTANCE\",\n  \"creation_method\": \"AUTO\",\n  \"is_canceled\": false,\n  \"itsm_destination_id\": null,\n  \"itsm_destination\": null,\n  \"owner\": { \"id\": 56, \"full_name\": \"Jane Smith\", \"email\": \"jane.smith@example.com\" },\n  \"owner_id\": 56,\n  \"owners\": [{ \"id\": 56, \"name\": \"Jane Smith\", \"type\": \"user\", \"email\": \"jane.smith@example.com\" }],\n  \"submitter\": { \"id\": 56, \"full_name\": \"Jane Smith\", \"email\": \"jane.smith@example.com\" },\n  \"remediated_vuln_instances_count\": 0,\n  \"excepted_vuln_instances_count\": 0,\n  \"total_plans_count\": 5,\n  \"total_vuln_instances_count\": 5\n}\n\n
","urlObject":{"path":["remediate","remediationplan","action"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"key":"created_at","value":""},{"disabled":true,"key":"creation_method","value":""},{"disabled":true,"key":"due_date","value":""},{"disabled":true,"key":"is_canceled","value":""},{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":""},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":""},{"disabled":true,"description":{"content":"

Which field to use when ordering the results.

\n","type":"text/plain"},"key":"ordering","value":""},{"disabled":true,"description":{"content":"

A search term.

\n","type":"text/plain"},"key":"search","value":""},{"disabled":true,"key":"team_id","value":""}],"variable":[]}},"response":[{"id":"c0900144-a444-4657-911c-e1b90f84ce87","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/remediate/remediationplan/action?created_at=&creation_method=&due_date=&is_canceled=&limit=&offset=&ordering=&search=&team_id=","host":["{{baseUrl}}"],"path":["remediate","remediationplan","action"],"query":[{"key":"created_at","value":""},{"key":"creation_method","value":""},{"key":"due_date","value":""},{"key":"is_canceled","value":""},{"description":"Number of results to return per page.","key":"limit","value":""},{"description":"The initial index from which to return the results.","key":"offset","value":""},{"description":"Which field to use when ordering the results.","key":"ordering","value":""},{"description":"A search term.","key":"search","value":""},{"key":"team_id","value":""}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": \"\",\n \"next\": \"\",\n \"previous\": \"\",\n \"results\": [\n {\n \"action_id\": \"\",\n \"action_request_ids\": [],\n \"created_at\": \"\",\n \"group_by\": \"TARGET\",\n \"id\": \"\",\n \"itsm_destination\": {\n \"destination\": \"\",\n \"id\": \"\",\n \"itsm_integration_name\": \"\",\n \"itsm_product_logo\": \"\",\n \"itsm_product_name\": \"\",\n \"name\": \"\",\n \"is_active\": \"\"\n },\n \"name\": \"\",\n \"remediated_vuln_instances_count\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"v9N_xff\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"total_plans_count\": \"\",\n \"total_vuln_instances_count\": \"\",\n \"updated_at\": \"\",\n \"is_canceled\": \"\",\n \"creation_method\": \"AUTO\",\n \"created_by\": \"\",\n \"vuln_instance_ids\": [\n \"\",\n \"\"\n ],\n \"query_data\": {\n \"grouping\": \"VULN_INSTANCE\",\n \"query\": {\n \"description\": \"Either query or selected ids must be provided. If no query is provided, all vuln instances for selected ids will be included.\"\n },\n \"selected_ids\": [\n \"\",\n \"\"\n ]\n },\n \"itsm_destination_id\": \"\",\n \"due_date\": \"\",\n \"details\": \"\",\n \"max_number_created\": \"\"\n },\n {\n \"action_id\": \"\",\n \"action_request_ids\": [],\n \"created_at\": \"\",\n \"group_by\": \"NO_GROUP\",\n \"id\": \"\",\n \"itsm_destination\": {\n \"destination\": \"\",\n \"id\": \"\",\n \"itsm_integration_name\": \"\",\n \"itsm_product_logo\": \"\",\n \"itsm_product_name\": \"\",\n \"name\": \"\",\n \"is_active\": \"\"\n },\n \"name\": \"\",\n \"remediated_vuln_instances_count\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"-LC+Rl0bog\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"total_plans_count\": \"\",\n \"total_vuln_instances_count\": \"\",\n \"updated_at\": \"\",\n \"is_canceled\": \"\",\n \"creation_method\": \"AUTO\",\n \"created_by\": \"\",\n \"vuln_instance_ids\": [\n \"\",\n \"\"\n ],\n \"query_data\": {\n \"grouping\": \"VULNERABILITY\",\n \"query\": {\n \"description\": \"Either query or selected ids must be provided. If no query is provided, all vuln instances for selected ids will be included.\"\n },\n \"selected_ids\": [\n \"\",\n \"\"\n ]\n },\n \"itsm_destination_id\": \"\",\n \"due_date\": \"\",\n \"details\": \"\",\n \"max_number_created\": \"\"\n }\n ]\n}"}],"_postman_id":"835e9e57-35db-49f3-94cb-b3d321528d1a"},{"name":"Create Remediation Action","id":"be8a04c5-3872-4a50-8e56-a5e298a92fb0","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"POST","header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"},{"key":"Accept","value":"application/json"}],"body":{"mode":"urlencoded","urlencoded":[{"description":"

(Required)

\n","key":"group_by","value":"TARGET"},{"description":"

(Required)

\n","key":"name","value":""},{"key":"vuln_instance_ids","value":"","description":"

One of vuln_instance_ids or a saved-query field is required. Confirmed live: a list of real vuln instance UUIDs works standalone alongside just group_by and name (no grouping/query/selected_ids needed).

\n","disabled":true},{"key":"grouping","value":"VULNERABILITY","description":"

Unverified. Not required alongside vuln_instance_ids (confirmed unnecessary live). Likely relates to the \"query ID\" creation path mentioned in this endpoint's description, but the exact field shape was not confirmed live in this review - test explicitly before relying on grouping/query/selected_ids.

\n","disabled":true},{"key":"query","value":"[object Object]","disabled":true},{"key":"selected_ids","value":",","disabled":true},{"key":"itsm_destination_id","value":"","description":"

Optional. Confirmed live (2026-07-31): omitting this creates the Remediation Action fine (201, id returned), but resulted in ZERO Plans ever appearing in Get Plans in Remediation Action, checked immediately and after 20+ seconds, with both TARGET and ASSET group_by. This contradicts the \"Local Only destination is set if no destination is provided\" description below, which implies a Plan should still be created. Possible product bug - use a real itsm_destination_id (see Get ITSM Destination Setting Detail) if you need the action to actually produce a visible Plan.

\n","disabled":true},{"key":"due_date","value":"","disabled":true},{"key":"details","value":"","disabled":true},{"key":"max_number_created","value":"","disabled":true}]},"url":"{{baseUrl}}/remediate/remediationplan/action","description":"

Last reviewed: 2026-07-31

\n

Create a remediation action from either a list of specific vuln instance IDs, or (in theory) a saved query. Depending on the Group By you choose, this generates one or more Plans underneath the action - a Plan is what would become a ticket or email to your ITSM if you pointed the action at a real destination instead of leaving it Local Only.

\n
    \n

  • id should NOT be sent in the request - it's a response-only field (the server generates it). The request form used to list it as required; that was a documentation bug, now fixed.

    \n
    • \n

  • vuln_instance_ids only needs to appear once. The form used to list it twice; that duplicate has been removed.

    \n
    • \n

  • Creating with just group_by, name, and vuln_instance_ids (a list of real vuln instance UUIDs) works on its own - no grouping, query, or selected_ids needed. It will return201 Created with a generated id and an action_request_ids array.

    \n
    • \n
\n

Work example:

\n
POST {{baseUrl}}/remediate/remediationplan/action\nContent-Type: application/x-www-form-urlencoded\ngroup_by=ASSET&name=Test action&vuln_instance_ids=c17f0028-33a9-4826-931c-8d06d5e90b6c\n\n

Response (201 Created):

\n
{\n    \"id\": \"9264a2ab-4858-49a5-931c-b9dd8f263cc7\",\n    \"name\": \"Test action\",\n    \"group_by\": \"ASSET\",\n    \"itsm_destination_id\": null,\n    \"due_date\": null,\n    \"details\": \"\",\n    \"action_request_ids\": [\n        \"d8d671d5-6045-4066-9da2-441116687e98\"\n    ]\n}\n\n
\n

Note the response does NOT echo back vuln_instance_ids - only action_request_ids, an internal tracking ID for the async job that turns your request into Plans.

\n

Depending on your Group By setting there may be one or more Plans created. You can think of Plans as the tickets or emails that would be sent to your ITSM if you selected a destination other than Local Only.

\n","urlObject":{"path":["remediate","remediationplan","action"],"host":["{{baseUrl}}"],"query":[],"variable":[]}},"response":[{"id":"960d5218-4724-480a-a0fa-673d6a07083f","name":"Untitled Response","originalRequest":{"method":"POST","header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"},{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"body":{"mode":"urlencoded","urlencoded":[{"description":"(Required) ","key":"group_by","value":"TARGET"},{"description":"(Required) ","key":"id","value":""},{"description":"(Required) ","key":"name","value":""},{"key":"vuln_instance_ids","value":""},{"key":"vuln_instance_ids","value":""},{"key":"grouping","value":"VULNERABILITY"},{"key":"query","value":"[object Object]"},{"key":"selected_ids","value":","},{"key":"itsm_destination_id","value":""},{"key":"due_date","value":""},{"key":"details","value":""},{"key":"max_number_created","value":""}]},"url":"{{baseUrl}}/remediate/remediationplan/action"},"status":"Created","code":201,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"action_request_ids\": [],\n \"group_by\": \"TARGET\",\n \"id\": \"\",\n \"name\": \"\",\n \"vuln_instance_ids\": [\n \"\",\n \"\"\n ],\n \"query_data\": {\n \"grouping\": \"VULNERABILITY\",\n \"query\": {\n \"description\": \"Either query or selected ids must be provided. If no query is provided, all vuln instances for selected ids will be included.\"\n },\n \"selected_ids\": [\n \"\",\n \"\"\n ]\n },\n \"itsm_destination_id\": \"\",\n \"due_date\": \"\",\n \"details\": \"\",\n \"max_number_created\": \"\"\n}"}],"_postman_id":"be8a04c5-3872-4a50-8e56-a5e298a92fb0"},{"name":"Get Plans in Remediation Action","id":"5aff5258-e445-45d4-97bc-544a0cf02466","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/remediationplan/action/:action_id/plan","description":"

Last reviewed: 2026-08-02

\n

Lists the Plans created by a specific Remediation Action. Use it to get Plan IDs before calling Get Plan Details or Get Vuln Instances within Plan.

\n

The action_id path segment is the id UUID field from Get Remediation Actions, not the shorter action_id field shown in that response.

\n

A few things worth knowing:

\n
    \n

  • Same two-ID pattern as elsewhere: each Plan has id (a UUID - use this for Get Plan Details / Get Vuln Instances within Plan) and plan_id (a human-readable code like \"421-1\").

    \n
    • \n

  • Same triple ownership representation as Get Remediation Actions: owner (object), owner_id (duplicate), owners (array), plus a separate submitter object.

    \n
    • \n

  • itsmticket nests the actual ITSM ticket info (destination, ticket id) if one was created for this Plan - destination at the Plan level (e.g. \"UVRM\") is a plain string, not the full object you'd get from Get ITSM Destination Setting Detail.

    \n
    • \n

  • total_vuln_instances_count here is per-Plan, not per-Action - don't confuse it with the same-named field on Get Remediation Actions.

    \n
    • \n
\n

Query params (all optional): limit, offset, ordering, search.

\n

Example (illustrative, PII scrubbed - real record had a real employee's name/email in owner/submitter/owners):

\n
{\n  \"id\": \"a1b2c3d4-e5f6-4789-90ab-cdef01234567\",\n  \"plan_id\": \"421-1\",\n  \"group_by\": \"ASSET\",\n  \"status\": \"IN_PROGRESS\",\n  \"submitter\": { \"id\": 1873, \"full_name\": \"Jane Smith\", \"email\": \"jane.smith@example.com\" },\n  \"owner\": { \"id\": 1873, \"full_name\": \"Jane Smith\", \"email\": \"jane.smith@example.com\" },\n  \"owners\": [{ \"id\": 1873, \"name\": \"Jane Smith\", \"type\": \"user\" }],\n  \"remediated_vuln_instances_count\": 0,\n  \"excepted_vuln_instances_count\": 0,\n  \"total_vuln_instances_count\": 198,\n  \"destination\": \"UVRM\",\n  \"itsmticket\": {\n    \"id\": \"b2c3d4e5-f6a7-4890-91bc-def012345678\",\n    \"remediation_plan_id\": \"a1b2c3d4-e5f6-4789-90ab-cdef01234567\"\n  }\n}\n\n
","urlObject":{"path":["remediate","remediationplan","action",":action_id","plan"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":""},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":""},{"disabled":true,"description":{"content":"

Which field to use when ordering the results.

\n","type":"text/plain"},"key":"ordering","value":""},{"disabled":true,"description":{"content":"

A search term.

\n","type":"text/plain"},"key":"search","value":""}],"variable":[{"id":"a1467199-a39b-46fd-ae37-c9cfe29f8799","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"","key":"action_id"}]}},"response":[{"id":"80bee676-779f-41af-8d6a-84d440485b73","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/remediate/remediationplan/action/:action_id/plan?limit=&offset=&ordering=&search=","host":["{{baseUrl}}"],"path":["remediate","remediationplan","action",":action_id","plan"],"query":[{"description":"Number of results to return per page.","key":"limit","value":""},{"description":"The initial index from which to return the results.","key":"offset","value":""},{"description":"Which field to use when ordering the results.","key":"ordering","value":""},{"description":"A search term.","key":"search","value":""}],"variable":[{"key":"action_id"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": \"\",\n \"next\": \"\",\n \"previous\": \"\",\n \"results\": [\n {\n \"action_request_ids\": [],\n \"created_at\": \"\",\n \"creation_method\": \"\",\n \"derived_vuln_instance_info\": {\n \"derived_target_criticality\": \"LOW\",\n \"derived_target_risk_grade\": \"\",\n \"derived_target_risk_score\": \"\",\n \"derived_vuln_cve_list\": [\n \"\",\n \"\"\n ],\n \"derived_vuln_risk_grade\": \"\",\n \"derived_vuln_risk_score\": \"\",\n \"exceptionplan_status\": \"\",\n \"first_detected_date\": \"\",\n \"id\": \"\",\n \"remediation_date\": \"\",\n \"status\": \"\",\n \"target_id\": \"\",\n \"target_location\": \"\",\n \"target_name\": \"\",\n \"target_type\": \"\",\n \"vuln_description\": \"\",\n \"vuln_id\": \"\",\n \"vuln_max_cvssv3\": \"\",\n \"vuln_title\": \"\"\n },\n \"details\": \"\",\n \"due_date\": \"\",\n \"group_by\": \"\",\n \"id\": \"\",\n \"itsmticket\": {\n \"destination_users\": [\n {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"Fh\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"LOPUmNW@\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n }\n ],\n \"ext_url\": \"\",\n \"group_by\": \"NO_GROUP\",\n \"id\": \"\",\n \"itsm_destination\": {\n \"destination\": \"\",\n \"id\": \"\",\n \"itsm_integration_name\": \"\",\n \"itsm_product_logo\": \"\",\n \"itsm_product_name\": \"\",\n \"name\": \"\",\n \"is_active\": \"\"\n },\n \"remediation_plan_id\": \"\",\n \"internal_status\": \"\",\n \"ext_id\": \"\",\n \"ext_number\": \"\",\n \"ext_status\": \"\",\n \"ext_assignee\": \"\",\n \"destination_ext_email_list\": [\n \"\",\n \"\"\n ]\n },\n \"plan_id\": \"\",\n \"remediated_vuln_instances_count\": \"\",\n \"remediation_action_id\": \"\",\n \"status\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"_Z6BOVtjK\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"total_vuln_instances_count\": \"\",\n \"updated_at\": \"\"\n },\n {\n \"action_request_ids\": [],\n \"created_at\": \"\",\n \"creation_method\": \"\",\n \"derived_vuln_instance_info\": {\n \"derived_target_criticality\": \"NONE\",\n \"derived_target_risk_grade\": \"\",\n \"derived_target_risk_score\": \"\",\n \"derived_vuln_cve_list\": [\n \"\",\n \"\"\n ],\n \"derived_vuln_risk_grade\": \"\",\n \"derived_vuln_risk_score\": \"\",\n \"exceptionplan_status\": \"\",\n \"first_detected_date\": \"\",\n \"id\": \"\",\n \"remediation_date\": \"\",\n \"status\": \"\",\n \"target_id\": \"\",\n \"target_location\": \"\",\n \"target_name\": \"\",\n \"target_type\": \"\",\n \"vuln_description\": \"\",\n \"vuln_id\": \"\",\n \"vuln_max_cvssv3\": \"\",\n \"vuln_title\": \"\"\n },\n \"details\": \"\",\n \"due_date\": \"\",\n \"group_by\": \"\",\n \"id\": \"\",\n \"itsmticket\": {\n \"destination_users\": [\n {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"GSsZo0Z\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"ya.rQkMG@V4\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n }\n ],\n \"ext_url\": \"\",\n \"group_by\": \"VULN_INSTANCE\",\n \"id\": \"\",\n \"itsm_destination\": {\n \"destination\": \"\",\n \"id\": \"\",\n \"itsm_integration_name\": \"\",\n \"itsm_product_logo\": \"\",\n \"itsm_product_name\": \"\",\n \"name\": \"\",\n \"is_active\": \"\"\n },\n \"remediation_plan_id\": \"\",\n \"internal_status\": \"\",\n \"ext_id\": \"\",\n \"ext_number\": \"\",\n \"ext_status\": \"\",\n \"ext_assignee\": \"\",\n \"destination_ext_email_list\": [\n \"\",\n \"\"\n ]\n },\n \"plan_id\": \"\",\n \"remediated_vuln_instances_count\": \"\",\n \"remediation_action_id\": \"\",\n \"status\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"2.U_Iopu5Q5\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"total_vuln_instances_count\": \"\",\n \"updated_at\": \"\"\n }\n ]\n}"}],"_postman_id":"5aff5258-e445-45d4-97bc-544a0cf02466"},{"name":"Get Plan Details","id":"9f4ee27a-0f77-4946-9cf2-7a2ed651c997","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/remediationplan/action/:action_id/plan/:id","description":"

Last reviewed: 2026-08-02

\n

Get a single Plan's details by Action ID and Plan ID.

\n

Both action_id and id in the path are internal record UUIDs (the id fields from Get Remediation Actions and Get Plans in Remediation Action), not the shorter action_id or plan_id display values.

\n

Same object shape as a single item in Get Plans in Remediation Action's results array - see that doc for the field-level notes (the id/plan_id duality, the triple ownership representation, itsmticket, etc.). This endpoint just fetches one by ID instead of listing all of them.

\n","urlObject":{"path":["remediate","remediationplan","action",":action_id","plan",":id"],"host":["{{baseUrl}}"],"query":[],"variable":[{"id":"a8ee014b-2ae4-4d0e-a754-f99b32ecb345","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"","key":"action_id"},{"id":"fa47738c-6829-493a-aef3-4beda735249b","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"","key":"id"}]}},"response":[{"id":"f0c06625-50ff-480b-b508-debd22f4f98b","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/remediate/remediationplan/action/:action_id/plan/:id","host":["{{baseUrl}}"],"path":["remediate","remediationplan","action",":action_id","plan",":id"],"variable":[{"key":"action_id"},{"key":"id"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"action_request_ids\": [],\n \"created_at\": \"\",\n \"creation_method\": \"\",\n \"derived_vuln_instance_info\": {\n \"derived_target_criticality\": \"NONE\",\n \"derived_target_risk_grade\": \"\",\n \"derived_target_risk_score\": \"\",\n \"derived_vuln_cve_list\": [\n \"\",\n \"\"\n ],\n \"derived_vuln_risk_grade\": \"\",\n \"derived_vuln_risk_score\": \"\",\n \"exceptionplan_status\": \"\",\n \"first_detected_date\": \"\",\n \"id\": \"\",\n \"remediation_date\": \"\",\n \"status\": \"\",\n \"target_id\": \"\",\n \"target_location\": \"\",\n \"target_name\": \"\",\n \"target_type\": \"\",\n \"vuln_description\": \"\",\n \"vuln_id\": \"\",\n \"vuln_max_cvssv3\": \"\",\n \"vuln_title\": \"\"\n },\n \"details\": \"\",\n \"due_date\": \"\",\n \"group_by\": \"\",\n \"id\": \"\",\n \"itsmticket\": {\n \"destination_users\": [\n {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"UQu+\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"bHmtHHe\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n }\n ],\n \"ext_url\": \"\",\n \"group_by\": \"VULN_INSTANCE\",\n \"id\": \"\",\n \"itsm_destination\": {\n \"destination\": \"\",\n \"id\": \"\",\n \"itsm_integration_name\": \"\",\n \"itsm_product_logo\": \"\",\n \"itsm_product_name\": \"\",\n \"name\": \"\",\n \"is_active\": \"\"\n },\n \"remediation_plan_id\": \"\",\n \"internal_status\": \"\",\n \"ext_id\": \"\",\n \"ext_number\": \"\",\n \"ext_status\": \"\",\n \"ext_assignee\": \"\",\n \"destination_ext_email_list\": [\n \"\",\n \"\"\n ]\n },\n \"plan_id\": \"\",\n \"remediated_vuln_instances_count\": \"\",\n \"remediation_action_id\": \"\",\n \"status\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \".P\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"total_vuln_instances_count\": \"\",\n \"updated_at\": \"\"\n}"}],"_postman_id":"9f4ee27a-0f77-4946-9cf2-7a2ed651c997"},{"name":"Get Vuln Instances within Plan","id":"9ff222c7-50d9-41f8-b471-2ee36d3e577d","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/remediationplan/action/:action_id/plan/:plan_id/vuln_instance","description":"

Last reviewed: 2026-08-02

\n

Retrieve the vuln instances covered by a specific Remediation Plan.

\n

A few things worth knowing:

\n
    \n

  • Path variable is plan_id, but note it takes the same internal id UUID used elsewhere (from Get Plans in Remediation Action / Get Plan Details), not the human-readable plan_id display value (e.g. \"421-1\"). The parameter name is misleading - same trap as action_id on sibling endpoints.

    \n
    • \n

  • Like Get Exception Plan Vuln Instances, results are flat with dotted-string keys (e.g. \"vuln_instance_data.derived.combined_status\"), not nested JSON.

    \n
    • \n

  • Unlike that Exception Plan endpoint, this one does include an identifier: vuln_instance_data.id. Use that if you need to reference a specific instance elsewhere.

    \n
    • \n
\n

Query params (all optional): limit, offset.

\n","urlObject":{"path":["remediate","remediationplan","action",":action_id","plan",":plan_id","vuln_instance"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":""},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":""}],"variable":[{"id":"ad2fdc34-2869-4076-b22e-f62de65586ba","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"","key":"action_id"},{"id":"a2a7459e-1757-490b-9875-4ecc0bb31829","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"","key":"plan_id"}]}},"response":[{"id":"74df63c6-f3a2-44f9-8551-b8e9aef0ec59","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"key":"X-NOPSEC-API-KEY","value":"","description":"Added as a part of security scheme: apikey"}],"url":{"raw":"{{baseUrl}}/remediate/remediationplan/action/:action_id/plan/:plan_id/vuln_instance?limit=&offset=","host":["{{baseUrl}}"],"path":["remediate","remediationplan","action",":action_id","plan",":plan_id","vuln_instance"],"query":[{"key":"limit","value":"","description":"Number of results to return per page."},{"key":"offset","value":"","description":"The initial index from which to return the results."}],"variable":[{"key":"action_id","value":""},{"key":"plan_id","value":""}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": \"\",\n \"next\": \"\",\n \"previous\": \"\",\n \"results\": [\n {\n \"derived_target_criticality\": \"HIGH\",\n \"derived_target_division\": \"\",\n \"derived_target_risk_grade\": \"\",\n \"derived_target_risk_score\": \"\",\n \"derived_vuln_cve_list\": [\n \"\",\n \"\"\n ],\n \"derived_vuln_risk_grade\": \"\",\n \"derived_vuln_risk_score\": \"\",\n \"exceptionplan_status\": \"\",\n \"first_detected_date\": \"\",\n \"id\": \"\",\n \"remediation_date\": \"\",\n \"status\": \"\",\n \"target_id\": \"\",\n \"target_location\": \"\",\n \"target_name\": \"\",\n \"target_type\": \"\",\n \"vuln_cves\": [],\n \"vuln_cwes\": [],\n \"vuln_description\": \"\",\n \"vuln_id\": \"\",\n \"vuln_max_cvssv3\": \"\",\n \"vuln_title\": \"\"\n },\n {\n \"derived_target_criticality\": \"CRITICAL\",\n \"derived_target_division\": \"\",\n \"derived_target_risk_grade\": \"\",\n \"derived_target_risk_score\": \"\",\n \"derived_vuln_cve_list\": [\n \"\",\n \"\"\n ],\n \"derived_vuln_risk_grade\": \"\",\n \"derived_vuln_risk_score\": \"\",\n \"exceptionplan_status\": \"\",\n \"first_detected_date\": \"\",\n \"id\": \"\",\n \"remediation_date\": \"\",\n \"status\": \"\",\n \"target_id\": \"\",\n \"target_location\": \"\",\n \"target_name\": \"\",\n \"target_type\": \"\",\n \"vuln_cves\": [],\n \"vuln_cwes\": [],\n \"vuln_description\": \"\",\n \"vuln_id\": \"\",\n \"vuln_max_cvssv3\": \"\",\n \"vuln_title\": \"\"\n }\n ]\n}"}],"_postman_id":"9ff222c7-50d9-41f8-b471-2ee36d3e577d"},{"name":"Get Remediation Action Details","id":"f013b81e-bc95-4648-88b8-9bf8135cef7a","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/remediate/remediationplan/action/:id","description":"

Last reviewed: 2026-08-02

\n

Get a single Remediation Action's details by ID - metadata like the creator, plan count, status, and description, not the vuln instances themselves.

\n

The path uses id, the internal record UUID, not action_id (the shorter human-facing number shown in the UI) - use the id from Get Remediation Actions here.

\n

A few things worth knowing:

\n
    \n

  • itsm_destination here matches the shape from Get ITSM Destination Setting Detail exactly and this is the strongest evidence that endpoint's nested itsm_destination.id is the right value to pass as itsm_destination_id on Create Remediation Action.

    \n
    • \n

  • created_by is a plain string (the creator's full name), unlike owner/submitter elsewhere in this API family, which are full nested user objects. Don't assume it's an object.

    \n
    • \n

  • details is raw HTML, same as elsewhere in this API.

    \n
    • \n
\n","urlObject":{"path":["remediate","remediationplan","action",":id"],"host":["{{baseUrl}}"],"query":[],"variable":[{"id":"7087c246-7322-45fd-8401-a380a2e2900c","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"e21f4245-7bff-4860-aff9-3df4ed848b32","key":"id"}]}},"response":[{"id":"75bddbc7-0336-41f6-a915-5698ddc0373c","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/remediate/remediationplan/action/:id","host":["{{baseUrl}}"],"path":["remediate","remediationplan","action",":id"],"variable":[{"key":"id"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"action_id\": \"\",\n \"action_request_ids\": [],\n \"created_at\": \"\",\n \"group_by\": \"TARGET\",\n \"id\": \"\",\n \"itsm_destination\": {\n \"destination\": \"\",\n \"id\": \"\",\n \"itsm_integration_name\": \"\",\n \"itsm_product_logo\": \"\",\n \"itsm_product_name\": \"\",\n \"name\": \"\",\n \"is_active\": \"\"\n },\n \"name\": \"\",\n \"remediated_vuln_instances_count\": \"\",\n \"submitter\": {\n \"email\": \"\",\n \"full_name\": \"\",\n \"username\": \"fJtB0E5\",\n \"first_name\": \"\",\n \"last_name\": \"\",\n \"department\": \"\",\n \"job_title\": \"\",\n \"is_active\": \"\"\n },\n \"total_plans_count\": \"\",\n \"total_vuln_instances_count\": \"\",\n \"updated_at\": \"\",\n \"is_canceled\": \"\",\n \"creation_method\": \"MANUAL\",\n \"created_by\": \"\",\n \"vuln_instance_ids\": [\n \"\",\n \"\"\n ],\n \"query_data\": {\n \"grouping\": \"VULN_INSTANCE\",\n \"query\": {\n \"description\": \"Either query or selected ids must be provided. If no query is provided, all vuln instances for selected ids will be included.\"\n },\n \"selected_ids\": [\n \"\",\n \"\"\n ]\n },\n \"itsm_destination_id\": \"\",\n \"due_date\": \"\",\n \"details\": \"\",\n \"max_number_created\": \"\"\n}"}],"_postman_id":"f013b81e-bc95-4648-88b8-9bf8135cef7a"}],"id":"7a1264b1-4fec-4603-b198-6891ef56d4be","_postman_id":"7a1264b1-4fec-4603-b198-6891ef56d4be","description":""},{"name":"Reports","item":[{"name":"Create Download Task","id":"48f71a8a-236d-437d-af89-9c809a851ae0","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"POST","header":[],"body":{"mode":"raw","raw":"{\"download_query\": {\"group_by\": \"ASSET\", \"sort_by\": \"target_data.derived.risk_score-desc\", \"max_download_limit\": 5000}}","options":{"raw":{"language":"json"}}},"url":"{{baseUrl}}/search/download-csv-sql","description":"

What this does

\n

Last reviewed: 2026-07-31

\n

This is step 1 of a 3-step flow for exporting large datasets as CSV. A report can contain millions of rows, so you do not get the file directly. You start a background job here, check on it, then fetch the finished file once it is ready. It works the same way as ordering something online: you place the order, track it, then pick it up once it is done.

\n

The 3 steps:

\n
    \n

  1. Create Download Task (this endpoint) - starts the job, returns a download_request_id

    \n
    2. \n

  2. Download Status (GET /search/download-csv/{download_request_id}) - poll this until status is COMPLETED

    \n
    3. \n

  3. Download CSV File (GET /search/download-csv/{download_request_id}/{file_attachment_id}) - fetch the actual file

    \n
    4. \n
\n

Request body

\n

Send one download_query object. Only group_by is required. Everything below has been confirmed:

\n
    \n

  • group_by (required): what kind of record you are exporting. TARGET, ASSET, VULNERABILITY, or VULN_INSTANCE.

    \n
    • \n

  • saved_query_id (optional): id of a saved filter, from GET /prioritize/saved-query. Passing a real saved_query_id genuinely narrows the results, it is not decorative. Leave it out and you get everything, no filter applied.

    \n
    • \n

  • saved_column_group_by_id (optional): id of a saved column layout, from GET /prioritize/saved-column-group-by. The returned CSV headers match the columns configured on that preset. Leave it out and you get a sensible default set of columns for the group_by you picked.

    \n
    • \n

  • max_download_limit (optional): caps how many rows come back. Leave it out and you get everything that matches.

    \n
    • \n

  • sort_by (optional): a field name, optionally followed by -asc or -desc, for example target_data.derived.risk_score-desc. For example for group_by=ASSET with max_download_limit at or below 10000: rows come back genuinely sorted. Above that limit, or for other group_by values combined with the legacy architecture, treat sort_by as best-effort rather than guaranteed.

    \n
    • \n
\n

Example request body:

\n
{\n  \"download_query\": {\n    \"group_by\": \"VULN_INSTANCE\",\n    \"saved_query_id\": \"3b22a1d2-72d1-4c3e-9a1f-0b1b9d4b55c9\",\n    \"saved_column_group_by_id\": \"8a7e44f1-1a4b-4d3a-9e0d-2a0b3f4d5e6f\",\n    \"max_download_limit\": 10000,\n    \"sort_by\": \"target_data.derived.risk_score-desc\"\n  }\n}\n\n

What you get back

\n
{\n  \"download_request_id\": \"d53e5215-da69-4d01-ab21-e1afa612c485\",\n  \"status\": \"REQUESTED\",\n  \"file_attachment_ids\": [],\n  \"urls\": []\n}\n\n

Hold on to download_request_id. That is what you use in the next two steps to check on the job and to download the file.

\n

Two different IDs, do not mix them up

\n

Once the status check tells you the job is COMPLETED, it hands you a list of file_attachment_ids. That is a different id than download_request_id. A single report can span more than one CSV file (each file caps out at 1 million rows), so each file gets its own id. When you call the Download CSV File endpoint, the first part of the path is your download_request_id, the second part is one of the file_attachment_ids. Mixing them up is the most common mistake integrators make with this API.

\n

Fields you might see in older examples

\n

Some older integrations pass a raw query object, saved_report_id, or fields like data_fields, columns, and ids. Those belong to an earlier version of this API and should not be used going forward. Use saved_query_id and saved_column_group_by_id instead, they cover the same ground with a lot less setup on your end.

\n

saved_report_id specifically: at the time of writing, the test client used to verify this API had zero SavedReport records to reference (GET /prioritize/saved-report returned an empty list). We could not exercise this field with real data. Combined with it having no equivalent in the simplified saved_query_id plus saved_column_group_by_id model, this field is a strong candidate for deprecation. Do not build new integrations on it, and flag it to the platform team as a removal candidate rather than assuming it is safe long term.

\n","urlObject":{"path":["search","download-csv-sql"],"host":["{{baseUrl}}"],"query":[],"variable":[]}},"response":[{"id":"42e8f9e6-8cc7-4d7f-bc25-435520f205a8","name":"Untitled Response","originalRequest":{"method":"POST","header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"},{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"body":{"mode":"urlencoded","urlencoded":[{"description":"(Required) ","key":"group_by","value":"VULNERABILITY"},{"description":"(Required) ","key":"sort_by","value":""},{"description":"(Required) ","key":"query","value":"[object Object]"},{"description":"(Required) ","key":"saved_report_id","value":""},{"description":"(Required) ","key":"saved_query_id","value":""},{"description":"(Required) ","key":"saved_column_group_by_id","value":""},{"description":"(Required) ","key":"data_fields","value":","},{"description":"(Required) ","key":"agg_fields","value":","},{"description":"(Required) ","key":"ids","value":","},{"description":"(Required) ","key":"max_download_limit","value":""},{"description":"(Required) ","key":"limit","value":""},{"description":"(Required) ","key":"offset","value":""},{"description":"(Required) Download Request Id.","key":"download_request_id","value":""},{"description":"(Required) List of file attachment ids","key":"file_attachment_ids","value":""},{"description":"(Required) ","key":"id","value":""},{"description":"(Required) Array of urls to download","key":"urls","value":""},{"description":"* `REQUESTED` - Requested\n* `IN_PROGRESS` - In Progress\n* `COMPLETED` - Completed\n* `ERROR` - Error","key":"status","value":"ERROR"}]},"url":"{{baseUrl}}/search/download-csv"},"status":"Created","code":201,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"download_query\": {\n \"group_by\": \"VULNERABILITY\",\n \"sort_by\": \"\",\n \"query\": {},\n \"saved_report_id\": \"\",\n \"saved_query_id\": \"\",\n \"saved_column_group_by_id\": \"\",\n \"data_fields\": [\n \"\",\n \"\"\n ],\n \"agg_fields\": [\n \"\",\n \"\"\n ],\n \"ids\": [\n \"\",\n \"\"\n ],\n \"max_download_limit\": \"\",\n \"limit\": \"\",\n \"offset\": \"\"\n },\n \"download_request_id\": \"\",\n \"file_attachment_ids\": \"\",\n \"id\": \"\",\n \"urls\": \"\",\n \"status\": \"ERROR\"\n}"}],"_postman_id":"48f71a8a-236d-437d-af89-9c809a851ae0"},{"name":"Download CSV File","id":"9c646581-87a9-4662-b67d-a3dbc47c71a3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"text/csv"}],"url":"{{baseUrl}}/search/download-csv/:download_request_id/:file_attachment_id","description":"

What this does

\n

Last reviewed: 2026-07-31

\n

Step 3, the last one. Fetches the actual CSV bytes for a single file that Download Status told you about. Notice the URL needs two ids, not one: download_request_id identifies the whole export job, file_attachment_id identifies one specific file within it. They point to different records and are not interchangeable.

\n

If your export is small (under 1 million rows) there will be exactly one file_attachment_id and one call here is all you need. If it is bigger, call this once per id in file_attachment_ids and you will get all the pieces of the same report.

\n

Response

\n

A raw CSV file (Content-Type text/csv), with Content-Disposition set so most HTTP clients and browsers will save it directly. Column headers match whatever saved_column_group_by_id you used in Create Download Task, or the default set if you did not provide one.

\n","urlObject":{"path":["search","download-csv",":download_request_id",":file_attachment_id"],"host":["{{baseUrl}}"],"query":[],"variable":[{"id":"27097ab5-341b-4c64-8a49-e60db2c75dd6","description":{"content":"

Required. The download_request_id you got from Create Download Task.

\n","type":"text/plain"},"type":"any","value":"","key":"download_request_id"},{"id":"3370bfb7-5348-4c5c-9ee1-24e224e80cd5","description":{"content":"

Required. A different id than download_request_id, one of the values from file_attachment_ids in Download Status.

\n","type":"text/plain"},"type":"any","value":"","key":"file_attachment_id"}]}},"response":[{"id":"649a8457-6888-4860-b9a4-92d050df0a95","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"text/csv"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/search/download-csv/:download_request_id/:id","host":["{{baseUrl}}"],"path":["search","download-csv",":download_request_id",":id"],"variable":[{"key":"download_request_id"},{"key":"id"}]}},"status":"OK","code":200,"_postman_previewlanguage":"text","header":[{"key":"Content-Type","value":"text/csv"}],"cookie":[],"responseTime":null,"body":"{\n \"incididunt_d\": {},\n \"dolor_3\": {}\n}"}],"_postman_id":"9c646581-87a9-4662-b67d-a3dbc47c71a3"},{"name":"Download Status","id":"702b6336-db38-4cbe-ad4c-0580083a5a4e","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/search/download-csv/:download_request_id","description":"

What this does

\n

Last reviewed: 2026-07-31

\n

Step 2 of the download flow. Poll this endpoint with the download_request_id you got back from Create Download Task, and keep checking until status flips to COMPLETED. A reasonable pattern is to check every few seconds, since most exports finish quickly, but a large one spanning millions of rows can take longer.

\n

Possible status values

\n
    \n

  • REQUESTED: the job is queued, work has not started yet

    \n
    • \n

  • IN_PROGRESS: your data is being pulled and written to file

    \n
    • \n

  • COMPLETED: done, file_attachment_ids is now populated and ready for the next step

    \n
    • \n

  • ERROR: something went wrong. There is no retry, you need to call Create Download Task again to start over

    \n
    • \n
\n

Response shape

\n
{\n  \"download_request_id\": \"d72e1225-da89-4f02-66ba-ea8f3d16c4a2\",\n  \"status\": \"COMPLETED\",\n  \"file_attachment_ids\": [\n    \"2cff4091-862a-41f1-1926-a6d6833823b4\"\n  ],\n  \"urls\": []\n}\n\n

A report over 1 million rows gets split into multiple files, so file_attachment_ids can hold more than one id. Each one belongs to a different chunk of the same report and needs its own call to Download CSV File.

\n","urlObject":{"path":["search","download-csv",":download_request_id"],"host":["{{baseUrl}}"],"query":[],"variable":[{"id":"a715cc32-b3d0-44cd-a3a8-73d0ddffb510","description":{"content":"

(Required)

\n","type":"text/plain"},"type":"any","value":"","key":"download_request_id"}]}},"response":[{"id":"df823512-6a0f-4849-9c8c-38e538230d37","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"description":"Added as a part of security scheme: apikey","key":"X-NOPSEC-API-KEY","value":""}],"url":{"raw":"{{baseUrl}}/search/download-csv/:id","host":["{{baseUrl}}"],"path":["search","download-csv",":id"],"variable":[{"key":"id"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"download_query\": {\n \"group_by\": \"VULNERABILITY\",\n \"sort_by\": \"\",\n \"query\": {},\n \"saved_report_id\": \"\",\n \"saved_query_id\": \"\",\n \"saved_column_group_by_id\": \"\",\n \"data_fields\": [\n \"\",\n \"\"\n ],\n \"agg_fields\": [\n \"\",\n \"\"\n ],\n \"ids\": [\n \"\",\n \"\"\n ],\n \"max_download_limit\": \"\",\n \"limit\": \"\",\n \"offset\": \"\"\n },\n \"download_request_id\": \"\",\n \"file_attachment_ids\": \"\",\n \"id\": \"\",\n \"urls\": \"\",\n \"status\": \"ERROR\"\n}"}],"_postman_id":"702b6336-db38-4cbe-ad4c-0580083a5a4e"}],"id":"5bdc00ea-e305-4b7c-bffc-f298889d1372","_postman_id":"5bdc00ea-e305-4b7c-bffc-f298889d1372","description":""},{"name":"Ingestion","item":[{"name":"Tags File Upload","id":"4f169d33-2853-4c81-87eb-ea40d9890a5b","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"POST","header":[],"body":{"mode":"formdata","formdata":[{"key":"file","description":"

CSV file to be uploaded with headers [target_id,tag_key,tag_value,action,new_value]

\n","type":"file","fileNotInWorkingDirectoryWarning":"This file isn't in your working directory. Teammates you share this request with won't be able to use this file. To make collaboration easier you can setup your working directory in Settings.","filesNotInWorkingDirectory":["/Users/nitinkumar/Downloads/demo_tag_upload_api.csv"],"value":null}]},"url":"{{baseUrl}}/ingestion/tags/upload","description":"

Last reviewed: 2026-07-31

\n

This API allows clients to upload CSV files to manage tags associated with their targets. The tags can be added, modified, or removed based on the specified actions within the CSV file.

\n

CSV Format Requirements:

\n

The uploaded CSV file must include the following headers:

\n
    \n

  • target_id (required): Unique identifier of the target.

    \n
    • \n

  • tag_key (required): The key of the tag to manage.

    \n
    • \n

  • tag_value (conditional): The value of the tag; required for add and modify actions.

    \n
    • \n

  • action (required): The action to perform. Valid options: add, modify, remove.

    \n
    • \n

  • new_value (conditional): The new value for the tag; required for the modify action.

    \n
    • \n
\n

Al four scenarios below have been captured as saved examples on this request (see the tree beneath \"Tags File Upload\") - these are real responses:

\n
    \n

  • Successfully Created - 201 Created, body: \"Tags ingestion task successfully created.\"

    \n
    • \n

  • File not provided - 400, {\"file\": [\"The submitted data was not a file. Check the encoding type on the form.\"]}

    \n
    • \n

  • Invalid CSV headers - 400, message shows the exact expected vs. received header list, e.g. Expected ['target_id', 'tag_key', 'tag_value', 'action', 'new_value'] but got [...]. This confirms the CSV header row must always include all 5 column names, even though tag_value/new_value are only conditionally required per-row.

    \n
    • \n

  • File size is too large - 400, {\"file\": [\"File size exceeds 9.5367421110625e-04 MB\"]} - note the odd scientific-notation limit in this saved example; that's not a copy error, the backend's error message genuinely formats the size limit that way.

    \n
    • \n
\n

This is a write endpoint (creates a real async ingestion task and can modify real tag data). Get explicit go-ahead before sending a real file.

\n","urlObject":{"path":["ingestion","tags","upload"],"host":["{{baseUrl}}"],"query":[],"variable":[]}},"response":[{"id":"1fd81d0f-599a-4b65-8a83-ab9ddafbef5a","name":"Successfully Created","originalRequest":{"method":"POST","header":[],"body":{"mode":"formdata","formdata":[{"key":"file","description":"CSV file to be uploaded with headers [target_id,tag_key,tag_value,action,new_value]","type":"file","fileNotInWorkingDirectoryWarning":"This file isn't in your working directory. Teammates you share this request with won't be able to use this file. To make collaboration easier you can setup your working directory in Settings.","filesNotInWorkingDirectory":["/Users/nitinkumar/Downloads/demo_tag_upload_api.csv"],"value":null}]},"url":"{{baseUrl}}/ingestion/tags/upload"},"status":"Created","code":201,"_postman_previewlanguage":null,"header":null,"cookie":[],"responseTime":null,"body":"\"Tags ingestion task successfully created.\""},{"id":"caeb0959-298e-4706-bed6-91cfd92d216d","name":"File not provided","originalRequest":{"method":"POST","header":[],"body":{"mode":"formdata","formdata":[{"key":"file","description":"CSV file to be uploaded with headers [target_id,tag_key,tag_value,action,new_value]","type":"file","fileNotInWorkingDirectoryWarning":"This file isn't in your working directory. Teammates you share this request with won't be able to use this file. To make collaboration easier you can setup your working directory in Settings.","filesNotInWorkingDirectory":["/Users/nitinkumar/Downloads/demo_tag_upload_api.csv"],"value":null}]},"url":"{{baseUrl}}/ingestion/tags/upload"},"status":"Bad Request","code":400,"_postman_previewlanguage":null,"header":null,"cookie":[],"responseTime":null,"body":"{\n \"file\": [\n \"The submitted data was not a file. Check the encoding type on the form.\"\n ]\n}"},{"id":"8702fb58-7911-41d6-8ccc-63cd38385bdc","name":"Invalid CSV headers","originalRequest":{"method":"POST","header":[],"body":{"mode":"formdata","formdata":[{"key":"file","description":"CSV file to be uploaded with headers [target_id,tag_key,tag_value,action,new_value]","type":"file","fileNotInWorkingDirectoryWarning":"This file isn't in your working directory. Teammates you share this request with won't be able to use this file. To make collaboration easier you can setup your working directory in Settings.","filesNotInWorkingDirectory":["/Users/nitinkumar/Downloads/demo_tag_upload_api.csv"],"value":null}]},"url":"{{baseUrl}}/ingestion/tags/upload"},"status":"Bad Request","code":400,"_postman_previewlanguage":null,"header":null,"cookie":[],"responseTime":null,"body":"{\n \"file\": [\n \"Invalid CSV headers. Expected ['target_id', 'tag_key', 'tag_value', 'action', 'new_value'] but got ['target_id', 'tag_key', 'tag_value', 'action']\"\n ]\n}"},{"id":"6fe32478-73ec-46a7-92a0-95fe08566e8f","name":"File size is too large","originalRequest":{"method":"POST","header":[],"body":{"mode":"formdata","formdata":[{"key":"file","description":"CSV file to be uploaded with headers [target_id,tag_key,tag_value,action,new_value]","type":"file","fileNotInWorkingDirectoryWarning":"This file isn't in your working directory. Teammates you share this request with won't be able to use this file. To make collaboration easier you can setup your working directory in Settings.","filesNotInWorkingDirectory":["/Users/nitinkumar/Downloads/demo_tag_upload_api.csv"],"value":null}]},"url":"{{baseUrl}}/ingestion/tags/upload"},"status":"Bad Request","code":400,"_postman_previewlanguage":null,"header":null,"cookie":[],"responseTime":null,"body":"{\n \"file\": [\n \"File size exceeds 9.5367431640625e-07 MB\"\n ]\n}"}],"_postman_id":"4f169d33-2853-4c81-87eb-ea40d9890a5b"}],"id":"b83414ad-aaee-49c1-9b5b-bc4e8cde92f2","description":"

This ingestions APIs is designed to ingestion of client data into our system. It includes endpoints that facilitate data submission, validation, and storage, ensuring a seamless and efficient integration process.

\n","_postman_id":"b83414ad-aaee-49c1-9b5b-bc4e8cde92f2"},{"name":"AuditLog","item":[{"name":"List Audit Logs","id":"c7a1aee6-87ae-41b6-8950-06bd4dc0ff6f","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"apikey","apikey":{"basicConfig":[{"key":"key","value":"X-NOPSEC-API-KEY"},{"key":"value","value":"{{apiKey}}"}]},"isInherited":false},"method":"GET","header":[{"key":"Accept","value":"application/json"}],"url":"{{baseUrl}}/auditlog/log?action_type=CREATE","description":"

Last reviewed: 2026-07-31

\n

Retrieve a paginated, filterable list of audit log entries for your client - who did what, when, and how (via the UI, or via the API). Useful for answering \"who changed this\" questions, and for building your own activity feed.

\n

Each entry (values below are illustrative):

\n
{\n    \"id\": \"5f1e2d3c-4b5a-4968-8f7e-6d5c4b3a2918\",\n    \"username\": \"John Doe\",\n    \"user_id\": null,\n    \"action_type\": \"CREATE\",\n    \"action_description\": \"Remediation Action created: Test action - safe to archive\",\n    \"reference\": \"RemediationAction:7a8b9c0d-1e2f-4a3b-8c9d-0e1f2a3b4c5d:5f1e2d3c-4b5a-4968-8f7e-6d5c4b3a2918\",\n    \"trigger_source\": \"API\",\n    \"created_at\": \"2026-07-31T19:28:41.290300Z\"\n}\n\n
\n

Notes on the fields:

\n
    \n

  • user_id is frequently null even when username is populated - don't treat it as a reliable join key. Use username for display, and reference if you need to link back to the actual object that was changed.

    \n
    • \n

  • action_type is a free-form-looking but actually constrained set of values - examples: CREATE, TEAM_MEMBERSHIP_ADD. Expect one value per kind of mutating action across the platform (remediation actions, team membership, etc.), not just one per API endpoint.

    \n
    • \n

  • reference encodes the affected object as EntityType:id1:id2... - for example a Remediation Action shows both its action id and the specific audit-relevant sub-id.

    \n
    • \n

  • action_description is meant to be human-readable and shown directly in a UI; it already includes enough context (e.g. the object's name) that you often don't need to separately look up the referenced object.

    \n
    • \n
\n

Filters: action_type genuinely filters, ?action_type=CREATE will return less as it's filtering.All filters follow the same pattern as filters elsewhere in this API:

\n
    \n

  • created_after / created_before / created_at_gt / created_at_gte / created_at_lt / created_at_lte - ISO 8601 datetime range filters

    \n
    • \n

  • created_at / created_at_exact - exact match

    \n
    • \n

  • trigger_source - e.g. API

    \n
    • \n

  • ordering - field to sort by

    \n
    • \n

  • limit / offset - standard pagination

    \n
    • \n
\n","urlObject":{"path":["auditlog","log"],"host":["{{baseUrl}}"],"query":[{"disabled":true,"key":"created_after","value":"1958-05-09T01:30:49.964Z"},{"disabled":true,"key":"created_at","value":"1980-08-29"},{"disabled":true,"key":"created_at_exact","value":"1958-05-09T01:30:49.964Z"},{"disabled":true,"key":"created_at_gt","value":"1958-05-09T01:30:49.964Z"},{"disabled":true,"key":"created_at_gte","value":"1958-05-09T01:30:49.964Z"},{"disabled":true,"key":"created_at_lt","value":"1958-05-09T01:30:49.964Z"},{"disabled":true,"key":"created_at_lte","value":"1958-05-09T01:30:49.964Z"},{"disabled":true,"key":"created_before","value":"1958-05-09T01:30:49.964Z"},{"disabled":true,"description":{"content":"

Number of results to return per page.

\n","type":"text/plain"},"key":"limit","value":"6100"},{"disabled":true,"description":{"content":"

The initial index from which to return the results.

\n","type":"text/plain"},"key":"offset","value":"6100"},{"disabled":true,"description":{"content":"

Which field to use when ordering the results.

\n","type":"text/plain"},"key":"ordering","value":"string"},{"disabled":true,"description":{"content":"

Source that triggered the audit log

\n
    \n
  • GUI - GUI
    • \n
  • CLIENT_MANAGEMENT - Client Management
    • \n
  • AUTOMATED - Automated
    • \n
  • API - API
    • \n
  • SYSTEM - System
    • \n
\n","type":"text/plain"},"key":"trigger_source","value":"API"},{"description":{"content":"

Type of action performed

\n
    \n
  • CREATE - Create
    • \n
  • UPDATE - Update
    • \n
  • DELETE - Delete
    • \n
  • LOGIN - Login
    • \n
  • LOGOUT - Logout
    • \n
  • TEST - Test
    • \n
  • TEAM_MEMBERSHIP_ADD - Team Membership Add
    • \n
  • TEAM_MEMBERSHIP_REMOVE - Team Membership Remove
    • \n
  • TEAM_MEMBERSHIP_CLEAR - Team Membership Clear
    • \n
  • REMEDIATION_PLAN_TEAM_ADD - Remediation Plan Team Add
    • \n
  • REMEDIATION_PLAN_TEAM_REMOVE - Remediation Plan Team Remove
    • \n
  • REMEDIATION_PLAN_TEAM_CLEAR - Remediation Plan Team Clear
    • \n
  • EXCEPTION_PLAN_TEAM_ADD - Exception Plan Team Add
    • \n
  • EXCEPTION_PLAN_TEAM_REMOVE - Exception Plan Team Remove
    • \n
  • EXCEPTION_PLAN_TEAM_CLEAR - Exception Plan Team Clear
    • \n
  • DERIVED_FIELD_RULE_ADD - Derived Field Rule Add
    • \n
  • DERIVED_FIELD_RULE_REMOVE - Derived Field Rule Remove
    • \n
  • DERIVED_FIELD_RULE_CLEAR - Derived Field Rule Clear
    • \n
\n","type":"text/plain"},"key":"action_type","value":"CREATE"}],"variable":[]}},"response":[{"id":"a4a8654a-7e3a-49a1-b701-30e469008eda","name":"Untitled Response","originalRequest":{"method":"GET","header":[{"key":"Accept","value":"application/json"},{"key":"X-NOPSEC-API-KEY","value":"","description":"Added as a part of security scheme: apikey"}],"url":{"raw":"{{baseUrl}}/auditlog?action_description=string&action_type=LOGIN&created_after=1958-05-09T01:30:49.964Z&created_at=1980-08-29&created_at_exact=1958-05-09T01:30:49.964Z&created_at_gt=1958-05-09T01:30:49.964Z&created_at_gte=1958-05-09T01:30:49.964Z&created_at_lt=1958-05-09T01:30:49.964Z&created_at_lte=1958-05-09T01:30:49.964Z&created_before=1958-05-09T01:30:49.964Z&limit=6100&offset=6100&ordering=string&search=string&trigger_source=API&user_id=6100&username=string","host":["{{baseUrl}}"],"path":["auditlog"],"query":[{"key":"action_description","value":"string"},{"key":"action_type","value":"LOGIN","description":"Type of action performed\n\n* `CREATE` - Create\n* `UPDATE` - Update\n* `DELETE` - Delete\n* `LOGIN` - Login\n* `LOGOUT` - Logout\n* `TEST` - Test\n* `TEAM_MEMBERSHIP_ADD` - Team Membership Add\n* `TEAM_MEMBERSHIP_REMOVE` - Team Membership Remove\n* `TEAM_MEMBERSHIP_CLEAR` - Team Membership Clear\n* `REMEDIATION_PLAN_TEAM_ADD` - Remediation Plan Team Add\n* `REMEDIATION_PLAN_TEAM_REMOVE` - Remediation Plan Team Remove\n* `REMEDIATION_PLAN_TEAM_CLEAR` - Remediation Plan Team Clear\n* `EXCEPTION_PLAN_TEAM_ADD` - Exception Plan Team Add\n* `EXCEPTION_PLAN_TEAM_REMOVE` - Exception Plan Team Remove\n* `EXCEPTION_PLAN_TEAM_CLEAR` - Exception Plan Team Clear\n* `DERIVED_FIELD_RULE_ADD` - Derived Field Rule Add\n* `DERIVED_FIELD_RULE_REMOVE` - Derived Field Rule Remove\n* `DERIVED_FIELD_RULE_CLEAR` - Derived Field Rule Clear"},{"key":"created_after","value":"1958-05-09T01:30:49.964Z"},{"key":"created_at","value":"1980-08-29"},{"key":"created_at_exact","value":"1958-05-09T01:30:49.964Z"},{"key":"created_at_gt","value":"1958-05-09T01:30:49.964Z"},{"key":"created_at_gte","value":"1958-05-09T01:30:49.964Z"},{"key":"created_at_lt","value":"1958-05-09T01:30:49.964Z"},{"key":"created_at_lte","value":"1958-05-09T01:30:49.964Z"},{"key":"created_before","value":"1958-05-09T01:30:49.964Z"},{"key":"limit","value":"6100","description":"Number of results to return per page."},{"key":"offset","value":"6100","description":"The initial index from which to return the results."},{"key":"ordering","value":"string","description":"Which field to use when ordering the results."},{"key":"search","value":"string","description":"A search term."},{"key":"trigger_source","value":"API","description":"Source that triggered the audit log\n\n* `GUI` - GUI\n* `CLIENT_MANAGEMENT` - Client Management\n* `AUTOMATED` - Automated\n* `API` - API\n* `SYSTEM` - System"},{"key":"user_id","value":"6100"},{"key":"username","value":"string"}]}},"status":"OK","code":200,"_postman_previewlanguage":"json","header":[{"key":"Content-Type","value":"application/json"}],"cookie":[],"responseTime":null,"body":"{\n \"count\": 123,\n \"next\": \"{{baseUrl}}/auditlog/log?offset=400&limit=100\",\n \"previous\": \"{{baseUrl}}/auditlog/log?offset=200&limit=100\",\n \"results\": [\n {\n \"id\": \"48b9eb82-fc2d-4920-880e-45debbc992eb\",\n \"username\": \"username\",\n \"user_id\": \"user id\",\n \"action_type\": \"UPDATE\",\n \"action_description\": \"Settings updated: username\",\n \"reference\": \"Settings:Id:48b9eb82-fc2d-4920-880e-45debbc992eb\",\n \"trigger_source\": \"GUI\",\n \"created_at\": \"2025-10-07T18:44:42.025453Z\"\n }\n ]\n}"}],"_postman_id":"c7a1aee6-87ae-41b6-8950-06bd4dc0ff6f"}],"id":"382e95ba-8e8b-4494-8e47-6391935d1a80","_postman_id":"382e95ba-8e8b-4494-8e47-6391935d1a80","description":""}],"event":[{"listen":"prerequest","script":{"id":"2ecb7345-0ccc-476f-ad15-15059288162f","type":"text/javascript","packages":{},"exec":[""]}},{"listen":"test","script":{"id":"542ff057-427d-4ff0-ba0c-ba6b83dffb0f","type":"text/javascript","packages":{},"exec":[""]}}],"variable":[{"key":"baseUrl","value":"/api","disabled":true}]}