Apply Patch

Mark a security patch as applied for a finding

POST /api/findings/{id}/apply-patch

Apply Patch

cURL

curl --request POST \
  --url https://api.example.com/api/findings/{id}/apply-patch

{
  "success": true,
  "data": {
    "finding_id": "123e4567-e89b-12d3-a456-426614174000",
    "patch_id": "789e1234-e89b-12d3-a456-426614174333",
    "applied_by": "555e5555-e89b-12d3-a456-426614175555",
    "event": {
      "id": "987e6543-e89b-12d3-a456-426614174999",
      "finding_id": "123e4567-e89b-12d3-a456-426614174000",
      "user_id": "555e5555-e89b-12d3-a456-426614175555",
      "event_type": "patch_applied",
      "old_value": null,
      "new_value": "789e1234-e89b-12d3-a456-426614174333",
      "comment": null,
      "metadata": null,
      "created_at": "2026-03-12T15:45:00Z"
    }
  }
}

Apply the suggested patch for a security finding. This operation marks the patch as applied and creates an audit event to track who applied it and when.

This endpoint requires authentication. The authenticated user will be recorded as the person who applied the patch.

This endpoint only marks the patch as applied in Heimdall’s database. It does not automatically modify your source code. You must apply the actual code changes separately.

Path Parameters

id · string · required

The unique UUID of the finding whose patch should be applied

Patch Application Process

When you call this endpoint, Heimdall performs the following steps:

1. Validates the finding exists - Ensures the specified finding ID is valid
2. Retrieves the latest patch - Fetches the most recent patch associated with this finding
3. Checks patch status - Verifies the patch hasn’t already been applied
4. Marks patch as applied - Updates the patch record with the applied status and user ID
5. Creates audit event - Records a patch_applied event for tracking

Each finding can have multiple patches generated over time. This endpoint always applies the most recent patch.

Response

Returns information about the applied patch and the audit event that was created.

data · object

Show Response Properties

finding_id · string

UUID of the finding whose patch was applied

patch_id · string

UUID of the patch that was marked as applied

applied_by · string

UUID of the user who applied the patch

event · object

The audit event created to track this operation

Show Event Properties

id · string

Unique identifier for the event

finding_id · string

UUID of the associated finding

user_id · string

UUID of the user who applied the patch

event_type · string

Always patch_applied for this operation

old_value · string

Always null for patch application events

new_value · string

The UUID of the patch that was applied

comment · string

Optional comment about the patch application

metadata · object

Additional structured data about the event

created_at · string

ISO 8601 timestamp when the patch was applied

{
  "success": true,
  "data": {
    "finding_id": "123e4567-e89b-12d3-a456-426614174000",
    "patch_id": "789e1234-e89b-12d3-a456-426614174333",
    "applied_by": "555e5555-e89b-12d3-a456-426614175555",
    "event": {
      "id": "987e6543-e89b-12d3-a456-426614174999",
      "finding_id": "123e4567-e89b-12d3-a456-426614174000",
      "user_id": "555e5555-e89b-12d3-a456-426614175555",
      "event_type": "patch_applied",
      "old_value": null,
      "new_value": "789e1234-e89b-12d3-a456-426614174333",
      "comment": null,
      "metadata": null,
      "created_at": "2026-03-12T15:45:00Z"
    }
  }
}

Error Responses

404 Not Found - Finding Not Found

Returned when the specified finding does not exist.

{
  "success": false,
  "code": 404,
  "message": "Finding '123e4567-e89b-12d3-a456-426614174000' not found"
}

404 Not Found - No Patch Available

Returned when no patch exists for the finding.

{
  "success": false,
  "code": 404,
  "message": "No patch available for finding '123e4567-e89b-12d3-a456-426614174000'"
}

409 Conflict

Returned when attempting to apply a patch that has already been applied.

{
  "success": false,
  "code": 409,
  "message": "Patch has already been applied"
}

500 Internal Server Error

Returned when the patch application fails or the event cannot be recorded.

{
  "success": false,
  "code": 500,
  "message": "Failed to apply patch: database connection error"
}

{
  "success": false,
  "code": 500,
  "message": "Patch applied but failed to record event: database error"
}

Best Practices

1. Review the patch first

   Use the Get Finding endpoint to retrieve the suggested_patch field and review the proposed changes before applying.

2. Apply code changes

   Manually apply the patch to your source code or use your preferred patching tool. This endpoint does not modify your code automatically.

3. Mark as applied

   Call this endpoint to record that the patch has been applied, enabling proper tracking and audit trails.

4. Verify the fix

   After applying the patch, consider running a new scan to verify the vulnerability has been resolved.