GetProjectVulnerabilitiesReviewNotes

Search the review notes across all vulnerabilities linked to a project.

Headers

POST /api/ss/project/:id/vulnerabilities/review-notes HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json

Request

Path Parameters

id - string | required

ID for the project.

Body

skip - number

Number of records to skip. Default is 0 (do not skip any records).

limit - number

Number of records to limit to. Default limit is 50. Max limit is 50.

include_replies - boolean

Return each thread's replies under replies (true, the default) or leave replies off every note (false). Send false when you only need the top-level notes, which also skips the reply lookup.

resolved - boolean

Return resolved notes only (true) or unresolved notes only (false). Omit to return both.

vulnerability_ids - list of strings

IDs of the vulnerabilities to search within. Every id must be a vulnerability linked to this project. Omit, or send an empty list, to search all vulnerabilities in the project.

order - string

Field and direction to sort the threads by. Direction must be ASC or DESC. Default is created DESC. Replies are always returned oldest first, whichever direction the threads are in.

Field	Sortable	Notes
id	Yes
created	Yes	The default
created_by	No
modified	No
note	No
resolved	Yes
resolved_at	Yes	Notes that have never been resolved have no value, so they sort first in ASC and last in DESC

Ordering by any other field returns an error.

q - string

Provides options to query a custom selection of review notes. Please visit the following link for more details on how to use this filter - https://support.attackforge.com/attackforge-enterprise/modules/self-service-restful-api/advanced-query-filter

The filter applies to the threads, not to the replies inside them, and is combined with topic and resolved when those are also supplied. Only the fields below can be filtered - any other field, or an expression that does not parse, returns an error.

Fields

Field	Type	Notes
id	ObjectId
created	date	ISO 8601 string
created_by	ObjectId	The id of the user who wrote the note
modified	date	ISO 8601 string. Also accepted as last_modified
note	string	The stored text of the note - HTML on notes written in rich text - so it suits $regex
resolved	boolean
resolved_at	date	ISO 8601 string. Absent on notes that have never been resolved

Examples

 Find the notes one user wrote { created_by: { $eq: ObjectId("5eab99471e18050942c7607a") } }

 Find notes written since a date { created: { $gte: "2026-01-01" } }

 Find notes that have never been resolved { resolved_at: { $eq: null } }

topic - list of strings

Filter to review notes carrying one of these topics. Each value is type:source:key:

Part	Value
type	system for a built-in part of the vulnerability or writeup, or custom for a custom field
source	vulnerability for a part of the vulnerability itself, or library for a writeup field shown on it, such as the description
key	Which part or custom field the note is against - see below

Add one entry per topic, e.g. ["system:vulnerability:stepsToReproduce", "system:library:description"]. A note is returned if it carries any of them.

System topics on the vulnerability

Key	Notes
vulnerability	The vulnerability title
affected_assets	Affected Asset(s)
visibility
zeroDay	Is 0-Day?
scoring
priority
exploitability
stepsToReproduce
notes
cvssTags
tags
customTags
testCases	Associated Test Cases
evidence

For example system:vulnerability:affected_assets.

System topics on the writeup

The key is one of description, attack_scenario, remediation_recommendation or secdim_sandboxes. For example system:library:remediation_recommendation.

Custom topics

The key is the key of the custom field the note is against, not its label. It is the same value as key in the custom fields on Get Vulnerability, so a field with key business_impact is filtered as follows:

Custom field on	Key taken from	Filter
The vulnerability	vulnerability_custom_fields	custom:vulnerability:business_impact
The writeup	vulnerability_library_custom_fields	custom:library:business_impact

Every returned note lists its topics with type, source and key, so topics[].key can also be copied from an existing note.

Older notes

Notes written before topics had keys carry only a topic name. They are returned with source vulnerability and the key that name maps to, and only a system:vulnerability filter matches them. A filter on system:library:description will not find an older note against the description, but system:vulnerability:description will.

Validation

• Keys are case-sensitive and are not validated.

• An unknown key, or a custom field that does not exist, simply matches no notes.

• An unrecognised type or source, or an empty key, returns an error.

Example

Request

curl --request POST \
	--url https://demo.attackforge.com/api/ss/project/5eab99471e18050942c7607a/vulnerabilities/review-notes \
	--header 'content-type: application/json' \
	--header 'x-ssapi-key: ************' \
	--data '{
		"vulnerability_ids":["5e8017d2e1385f0c58e8f4f8"],
		"resolved":false,
		"order":"created ASC"
	}'

Response

{
  "count": 1,
  "review_notes": [
    {
      "id": "...",
      "vulnerability_id": "5e8017d2e1385f0c58e8f4f8",
      "vulnerability_title": "...",
      "vulnerability_alternate_id": "...",
      "note": "...",
      "note_html": "...",
      "created": "...",
      "created_by": {
        "id": "...",
        "first_name": "...",
        "last_name": "..."
      },
      "topics": [
        {
          "type": "system",
          "source": "vulnerability",
          "key": "description",
          "name": "Description"
        }
      ],
      "resolved": false,
      "replies": [
        {
          "id": "...",
          "note": "...",
          "created": "...",
          "created_by": {
            "id": "...",
            "first_name": "...",
            "last_name": "..."
          },
          "replies": []
        }
      ]
    }
  ]
}

Access and failures

Requires Edit access to the project. Failures come back as an error in the 200 body:

Error	When
Missing Authorization	You do not have access to the project
Insufficient Authorization	You do not have Edit access to the project
vulnerability_ids contain invalid ids	An id is not a non-deleted vulnerability linked to this project
An invalid filter message	topic or q did not validate - see each property below
Error Finding Review Notes	The lookup failed

Response

Results come back as threads: each review note carries its replies nested under replies, oldest first, whichever direction the threads are sorted in, and a reply to a reply is nested the same way. Send include_replies as false to leave replies off every note. count, skip and limit apply to the threads on this page, not to the replies inside them. Deleted notes are dropped along with their thread, and deleted replies are dropped from the thread they belong to.

Every thread carries vulnerability_id. Topics for custom fields you cannot view are removed from topics, and a note whose topics are all hidden from you is not returned at all.

note is plain text, and created and resolved_at are ISO 8601 UTC strings. These properties are only present when they apply:

Property	Present when
vulnerability_title, vulnerability_alternate_id	The vulnerability has them
note_html	The note was written in rich text
resolved_at	The note has been resolved
has_hidden_topics	A topic was removed from topics because you cannot view its custom field. Always true
replies	include_replies is not false