Bulk update locked sections
PATCH
/rules/{ruleId}/bulk_section_locks
Locks or unlocks multiple sections at once on a rule. Requires reviewer role or higher on the parent component. Creates an audit trail entry.
Authorizations
tokenAuth
Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.
Type
HTTP (token)
Request Body
application/json
JSON "sections": [ [ "Fix", "Check" ] ], "locked": true, "comment": "Locking the Fix and Check sections for review"
{
}
Responses
Section locks updated, returns updated rule + toast
application/json
JSON "rule": { "id": 1786, "rule_id": "000001", "title": "The operating system must provide automated mechanisms for supporting account management functions.", "version": "SRG-OS-000001-GPOS-00001", "status": "Not Yet Determined", "rule_severity": "medium", "locked": true, "review_requestor_id": 0, "changes_requested": false, "comment_summary": { "open": 0, "total": 0 }, "rule_weight": "10.0", "fixtext": "Configure the operating system to provide automated mechanisms...", "fixtext_fixref": "F-3716r557030_fix", "ident": "CCI-000015", "ident_system": "http://cyber.mil/cci", "vendor_comments": "string", "vuln_id": "string", "legacy_ids": "V-56571, SV-70831", "component_id": 1, "status_justification": "string", "artifact_description": "string", "locked_fields": { "additionalProperties": true }, "nist_control_family": "AC-2 (1)", "srg_id": "SRG-OS-000001-GPOS-00001", "inspec_control_body": "string", "inspec_control_file": "string", "inspec_control_body_lang": "ruby", "inspec_control_file_lang": "ruby", "fix_id": "F-3716r557030_fix", "disa_rule_descriptions_attributes": [ { "id": 300, "vuln_discussion": "Without verification, containers may execute untrusted code...", "false_positives": "string", "false_negatives": "string", "documentable": false, "mitigations": "string", "severity_override_guidance": "string", "potential_impacts": "string", "third_party_tools": "string", "mitigation_control": "string", "responsibility": "string", "ia_controls": "string", "mitigations_available": "string", "poam_available": "string", "poam": "string", "_destroy": false } ], "checks_attributes": [ { "id": 200, "system": "C-56947r840354_chk", "content_ref_name": "M", "content_ref_href": "DPMS_XCCDF-Container_Platform_SRG.xml", "content": "Verify the container platform restricts access to container images...", "_destroy": false } ], "satisfies": [ { "id": 50, "rule_id": 100, "srg_id": "CNTR-00-000050" } ], "satisfied_by": [ { "id": 50, "rule_id": 100, "srg_id": "CNTR-00-000050", "fixtext": "Configure the container platform to restrict access..." } ], "histories": [ { "id": 224, "action": "update", "auditable_type": "Component", "auditable_id": 1, "name": "Demo Admin", "audited_name": "string", "comment": "string", "created_at": "2026-05-19 14:07:49 UTC", "audited_changes": [ { "field": "released", "prev_value": false, "new_value": true } ] } ], "rule_descriptions_attributes": [ { "id": 400, "description": "<VulnDiscussion>Without verification, containers may execute untrusted code.</VulnDiscussion>", "_destroy": false } ], "reviews": [ { "id": 1, "action": "comment", "comment": "The check says "verify that TLS 1.2 or greater is being used" but does not specify HOW to verify.", "created_at": "2026-05-19 14:08:17 UTC", "triage_status": "pending", "triage_set_at": "string", "adjudicated_at": "string", "rule_id": 2976, "section": "check_content", "responding_to_review_id": 0, "duplicate_of_review_id": 0, "addressed_by_rule_id": 0, "triage_set_by_id": 0, "name": "Demo Viewer", "author_name": "Demo Viewer", "triager_display_name": "string", "triager_imported": false, "adjudicator_display_name": "string", "adjudicator_imported": false, "commenter_display_name": "Demo Viewer", "commenter_imported": false, "commentable_type": "BaseRule", "responses_count": 0, "rule_displayed_name": "PHOS-03-000001", "author_email": "string", "commenter_email": "string", "reactions": { "up": 1, "down": 0, "mine": "string" } } ], "additional_answers_attributes": [ { "id": 10, "additional_question_id": 3, "answer": "Yes, this applies to all container runtime environments." } ], "srg_rule_attributes": { "id": 500, "rule_id": "SV-222396r857506_rule", "title": "The container platform must enforce approved authorizations for access.", "version": "CNTR-00-000050", "rule_severity": "medium", "rule_weight": "10.0", "ident": "CCI-000213", "ident_system": "http://cyber.mil/cci", "fixtext": "Configure the container platform to enforce approved authorizations...", "fixtext_fixref": "F-25073r857505_fix", "fix_id": "F-25073r857505_fix", "inspec_control_body": "string", "inspec_control_file": "string", "inspec_control_body_lang": "string", "inspec_control_file_lang": "string", "vuln_id": "V-222396", "legacy_ids": "SV-42474, V-32157", "rule_descriptions_attributes": [ { "id": 400, "description": "<VulnDiscussion>Without verification, containers may execute untrusted code.</VulnDiscussion>", "_destroy": false } ], "disa_rule_descriptions_attributes": [ { "id": 300, "vuln_discussion": "Without verification, containers may execute untrusted code...", "false_positives": "string", "false_negatives": "string", "documentable": false, "mitigations": "string", "severity_override_guidance": "string", "potential_impacts": "string", "third_party_tools": "string", "mitigation_control": "string", "responsibility": "string", "ia_controls": "string", "mitigations_available": "string", "poam_available": "string", "poam": "string", "_destroy": false } ], "checks_attributes": [ { "id": 200, "system": "C-56947r840354_chk", "content_ref_name": "M", "content_ref_href": "DPMS_XCCDF-Container_Platform_SRG.xml", "content": "Verify the container platform restricts access to container images...", "_destroy": false } ] }, "srg_info": { "version": "V2R4" } }, "toast": { "title": "User updated.", "message": [ [ "Successfully updated user." ] ], "variant": "success" }
{
}