# List remediations aggregated across campaigns for a target

Returns a paginated collection of remediation categories for the selected campaigns (each category nests `probes` with summary, distinct issues, AI-layer fix including optional how-to steps, engineering guidance, and retest criteria). Fixes are per probe; there is no cross-probe combined recipe. Uses the same `cursor` / `limit` pagination as other list APIs (default limit 50, max 200); `totalItems` is the number of categories.
Campaign selection uses the latest finished campaign of each campaign group. By default the newest 20 of that selection are used (`lastNCampaigns` defaults to 20; allowed range 1–20). `campaigns` replaces the selection with an explicit list (at most 20 ids; cannot be combined with `lastNCampaigns`). After selection, campaign ids are unique-sorted and capped at 20. Optional `severity`, `category`, and `sort` filter and sort the results. Campaigns still remediating are omitted. Download the full report via `GET .../remediations/report` with the same campaign/filter query params.

Endpoint: GET /api/v3.0/redteaming/orgs/{orgUuid}/applications/{applicationUuid}/projects/{projectUuid}/targets/{targetId}/remediations
Version: 3.0
Security: bearer-key

## Security:

  - `bearer-key` (unknown)
    http bearer JWT

## Path parameters:

  - `orgUuid` (string, required)

  - `applicationUuid` (string, required)

  - `projectUuid` (string, required)

  - `targetId` (string, required)

## Query parameters:

  - `pretty` (boolean)
    When `true`, indent the JSON body (2 spaces) and render multiline string
fields (e.g. YAML `config`) with literal newlines for human readability.
Default off (compact JSON). Intended for interactive use; omit for clients
that parse the body as strict JSON.

  - `cursor` (integer)

  - `limit` (integer)

  - `campaigns` (array)
    Comma-separated campaign ids to aggregate remediations for (at most 20 UUIDs). Sent once as a single value; each id must be a UUID, with no empty items, whitespace or duplicates (case-insensitive). Any id that does not belong to the target returns 404. Cannot be combined with `lastNCampaigns`.

  - `lastNCampaigns` (integer)
    Use only the N newest campaigns of the latest-finished-per-group selection (1–20). Defaults to 20 when omitted. Cannot be combined with `campaigns`. Must be sent once.

  - `severity` (string)
    Optional. Comma-separated severities: critical, high, medium, low. Sent once as a single value. Any other value returns 400 REMEDIATIONS.SEVERITY_INVALID.

  - `category` (string)
    Optional. Comma-separated category names. Sent once as a single value. At most 20 names of at most 100 characters each; otherwise 400 REMEDIATIONS.CATEGORY_INVALID.

  - `sort` (string)
    Optional. `asr` sorts by attack success rate, highest first. Omit for the default order (worst severity first, then name). Sent once. Any other value returns 400 REMEDIATIONS.SORT_INVALID.

## Header parameters:

  - `X-Correlation-ID` (string)
    Optional caller-supplied correlation id. Must be a UUID when present.
When omitted or blank, the API generates a UUID. A non-UUID value
returns 400 `CORRELATION.INVALID`. If a write fails because a UUID is already in use, the API returns 409
`UUID.DUPLICATE`. The value used (caller or generated) is echoed as
`supportToken` and in the `X-Correlation-ID` response header.

## Response 200:

  - `200` (unknown)
    Collection of remediation categories (each with nested probes) for the same campaign ids and filters. Probe `description` is the campaign description; engineering guidance uses `authorization`; distinct issues use `issue` and `evidence` finding links. `additionalData` carries `totalItems`, `cursor`, and `next` like other list APIs.

## Response 200 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `additionalData` (object, required)

  - `additionalData.totalItems` (string, required)
    Total number of items, encoded as a string.

  - `additionalData.cursor` (integer)

  - `additionalData.next` (string)
    URL of the next page, or null when this page is the last.

  - `response` (array, required)
    Page of remediation categories (each nests probes). AI-layer and engineering fixes are on each probe (including optional aiLayerFix.howToImplement); there is no cross-probe combined recipe.

  - `response.name` (string, required)

  - `response.probesNeedingFix` (integer, required)

  - `response.totalProbeTypes` (integer, required)

  - `response.categoryAttackSuccessRate` (number, required)

  - `response.severityCounts` (object, required)

  - `response.topProbes` (array, required)

  - `response.topProbes.probeId` (string, required)
    Probe id (same value as finding `probeId`).

  - `response.topProbes.probeLabel` (string, required)

  - `response.topProbes.severity` (string, required)
    Enum: "critical", "high", "medium", "low"

  - `response.topProbes.attackSuccessRate` (number, required)

  - `response.topProbesRemaining` (integer, required)

  - `response.probes` (array, required)

  - `response.probes.probeId` (string, required)
    Probe id (same value as finding `probeId`).

  - `response.probes.probeLabel` (string, required)

  - `response.probes.severity` (string, required)
    Enum: "critical", "high", "medium", "low"

  - `response.probes.attackSuccessRate` (number, required)

  - `response.probes.successfulAttacks` (number, required)

  - `response.probes.total` (number, required)

  - `response.probes.summary` (string, required)

  - `response.probes.distinctIssues` (array, required)

  - `response.probes.distinctIssues.issue` (string, required)

  - `response.probes.distinctIssues.description` (string, required)

  - `response.probes.distinctIssues.evidence` (array, required)
    Links to findings that provide evidence for this issue.

  - `response.probes.distinctIssues.evidence.href` (string, required)
    Public findings URL for this evidence result id.

  - `response.probes.aiLayerFix` (object, required)

  - `response.probes.aiLayerFix.systemPrompt` (string)
    Optional. Present when a system-prompt fix is available.

  - `response.probes.aiLayerFix.policies` (array, required)

  - `response.probes.aiLayerFix.guardrails` (array, required)

  - `response.probes.aiLayerFix.filters` (array, required)

  - `response.probes.aiLayerFix.howToImplement` (object)
    Optional. Present when the probe guide includes how-to steps for one or more AI-layer categories (systemPrompt, policies, guardrails, filters).

  - `response.probes.aiLayerFix.howToImplement.systemPrompt` (array)
    Optional. Present when system-prompt how-to steps exist.

  - `response.probes.aiLayerFix.howToImplement.policies` (array)
    Optional. Present when policy how-to steps exist.

  - `response.probes.aiLayerFix.howToImplement.guardrails` (array)
    Optional. Present when guardrail how-to steps exist.

  - `response.probes.aiLayerFix.howToImplement.filters` (array)
    Optional. Present when filter how-to steps exist.

  - `response.probes.engineeringGuidance` (object)
    Optional. Present when engineering guidance sections have content.

  - `response.probes.engineeringGuidance.authorization` (array, required)

  - `response.probes.engineeringGuidance.logging` (array, required)

  - `response.probes.engineeringGuidance.monitoring` (array, required)

  - `response.probes.engineeringGuidance.acceptanceCriteria` (array, required)

  - `response.probes.engineeringGuidance.other` (array, required)

  - `response.probes.retestCriteria` (array, required)

  - `response.probes.description` (string, required)
    Campaign description (empty when the campaign has no description).

  - `response.probes.createdAt` (number, required)

## Response 200 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 400:

  - `400` (unknown)
    X-Correlation-ID is not a UUID (CORRELATION.INVALID), cursor is invalid (PAGE.CURSOR), limit is out of range (PARAM.INT_RANGE), or a remediations campaign/filter query param is invalid (CAMPAIGNS.* / PARAM.INT_RANGE / REMEDIATIONS.SEVERITY_INVALID / REMEDIATIONS.SORT_INVALID / REMEDIATIONS.CATEGORY_INVALID).

## Response 400 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 400 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 401:

  - `401` (unknown)
    Authentication failed. The job report returns this JSON envelope and never a PDF or CSV attachment. Codes: AUTH.REQUIRED, AUTH.FAILED, AUTH.USER_HEADER_MISMATCH, JWT.EXPIRED, JWT.SIGNATURE, JWT.STRUCTURE, JWT.MISSING_CLAIMS, JWT.UNAVAILABLE, JWT.CLAIM_INVALID, JWT.VERIFICATION_FAILED.

## Response 401 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 401 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 403:

  - `403` (unknown)
    Authentication succeeded but the call is not allowed. AUTH.SERVICE_BOT: a service-to-service token cannot call this API. AUTH.ORG_MISMATCH: the organization in the URL does not match the access token. AUTH.INSUFFICIENT_PERMISSIONS: the token lacks permission for this action. Template update and delete also return AUTH.INSUFFICIENT_PERMISSIONS when the caller is not the template owner and does not have manage-settings access. TEMPLATE.ORG_SCOPE_DENIED: a template write whose scope is organization without organization-level manage-targets permission.

## Response 403 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 403 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 404:

  - `404` (unknown)
    No campaign configuration exists for this campaign (CAMPAIGN.NOT_FOUND), or the target does not exist (TARGET.NOT_FOUND).

## Response 404 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 404 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 429:

  - `429` (unknown)
    The caller exceeded the per-user request rate (RATE.LIMITED). The default is 600 requests per minute per user. Retry after the number of seconds in Retry-After.

## Response 429 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 429 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

  - `Retry-After` (integer)
    Seconds to wait before retrying.

## Response 500:

  - `500` (unknown)
    INTERNAL.ERROR: an unexpected failure. Retry and include supportToken if it continues. AUTH.PERMISSIONS_UNRESOLVED: permissions could not be resolved.

## Response 500 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 500 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 502:

  - `502` (unknown)
    The response body exceeded the maximum allowed size (UPSTREAM.TOO_LARGE). The default limit is 50 MB.

## Response 502 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 502 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 503:

  - `503` (unknown)
    The API is temporarily unavailable and is not accepting this request. This body is not the error envelope.

## Response 503 fields (application/json):

  - `status` (string, required)
    Enum: "not-ready"

  - `reason` (string, required)
    Why the API is not accepting the request.

## Response 504:

  - `504` (unknown)
    The operation timed out (UPSTREAM.TIMEOUT). The default timeout is 120 seconds, and 300 seconds for report exports. The operation may still complete; check its state before retrying a write.

## Response 504 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 504 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 400 examples:

  - `REMEDIATIONS.SEVERITY_INVALID` (unknown)

  - `REMEDIATIONS.SORT_INVALID` (unknown)

  - `REMEDIATIONS.CATEGORY_INVALID` (unknown)

  - `PATH.INVALID_UUID` (unknown)
    {name} is the path parameter that is not a UUID, for example targetId.

  - `CORRELATION.INVALID` (unknown)

## Response 401 examples:

  - `AUTH.REQUIRED` (unknown)

  - `AUTH.FAILED` (unknown)

  - `AUTH.USER_HEADER_MISMATCH` (unknown)

  - `JWT.EXPIRED` (unknown)

  - `JWT.SIGNATURE` (unknown)

  - `JWT.STRUCTURE` (unknown)

  - `JWT.MISSING_CLAIMS` (unknown)

  - `JWT.UNAVAILABLE` (unknown)

  - `JWT.CLAIM_INVALID` (unknown)

  - `JWT.VERIFICATION_FAILED` (unknown)

## Response 403 examples:

  - `TEMPLATE.ORG_SCOPE_DENIED` (unknown)

  - `AUTH.SERVICE_BOT` (unknown)

  - `AUTH.ORG_MISMATCH` (unknown)

  - `AUTH.INSUFFICIENT_PERMISSIONS` (unknown)

## Response 404 examples:

  - `CAMPAIGN.NOT_FOUND` (unknown)

  - `TARGET.NOT_FOUND` (unknown)

## Response 429 examples:

  - `RATE.LIMITED` (unknown)

## Response 500 examples:

  - `INTERNAL.ERROR` (unknown)

  - `AUTH.PERMISSIONS_UNRESOLVED` (unknown)

## Response 502 examples:

  - `UPSTREAM.TOO_LARGE` (unknown)

## Response 504 examples:

  - `UPSTREAM.TIMEOUT` (unknown)