PatchProjectRetestRound

This method can be used for the following functionality: Patch a retest for a project that user has Edit access to.

Parameters

The following URL, Headers and Parameters are required for requests to this API endpoint. Where a parameter is optional, it will be indicated. Otherwise treat all parameters as mandatory.

Headers

PATCH /api/ss/project/:projectId/retest/:retestRoundNumber HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json
Connection: close

Path

projectId (string)

Id of the project.

Example:

POST /api/ss/project/5e7c29afa3362408cf502a11/retest/:retestRoundNumber HTTP/1.1

retestRoundNumber (number)

Number of the Project Retest Round. Rounds are numbered from 1.

Example:

POST /api/ss/project/5e7c29afa3362408cf502a11/retest/:retestRoundNumber HTTP/1.1

Body

retesting_window_start (string) (optional)

Start date for retest window. Must be ISO8601 datetime e.g. 2025-03-23T00:00:00.000Z.

Example:

{   
    "retesting_window_start": "2025-03-23T00:00:00.000Z"
}

retesting_window_end (string) (optional)

End date for retest window. Must be ISO8601 datetime e.g. 2025-03-30T00:00:00.000Z.

Example:

{   
    "retesting_window_end": "2025-03-30T00:00:00.000Z"
}

vulnerability_ids (array of strings)

Project Vulnerability Ids in-scope for the retest round. Replaces the round's scope - every vulnerability listed is moved to 'Retest' status, not only the ones being added, so one which stayed in scope but was moved out of 'Retest' is put back. Vulnerabilities removed from the scope are moved back out of it. Unlike Request New Project Retest they do not have to be in 'Retest' status already, and a vulnerability already in that status is left alone, so sending the same scope again changes nothing. Every id must be a vulnerability on the project, otherwise the whole call is rejected.

Example:

{   
    "vulnerability_ids": ["6639508f50523053f459d29f"]
}

timezone (string) (optional)

Timezone the retest window dates were given in e.g. America/Chicago.

Example:

{   
    "timezone": "Australia/Sydney"
}

custom_fields (array of objects) (optional)

Custom fields. Must include a key and value. Key must be unique and letters, number and underscores only.

For more information visit https://support.attackforge.com/attackforge-enterprise/getting-started/custom-fields-and-forms#using-custom-fields-with-apis

Example:

{   
    "custom_fields": [
        {
            "key": "...", 
            "value": "..."
        }
    ]
}

Example

The following example is a cURL request to request a retest round on a project.

Request

Include API Token instead of stars in 'X-SSAPI-KEY: ***************************************' parameter.

curl --request PATCH \
	--url https://demo.attackforge.com/api/ss/project/5eacb8450c8d520a8281e539/retest/1 \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************' \
	--data '{
		"retesting_window_start":"2025-03-23T00:00:00.000Z",
		"retesting_window_end":"2025-03-30T00:00:00.000Z",
		"timezone":"Australia/Sydney",
		"vulnerability_ids":["6639508f50523053f459d29f"],
		"custom_fields":[{"key":"retest_reason","value":"Fixes deployed to production"}]
	}'

Response

Response contains a status.

{
   "status": "Project Retest Round Patched"
}