Generate an auto-fix proposal on demand.
POST/v1/scans/:scan_id/findings/:finding_id/autofix-proposals
Runs the restricted agent (read-only tools, file deny-list, size cap) against the finding and stages a proposal. If an open proposal already exists for the same fingerprint+repo, that one is returned with 200 instead — idempotent on the dev-tool path, so a CI loop can safely retry.
If the agent declined to produce a patch (forbidden file, model refusal, …), the response is still 201 with a failed-status proposal whose error carries the reason.
On split control-plane/data-plane deployments the agent runs on a scan worker instead of the control plane: the request returns 202 with status: "queued" and a proposals_url to poll (the new proposal appears in the scan's proposal list when the worker ships its result). A 409 means the scan is still running or another rerun is queued for it — retry once it finishes.
Request
Responses
- 200
- 201
- 202
- 400
- 403
- 404
- 409
Existing open proposal returned (idempotent).
Newly staged proposal (or a failed row if the agent declined).
Split deployment: generation was dispatched to a scan worker.
Poll proposals_url for the resulting proposal.
Malformed request — missing or invalid fields.
Authenticated, but not allowed (tier / role / ownership).
Resource not found or not visible to the caller.
Conflict with current resource state.