Update a FSPM security finding by ID

const response: Promise<FireblocksResponse<SecurityFindingDetailed>> = fireblocks.securityPostureManagement.updateSecurityFindingById(securityPostureManagementApiUpdateSecurityFindingByIdRequest);

CompletableFuture<ApiResponse<SecurityFindingDetailed>> response = fireblocks.securityPostureManagement().updateSecurityFindingById(updateFindingExternalRequest, id, idempotencyKey);

response = fireblocks.security_posture_management.update_security_finding_by_id(update_finding_external_request, id, idempotency_key);

curl --request PATCH \
  --url https://api.fireblocks.io/v1/security/fspm/findings/{id} \
  --header 'Content-Type: application/json' \
  --data '
{
  "status": "ACCEPTED",
  "statusUpdatedReason": "Risk accepted - compensating controls are in place"
}
'

const options = {
  method: 'PATCH',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    status: 'ACCEPTED',
    statusUpdatedReason: 'Risk accepted - compensating controls are in place'
  })
};

fetch('https://api.fireblocks.io/v1/security/fspm/findings/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fireblocks.io/v1/security/fspm/findings/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'status' => 'ACCEPTED',
    'statusUpdatedReason' => 'Risk accepted - compensating controls are in place'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fireblocks.io/v1/security/fspm/findings/{id}"

	payload := strings.NewReader("{\n  \"status\": \"ACCEPTED\",\n  \"statusUpdatedReason\": \"Risk accepted - compensating controls are in place\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fireblocks.io/v1/security/fspm/findings/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"status\": \"ACCEPTED\",\n  \"statusUpdatedReason\": \"Risk accepted - compensating controls are in place\"\n}"

response = http.request(request)
puts response.read_body

{
  "id": "d7ca6101-a65e-4a9c-b6c1-b8bd697e0cd2",
  "type": "API_COSIGNER_WITH_NO_CALLBACK",
  "status": "OPEN",
  "severity": "HIGH",
  "category": "USER_MANAGEMENT",
  "createdAt": "2026-07-28T11:37:05.000Z",
  "title": "The API user 'Security admin api' is paired with a co-signer and has no callback",
  "info": {
    "apiKey": "e7c3f18c-3060-3748-3563-19c3dbb3fa88",
    "apiUserName": "Security admin api",
    "cosignerId": "02f53cfa-34a3-4393-a451-e13dfab3c157",
    "cosignerName": "Production Co-Signer"
  },
  "complianceReqs": [],
  "riskExplanation": "An API user that is paired with a co-signer and does not have a callback implementation is vulnerable to auto-approving, allowing malicious transactions to proceed without review.",
  "mitigationGuidance": "Add a callback implementation to the API user. Alternatively, if the API user is no longer needed, you can delete it. To do so, go to Developer Center > API Users, click the actions button (3 dots) next to the API user, and select Delete. Note that by default this action can only be performed by the workspace owner.",
  "statusUpdatedAt": "2026-08-16T08:52:57.000Z",
  "statusUpdatedByUserId": "00d77437-3e7a-4e39-8482-55115a7a0892",
  "statusUpdatedReason": "False positive, callback is configured via a different mechanism"
}

{
  "message": "<string>",
  "code": 123
}