Skip to content

Triage multiple reviews at once

PATCH
/reviews/bulk_triage

Applies the same triage status to all specified reviews in a single request. Parameters are FLAT (no wrapper object). All reviews must belong to the same component (enforced server-side). Terminal statuses (duplicate, informational, withdrawn, addressed_by) auto-adjudicate every selected review. Conditional requirements: non_concur requires response_comment; duplicate requires duplicate_of_review_id; addressed_by requires addressed_by_rule_id. The target is ONE shared value applied to every selected review — many comments duplicating one canonical thread, or addressed by one rule. A duplicate canonical that is itself among review_ids is rejected. Every per-comment validator runs per selected review (same-component canonical, no chained duplicates); any failing review rolls back the whole batch. Optionally creates a response comment on each triaged review. Requires author+ role on the component's project.

Authorizations

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Request Body

application/json
JSON
{
  
"review_ids": [
  
  
10,
  
  
11,
  
  
12
  
],
  
"triage_status": "concur"
}

Responses

All reviews triaged successfully

application/json
JSON
{
  
"reviews": [
  
  
{
  
  
  
"id": 10,
  
  
  
"action": "comment",
  
  
  
"comment": "Original comment 1",
  
  
  
"triage_status": "concur",
  
  
  
"rule_id": 100,
  
  
  
"created_at": "2026-05-19 14:08:17 UTC",
  
  
  
"reactions": {
  
  
  
  
"up": 0,
  
  
  
  
"down": 0,
  
  
  
  
"mine": null
  
  
  
}
  
  
}
  
],
  
"response_reviews": [
  
]
}

Playground

Server
Authorization
Body

Samples

Powered by VitePress OpenAPI

Part of the MITRE Security Automation Framework (SAF)