> ## Documentation Index > Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt > Use this file to discover all available pages before exploring further. # Update a resource (partial) > Partial merge update; `id` and `userId` in the body are ignored (owner scoping comes from the session). ## OpenAPI ````yaml /api/openapi.json put /api/vulnerabilities/{id} openapi: 3.1.0 info: title: Aquila API version: 1.0.0 description: >- Event-driven reconnaissance platform API. All /api/* routes except /api/public/* require an authenticated session (cookie), an X-Api-Key header, or a bearer token. Auth endpoints under /api/auth/* are generated by Better Auth. servers: - url: https://aquila.attaxr.com - url: http://localhost security: [] tags: - name: AI - name: Agents - name: Bulk Delete - name: Chat - name: Constraints - name: Dashboard - name: Events - name: JS - name: JS Analysis - name: JS Monitoring - name: Leads - name: MCP Key - name: Models - name: Notification Channels - name: Notification Event Preferences - name: Notifications - name: OOB - name: Provider Keys - name: Public Shares - name: Reinforcements - name: Reports - name: Scans - name: Schedules - name: Shares - name: Tools - name: User Profiles - name: V1 - name: Vulnerabilities - name: Workflows paths: /api/vulnerabilities/{id}: put: tags: - Vulnerabilities summary: Update a resource (partial) description: >- Partial merge update; `id` and `userId` in the body are ignored (owner scoping comes from the session). operationId: putApiVulnerabilitiesId parameters: - name: id in: path required: true schema: type: string requestBody: required: true content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: id: type: string minLength: 1 userId: type: string leadId: type: string scanId: type: string target: type: string dedupKey: type: string title: type: string minLength: 1 severity: default: medium type: string enum: - info - low - medium - high - critical score: type: number minimum: 0 maximum: 100 status: default: open type: string enum: - open - triaging - confirmed - false_positive - fixed category: type: string featureCategory: type: string enum: - admin - api - auth - static - cdn - redirect - error - login - file_upload - exposed_asset - form - authentication - infrastructure - documentation - javascript_analysis - hidden_functionality - debug - internal - sensitive_data - technology_signature - parameterized_endpoint description: default: '' type: string proofOfConcept: type: string stepsToReproduce: type: string impact: type: string remediation: type: string attackScenarioMermaid: type: string chainRefs: type: array items: type: object properties: kind: type: string enum: - lead - inventory - vulnerability id: type: string label: type: string note: type: string required: - kind references: type: array items: type: object properties: title: type: string url: type: string evidence: type: array items: type: object properties: label: type: string minLength: 1 detail: type: string required: - label - detail methodology: type: string toolName: type: string metadata: default: {} type: object propertyNames: type: string additionalProperties: {} confirmedAt: {} createdAt: default: '2026-09-18T11:34:11.694Z' updatedAt: default: '2026-09-18T11:34:11.694Z' responses: '200': description: The updated resource. content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: id: type: string minLength: 1 userId: type: string leadId: type: string scanId: type: string target: type: string dedupKey: type: string title: type: string minLength: 1 severity: default: medium type: string enum: - info - low - medium - high - critical score: type: number minimum: 0 maximum: 100 status: default: open type: string enum: - open - triaging - confirmed - false_positive - fixed category: type: string featureCategory: type: string enum: - admin - api - auth - static - cdn - redirect - error - login - file_upload - exposed_asset - form - authentication - infrastructure - documentation - javascript_analysis - hidden_functionality - debug - internal - sensitive_data - technology_signature - parameterized_endpoint description: default: '' type: string proofOfConcept: type: string stepsToReproduce: type: string impact: type: string remediation: type: string attackScenarioMermaid: type: string chainRefs: type: array items: type: object properties: kind: type: string enum: - lead - inventory - vulnerability id: type: string label: type: string note: type: string required: - kind additionalProperties: false references: type: array items: type: object properties: title: type: string url: type: string additionalProperties: false evidence: type: array items: type: object properties: label: type: string minLength: 1 detail: type: string required: - label - detail additionalProperties: false methodology: type: string toolName: type: string metadata: default: {} type: object propertyNames: type: string additionalProperties: {} confirmedAt: {} createdAt: default: '2026-09-18T11:34:11.695Z' updatedAt: default: '2026-09-18T11:34:11.695Z' required: - id - userId - title - severity - status - description - metadata - createdAt - updatedAt additionalProperties: false '400': description: Request body failed schema validation. content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: error: type: string details: {} required: - error additionalProperties: false '401': description: No valid session cookie or API key. content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: error: type: string required: - error additionalProperties: false '403': description: Email address not verified, or the caller lacks the required role. content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: error: type: string required: - error additionalProperties: false '404': description: No such id for this owner. content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: error: type: string required: - error additionalProperties: false '429': description: >- Risk-tier rate limit exceeded (writes 20/min, expensive 10/min, bulk 60/min). Limited responses carry X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and Retry-After. content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: error: type: string required: - error additionalProperties: false security: - apiKeyCookie: [] - apiKeyHeader: [] - bearerAuth: [] components: securitySchemes: apiKeyCookie: type: apiKey in: cookie name: better-auth.session_token description: Browser session cookie set by Better Auth sign-in. apiKeyHeader: type: apiKey in: header name: x-api-key description: Personal API key (aquila_… prefix; settings → API keys). bearerAuth: type: http scheme: bearer description: Personal API key sent as a bearer token. ````