# Create Security Finding — Security Reporter

> Creates a new security finding. See the documentation

- Key: `security_reporter-create-finding`
- Type: Action (Write)
- Version: 0.1.1
- App: Security Reporter (`security_reporter`) — https://pipedream.com/apps/security-reporter.md
- This page (HTML): https://pipedream.com/apps/security-reporter/actions/create-finding
- Hints: open-world
- Source: https://github.com/PipedreamHQ/pipedream/blob/master/components/security_reporter/actions/create-finding/create-finding.mjs

## Description

Creates a new security finding. [See the documentation](https://trial3.securityreporter.app/api-documentation)

## Props

| Prop | Type | Required | Description |
|---|---|---|---|
| `assessmentId` | `string` | Yes | The ID of the assessment Options are loaded from the connected account. |
| `title` | `string` | Yes | Title of the finding. Must not be greater than 191 characters. |
| `targets` | `string[]` | Yes | The IDs of targets the finding applies to. Each target must belong to the assessment. Options are loaded from the connected account. |
| `assessmentSectionId` | `string` | Yes | The ID of the assessment section to put the finding in. The section must belong to the assessment, and its can_have_findings must be true. Options are loaded from the connected account. |
| `isVulnerability` | `boolean` | Yes | Whether the finding is for a vulnerability (and has associated severity metrics). |
| `foundAt` | `string` | No | The date when the finding was found. Format: YYYY-MM-DDTHH:MM:SS. |
| `priority` | `string` | No | How urgent resolving this finding is. Must be a valid priority. |
| `complexity` | `string` | No | How complex resolving this finding is. Must be a valid complexity. |
| `action` | `string` | No | The recommended action (under 500 characters) to resolve this finding. Example: Update ... |
| `description` | `string` | Yes | The description of the finding. Example: There is ... |
| `risk` | `string` | No | The risk associated with the finding. Example: A hacker could ... |
| `recommendation` | `string` | No | The recommendation for the finding. Example: Update ... |
| `proof` | `string` | No | The proof for the finding. Example: See attached ... |
| `references` | `string` | No | The references for the finding. **Example: - https://owasp.org/Top10/A03_2021-Injection/` https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/** |
| `draftDocuments` | `string[]` | No | Document IDs of uploaded draft documents. |
| `draftDocumentsFile` | `string[]` | No | One or more files to upload. For each entry, provide either a file URL or a path to a file in the /tmp directory (for example, /tmp/myFile.txt) |
| `resolvers` | `string[]` | No | User IDs of users assigned to resolve the finding. Options are loaded from the connected account. |
| `userGroups` | `string[]` | No | The user groups for the finding Options are loaded from the connected account. |
| `classifications` | `string[]` | No | An array with classifications by classification system. You can use any combination of CWE, CAPEC or VRT classifications. Note that classifications are ignored if their system is not set in the assessment. |
| `SMScoringSystem` | `string` | Yes | The scoring system you want to use. See the documentation for further information. |

## Run it

**MCP**

```ts
import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const accessToken = await pd.rawAccessToken

const transport = new StreamableHTTPClientTransport(
  new URL("https://remote.mcp.pipedream.net/v3"),
  {
    requestInit: {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "x-pd-project-id": process.env.PIPEDREAM_PROJECT_ID!,
        "x-pd-environment": "production",
        "x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
        "x-pd-app-slug": "security_reporter",
      },
    },
  },
)

const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)

const { tools } = await mcp.listTools()

// listTools() hands your model this tool's input schema, so it can
// fill the arguments itself:
const result = await mcp.callTool({
  name: "security_reporter-create-finding",
  arguments: {
    assessmentId: "Assessment ID",
    title: "Title",
  },
})
```

**TypeScript**

```ts
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "security_reporter-create-finding",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    security_reporter: { authProvisionId: "apn_xxxxxxx" },
    assessmentId: "Assessment ID",
    title: "Title",
  },
})

console.log(result)
```

**cURL**

```bash
curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
  -H "Content-Type: application/json" \
  -H "X-PD-Environment: production" \
  -H "Authorization: Bearer {access_token}" \
  -d '{
    "external_user_id": "{external_user_id}",
    "id": "security_reporter-create-finding",
    "configured_props": {
      "security_reporter": { "authProvisionId": "apn_xxxxxxx" },
      "assessmentId": "Assessment ID",
      "title": "Title"
    }
  }'
```

---

- App: https://pipedream.com/apps/security-reporter.md · All apps: https://pipedream.com/apps