Vulcan

Appearance

Projects​

Project CRUD, export, import, and member management

List projects with pagination, search, and sorting​

GET
/api/projects

Paginated project listing for SPA consumption. Supports substring search over name and description, whitelist-validated sorting, and pagy-backed pagination (default 25 per page, maximum 100). Unknown sort fields are silently ignored. Requires authentication. Returns 400 when the requested page is out of range. Timestamps on this endpoint are ISO 8601 (render_as_json path), unlike the string-rendered project pages.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Query Parameters

q

Case-insensitive substring filter matched against project name and description.

Type
string
Example"Photon"
sort

Sort field. Unknown fields are silently ignored.

Type
string
Valid values
"name""created_at""updated_at"
Example"name"
order

Sort direction. Defaults to asc when sort is applied.

Type
string
Valid values
"asc""desc"
Example"asc"
page

Page number (1-based). Out-of-range pages return 400.

Type
integer
Example1
per_page

Records per page (default 25, capped at 100).

Type
integer
Example25

Responses​

Paginated project rows

application/json
JSON
{
  
"rows": [
  
  
{
  
  
  
"id": 34,
  
  
  
"name": "Photon 3",
  
  
  
"description": null,
  
  
  
"visibility": "discoverable",
  
  
  
"memberships_count": 2,
  
  
  
"admin_name": "Demo Admin",
  
  
  
"admin_email": "admin@example.org",
  
  
  
"created_at": "2026-05-30T14:06:03.797Z",
  
  
  
"updated_at": "2026-05-30T14:06:28.292Z"
  
  
}
  
],
  
"pagination": {
  
  
"page": 1,
  
  
"per_page": 25,
  
  
"total": 1
  
}
}

Playground​

Server
Authorization
Variables
Key
Value

Samples​

Get rule statistics for a project​

GET
/api/projects/{id}/stats

Returns rule statistics aggregated across every component in the project plus a per-component breakdown, computed from grouped SQL queries. Requires viewer permission on the project.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

id*

Numeric ID of the project.

Type
integer
Required
Example7

Responses​

Project rule statistics with per-component breakdown

application/json
JSON
{
  
"aggregate": {
  
  
"rules_by_status_by_type": {
  
  
  
"stig": {
  
  
  
  
"not_yet_determined": 51,
  
  
  
  
"applicable_configurable": 121,
  
  
  
  
"applicable_inherently_meets": 15,
  
  
  
  
"applicable_does_not_meet": 8,
  
  
  
  
"not_applicable": 10
  
  
  
},
  
  
  
"srg": {
  
  
  
  
"not_yet_determined": 2,
  
  
  
  
"applicable": 1,
  
  
  
  
"not_applicable": 0
  
  
  
}
  
  
},
  
  
"rules_by_severity": {
  
  
  
"high": 21,
  
  
  
"medium": 176,
  
  
  
"low": 11
  
  
},
  
  
"rule_count": 208,
  
  
"completion_pct": 74.5,
  
  
"lock_pct": 12
  
},
  
"components": [
  
  
{
  
  
  
"id": 38,
  
  
  
"name": "RHEL 9 Hardened Baseline",
  
  
  
"prefix": "RHEL-09",
  
  
  
"document_type": "stig",
  
  
  
"rule_count": 203,
  
  
  
"completion_pct": 75.4,
  
  
  
"lock_pct": 12.3
  
  
},
  
  
{
  
  
  
"id": 41,
  
  
  
"name": "Photon OS 5 Baseline",
  
  
  
"prefix": "PHTN-50",
  
  
  
"document_type": "srg",
  
  
  
"rule_count": 5,
  
  
  
"completion_pct": 40,
  
  
  
"lock_pct": 0
  
  
}
  
]
}

Playground​

Server
Authorization
Variables
Key
Value

Samples​

Get triage summary for a project​

GET
/api/projects/{id}/triage_summary

Returns triage metrics aggregated across all of the project's components — top-level comment counts per triage status plus the adjudication percentage. Requires viewer permission on the project.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

id*

Numeric ID of the project.

Type
integer
Required
Example7

Responses​

Project-wide triage summary

application/json
JSON
{
  
"by_triage_status": {
  
  
"pending": 3,
  
  
"concur": 1,
  
  
"concur_with_comment": 0,
  
  
"non_concur": 0,
  
  
"duplicate": 0,
  
  
"informational": 1,
  
  
"needs_clarification": 0,
  
  
"withdrawn": 0,
  
  
"addressed_by": 0
  
},
  
"total": 5,
  
"adjudicated": 1,
  
"adjudication_pct": 20
}

Playground​

Server
Authorization
Variables
Key
Value

Samples​

List accessible projects​

GET
/projects

Returns all projects the current user can access, including owned projects, member projects, and discoverable projects. Includes membership counts and pending comment counts per project. Requires authentication.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Responses​

Projects list

application/json
JSON
[
  
{
  
  
"id": 4,
  
  
"name": "Container Platform",
  
  
"memberships_count": 14
  
},
  
{
  
  
"id": 1,
  
  
"name": "Photon 3",
  
  
"memberships_count": 14
  
}
]

Playground​

Server
Authorization

Samples​

Create a new project​

POST
/projects

Creates a new project with the given name and description. The creating user is automatically added as an admin member. Requires authentication.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Request Body​

application/json
JSON
{
  
"project": {
  
  
"name": "Red Hat Enterprise Linux 9",
  
  
"description": "STIG development for RHEL 9"
  
}
}

Responses​

Project created

application/json
JSON
{
  
"toast": {
  
  
"title": "Project created.",
  
  
"message": [
  
  
  
"Successfully created project Red Hat Enterprise Linux 9."
  
  
],
  
  
"variant": "success"
  
},
  
"redirect_url": "/projects/5"
}

Playground​

Server
Authorization
Body

Samples​

Project detail with component list and stats​

GET
/projects/{projectId}

Returns full project details including components, membership count, comment counts, and project metadata. Requires membership in the project or admin role.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Responses​

Project detail with components

application/json
JSON
{
  
"id": 1,
  
"name": "Photon 3",
  
"memberships_count": 16,
  
"pending_comment_count": 1,
  
"components": [
  
  
{
  
  
  
"id": 1,
  
  
  
"name": "Photon OS 3",
  
  
  
"prefix": "PHOS-03"
  
  
}
  
]
}

Playground​

Server
Authorization

Samples​

Full replacement of project attributes​

PUT
/projects/{projectId}

Full replacement — all fields required. Updates the project name, description, or visibility. Requires admin role on the project. Returns a canonical toast response.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Request Body​

application/json
JSON
{
  
"project": {
  
  
"name": "Container Platform v2"
  
}
}

Responses​

Project updated

application/json
JSON
{
  
"toast": {
  
  
"title": "Project updated.",
  
  
"message": [
  
  
  
"Successfully updated project."
  
  
],
  
  
"variant": "success"
  
}
}

Playground​

Server
Authorization
Body

Samples​

Delete a project and all its components​

DELETE
/projects/{projectId}

Permanently deletes the project, all its components, rules, reviews, and memberships. Requires admin role on the project. This action cannot be undone. Returns 403 for non-admin users.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Responses​

Project deleted

application/json
JSON
{
  
"toast": {
  
  
"title": "Project deleted.",
  
  
"message": [
  
  
  
"Successfully deleted project."
  
  
],
  
  
"variant": "success"
  
}
}

Playground​

Server
Authorization

Samples​

Partial update of project attributes​

PATCH
/projects/{projectId}

Partial update — send only changed fields. Updates the project name, description, or visibility. Requires admin role on the project. Returns a canonical toast response.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Request Body​

application/json
JSON
{
  
"project": {
  
  
"name": "Container Platform v2"
  
}
}

Responses​

Project updated

application/json
JSON
{
  
"toast": {
  
  
"title": "Project updated.",
  
  
"message": [
  
  
  
"Successfully updated project."
  
  
],
  
  
"variant": "success"
  
}
}

Playground​

Server
Authorization
Body

Samples​

Aggregated comments across all project components​

GET
/projects/{projectId}/comments

Returns paginated comments from all components in the project, with triage status counts. Different row shape from component comments — includes component_id/component_name but omits some triage attribution fields. Uses Project#paginated_comments (NOT CommentQueryService).

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Query Parameters

triage_status

Filter comments by triage disposition. Defaults to "pending" — the triage table opens on undispositioned comments. Use "all" to return comments in any status.

Type
string
Valid values
"all""pending""concur""concur_with_comment""non_concur""duplicate""informational""needs_clarification""withdrawn""addressed_by"
Example"pending"
Default
"pending"
page

Page number for paginated results (1-based).

Type
integer
Example1
Minimum
1
Default
1
per_page

Number of items to return per page.

Type
integer
Example25
Minimum
1
Maximum
1000
Default
25
section

Filter by requirement section (fixtext, check_content, etc.).

Type
string
Example"fixtext"
component_id

Filter to a specific component within the project.

Type
integer
author_id

Filter by comment author.

Type
integer
q

Text search within comment content.

Type
string
resolved

Filter by resolved state (true/false/all).

Type
string
Valid values
"true""false""all"
Example"false"

Responses​

Paginated project comment rows with status counts

application/json
JSON
{
  
"rows": [
  
  
{
  
  
  
"id": 26,
  
  
  
"rule_displayed_name": "PHOS-03-000038",
  
  
  
"component_id": 1,
  
  
  
"component_name": "Photon OS 3",
  
  
  
"triage_status": "pending",
  
  
  
"comment": "This requirement needs clarification.",
  
  
  
"responses_count": 0,
  
  
  
"reactions": {
  
  
  
  
"up": 0,
  
  
  
  
"down": 0,
  
  
  
  
"mine": null
  
  
  
}
  
  
}
  
],
  
"pagination": {
  
  
"page": 1,
  
  
"per_page": 25,
  
  
"total": 3
  
},
  
"status_counts": {
  
  
"pending": 1,
  
  
"concur": 1,
  
  
"informational": 1
  
}
}

Playground​

Server
Authorization
Variables
Key
Value

Samples​

Export project data in the specified format​

GET
/projects/{projectId}/export/{type}

Exports selected components from the project as CSV, XCCDF XML, InSpec profile, or JSON archive. Supports mode selection (working copy, vendor submission, published STIG) and optional SRG/membership inclusion. Returns a binary file download. Requires project membership.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Query Parameters

component_ids*

Comma-separated IDs of components to include in the export.

Type
string
Required
Example"29,30"
mode

Export mode controlling which fields and rules are included.

Type
string
Valid values
"working_copy""vendor_submission""published_stig"
Example"working_copy"
include_srg

Include the source SRG in the export package.

Type
string
Valid values
"true"
include_memberships

Include project membership data in the export.

Type
string
Valid values
"true""false"
exclude_satisfied_by

Exclude rules that are satisfied by another rule.

Type
string
Valid values
"true"

Responses​

Binary file download (CSV, XML, ZIP, or JSON)

Playground​

Server
Authorization
Variables
Key
Value

Samples​

Create a new project from a JSON archive backup​

POST
/projects/create_from_backup

Creates a new project by restoring from a JSON archive (.zip). The archive must have been created by the json_archive export. Optionally override the project name. The archived project metadata (project.json) is restored onto the new project. The creating user becomes the project admin. Requires authentication.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Request Body​

multipart/form-data

JSON archive .zip file from a previous export.

Format"binary"

Override project name. Uses the archived name if omitted.

Responses​

Dry-run returns preview (summary + warnings + project_defaults). Real create returns redirect URL + summary + toast.

application/json
JSON
{
  
"summary": {
  
  
"dry_run": true,
  
  
"components_imported": 2,
  
  
"rules_imported": 264,
  
  
"component_details": [
  
  
  
{
  
  
  
  
"name": "Photon OS 3",
  
  
  
  
"rule_count": 132
  
  
  
}
  
  
]
  
},
  
"warnings": [
  
],
  
"project_defaults": {
  
  
"name": "My Original Project",
  
  
"description": "A test project",
  
  
"visibility": "discoverable"
  
}
}

Playground​

Server
Authorization
Body

Samples​

Import a JSON archive backup​

POST
/projects/{projectId}/import_backup

Imports components, rules, reviews, and memberships from a JSON archive (.zip) into the project, replacing or augmenting existing content. Returns 200 with a toast + summary. Requires admin role on the project. The archive must have been created by the json_archive export format.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Request Body​

multipart/form-data

JSON archive .zip file from a previous export.

Format"binary"

Responses​

Backup imported (default mode) or dry-run preview completed

application/json
JSON
{
  
"toast": {
  
  
"title": "Backup restored.",
  
  
"message": [
  
  
  
"Backup restored successfully."
  
  
],
  
  
"variant": "success"
  
},
  
"summary": {
  
  
"components_imported": 2,
  
  
"rules_imported": 264,
  
  
"satisfactions_imported": 12,
  
  
"reviews_imported": 48,
  
  
"memberships_imported": 3,
  
  
"srgs_imported": 1,
  
  
"component_details": [
  
  
  
{
  
  
  
  
"name": "Photon OS 3",
  
  
  
  
"rule_count": 132,
  
  
  
  
"srg_title": "General Purpose Operating System SRG",
  
  
  
  
"srg_version": "V3R3"
  
  
  
}
  
  
]
  
},
  
"warnings": [
  
]
}

Playground​

Server
Authorization
Body

Samples​

Audit history for the project​

GET
/projects/{projectId}/histories

Returns the 50 most recent audit trail entries for the project, including component and rule changes. Used by the project history sidebar. Requires project membership.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Responses​

Recent audit entries

application/json
JSON
[
  
{
  
  
"id": 500,
  
  
"auditable_type": "Component",
  
  
"auditable_id": 38,
  
  
"action": "update",
  
  
"name": "Demo Admin",
  
  
"created_at": "2026-05-28T15:00:00Z",
  
  
"audited_changes": [
  
  
  
{
  
  
  
  
"field": "released",
  
  
  
  
"prev_value": false,
  
  
  
  
"new_value": true
  
  
  
}
  
  
]
  
}
]

Playground​

Server
Authorization

Samples​

Request access to a project​

POST
/projects/{projectId}/project_access_requests

Creates an access request for the current user on the specified project. Project admins are notified via email (if SMTP is enabled). Returns JSON with toast and the new request ID, or an HTML redirect for browser requests. Returns 422 if the user has already requested access.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

projectId*

Numeric ID of the project to request access to.

Type
integer
Required
Example7

Responses​

Access request created successfully

application/json
JSON
{
  
"toast": {
  
  
"title": "Access request submitted.",
  
  
"message": [
  
  
  
"Your request for access has been sent."
  
  
],
  
  
"variant": "success"
  
},
  
"id": 42
}

Playground​

Server
Authorization
Variables
Key
Value

Samples​

Deny or cancel a project access request​

DELETE
/projects/{projectId}/project_access_requests/{requestId}

Admins can deny a pending access request; the requesting user can cancel their own request. If SMTP is enabled, a rejection email is sent when an admin denies. Returns JSON with toast and destroyed request ID, or HTML redirect for browser requests.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

projectId*

Numeric ID of the project.

Type
integer
Required
Example7
requestId*

Numeric ID of the access request.

Type
integer
Required
Example42

Responses​

Access request destroyed successfully

application/json
JSON
{
  
"toast": {
  
  
"title": "Access request denied.",
  
  
"message": [
  
  
  
"Successfully denied Jane Doe's request to access project."
  
  
],
  
  
"variant": "success"
  
},
  
"id": 42
}

Playground​

Server
Authorization
Variables
Key
Value

Samples​

List triage response templates for a project​

GET
/projects/{projectId}/triage_response_templates

Returns all response templates for the specified project, ordered by name. Viewer+ role required. Templates are reusable canned responses that triagers can insert into the response textarea when making triage decisions.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

projectId*

Numeric ID of the project.

Type
integer
Required
Example42

Responses​

List of templates

application/json
JSON
{
  
"triage_response_templates": [
  
  
{
  
  
  
"id": 1,
  
  
  
"name": "Accept - standard",
  
  
  
"body": "Concur with the finding as written.",
  
  
  
"created_by_id": 42,
  
  
  
"created_at": "2026-06-01T10:00:00Z"
  
  
}
  
]
}

Playground​

Server
Authorization
Variables
Key
Value

Samples​

Create a triage response template​

POST
/projects/{projectId}/triage_response_templates

Creates a new reusable response template for the project. Admin role required. Template names must be unique within the project (case-insensitive).

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

projectId*

Numeric ID of the project.

Type
integer
Required
Example42

Request Body​

application/json
JSON
{
  
"triage_response_template": {
  
  
"name": "Decline - needs evidence",
  
  
"body": "Unable to incorporate without supporting evidence."
  
}
}

Responses​

Template created

application/json
JSON
{
  
"triage_response_template": {
  
  
"id": 3,
  
  
"name": "Decline - needs evidence",
  
  
"body": "Unable to incorporate without supporting evidence.",
  
  
"created_by_id": 42,
  
  
"created_at": "2026-06-03T01:00:00Z"
  
}
}

Playground​

Server
Authorization
Variables
Key
Value
Body

Samples​

Replace a triage response template​

PUT
/projects/{projectId}/triage_response_templates/{id}

Full replacement of an existing template. Same behavior as PATCH. Admin role required.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

projectId*

Numeric ID of the project.

Type
integer
Required
Example42
id*

Numeric ID of the template.

Type
integer
Required
Example1

Request Body​

application/json
JSON
{
  
"triage_response_template": {
  
  
"name": "Accept - standard",
  
  
"body": "Concur with the finding as written."
  
}
}

Responses​

Template replaced

application/json
JSON
{
  
"triage_response_template": {
  
  
"id": 1,
  
  
"name": "Accept - standard",
  
  
"body": "Concur with the finding as written. No changes needed.",
  
  
"created_by_id": 42,
  
  
"created_at": "2026-06-03T01:00:00Z"
  
}
}

Playground​

Server
Authorization
Variables
Key
Value
Body

Samples​

Delete a triage response template​

DELETE
/projects/{projectId}/triage_response_templates/{id}

Permanently deletes a response template. Admin role required. Returns 204 No Content on success.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

projectId*

Numeric ID of the project.

Type
integer
Required
Example42
id*

Numeric ID of the template.

Type
integer
Required
Example1

Responses​

Template deleted

Playground​

Server
Authorization
Variables
Key
Value

Samples​

Update a triage response template​

PATCH
/projects/{projectId}/triage_response_templates/{id}

Updates an existing response template. Admin role required. Name uniqueness is enforced within the project.

Authorizations​

tokenAuth

Personal access token authentication. Send via Authorization header: Authorization: Token vulcan_xxx. Tokens are SHA-256 hashed server-side (never stored in plaintext). Scopes: read (GET), write (mutations), admin (everything). Create tokens via Settings → API Tokens in the web UI.

Type
HTTP (token)

Parameters​

Path Parameters

projectId*

Numeric ID of the project.

Type
integer
Required
Example42
id*

Numeric ID of the template.

Type
integer
Required
Example1

Request Body​

application/json
JSON
{
  
"triage_response_template": {
  
  
"name": "Accept - updated",
  
  
"body": "Updated response text."
  
}
}

Responses​

Template updated

application/json
JSON
{
  
"triage_response_template": {
  
  
"id": 1,
  
  
"name": "Accept - standard",
  
  
"body": "Concur with the finding as written. No changes needed.",
  
  
"created_by_id": 42,
  
  
"created_at": "2026-06-03T01:00:00Z"
  
}
}

Playground​

Server
Authorization
Variables
Key
Value
Body

Samples​

Powered by VitePress OpenAPI

Part of the MITRE Security Automation Framework (SAF)

Copyright © 2025 MITRE Corporation