For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/jen.gilbert/astro-base/api/latest/security-monitoring/mute-or-unmute-security-findings.md. A documentation index is available at /llms.txt.
Language
Datadog site

Mute or unmute security findings

PATCHhttps://api.datadoghq.com/api/v2/security/findings/mutehttps://api.us3.datadoghq.com/api/v2/security/findings/mutehttps://api.us5.datadoghq.com/api/v2/security/findings/mutehttps://api.datadoghq.eu/api/v2/security/findings/mutehttps://api.ap1.datadoghq.com/api/v2/security/findings/mutehttps://api.ap2.datadoghq.com/api/v2/security/findings/mutehttps://api.uk1.datadoghq.com/api/v2/security/findings/mutehttps://api.ddog-gov.com/api/v2/security/findings/mutehttps://api.us2.ddog-gov.com/api/v2/security/findings/mute

Overview

Mute or unmute security findings. You can mute or unmute up to 100 security findings per request. The request body must include is_muted and reason attributes. The allowed reasons depend on whether the finding is being muted or unmuted:

  • To mute a finding: PENDING_FIX, FALSE_POSITIVE, OTHER, NO_FIX, DUPLICATE, RISK_ACCEPTED.
  • To unmute a finding: NO_PENDING_FIX, HUMAN_ERROR, NO_LONGER_ACCEPTED_RISK, OTHER.

This endpoint requires any of the following permissions:

  • security_monitoring_findings_write
  • appsec_vm_write

Request

Body Data (required)

Field
Type
Description
data [required]
object

Data of the mute request.

Response

Accepted

Response for the mute or unmute request.

Field
Type
Description
data
object

Data of the mute response.

Code Example

Mute security findings returns "Accepted" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "To be resolved later.",
        "expire_at": 1778721573794,
        "is_muted": true,
        "reason": "RISK_ACCEPTED"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
Unmute security findings returns "Accepted" response
# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF
# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X PATCH "https://api.${DD_SITE}/api/v2/security/findings/mute" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}" \
-d @- << EOF
{
  "data": {
    "attributes": {
      "mute": {
        "description": "Resolved.",
        "is_muted": false,
        "reason": "NO_PENDING_FIX"
      }
    },
    "relationships": {
      "findings": {
        "data": [
          {
            "id": "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=",
            "type": "findings"
          }
        ]
      }
    },
    "type": "mute"
  }
}
EOF