Skip to content

Non-concur with a relocation proposal, with a rationale

POST
/requirement_relocations/{id}/decline

Receiver-side adjudication (displayed as Non-concur): declines the proposal with a REQUIRED rationale. The record is retained as terminal history — never destroyed — and the rationale surfaces to the source author in the backlog, so the refusal communicates back across the ownership boundary. Requires author role on the destination component named in the request, and that component must be an ELIGIBLE receiver — an unreleased SRG component, other than the source, that declares the source requirement's core SRG (the same eligibility accept enforces). Audited. A declined source may be proposed again.

Authorizations

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Request Body

application/json
JSON
{
  
"target_component_id": 42,
  
"requirement_relocation": {
  
  
"adjudication_rationale": "Covered by CNTR-00-000001 already."
  
}
}

Responses

Proposal non-concurred with and retained with the rationale

application/json
JSON
{
  
"toast": {
  
  
"title": "Non-concurred.",
  
  
"message": [
  
  
  
"The source author can see your rationale in the backlog."
  
  
],
  
  
"variant": "success"
  
}
}

Playground

Server
Authorization
Body

Samples

Powered by VitePress OpenAPI

Part of the MITRE Security Automation Framework (SAF)