Skip to content
forgit api docs

Create or update an annotation

PUT
/repositories/{workspace}/{repo_slug}/commit/{commit}/reports/{reportId}/annotations/{annotationId}

Creates or updates an individual annotation for the specified report. Annotations are individual findings that have been identified as part of a report, for example, a line of code that represents a vulnerability. These annotations can be attached to a specific file and even a specific line in that file, however, that is optional. Annotations are not mandatory and a report can contain up to 1000 annotations.

Just as reports, annotation needs to be uploaded with a unique ID that can later be used to identify the report as an alternative to the generated UUID. If you want to use an existing id from your own system, we recommend prefixing it with your system’s name to avoid collisions, for example, mySystem-annotation001.

Sample cURL request:

curl --request PUT 'https://api.bitbucket.org/2.0/repositories/<username>/<reposity-name>/commit/<commit-hash>/reports/mySystem-001/annotations/mysystem-annotation001' \
--header 'Content-Type: application/json' \
--data-raw '{
    "title": "Security scan report",
    "annotation_type": "VULNERABILITY",
    "summary": "This line represents a security thread.",
    "severity": "HIGH",
    "path": "my-service/src/main/java/com/myCompany/mysystem/logic/Main.java",
    "line": 42
}'

Possible field values:

annotation_type: VULNERABILITY, CODE_SMELL, BUG result: PASSED, FAILED, IGNORED, SKIPPED severity: HIGH, MEDIUM, LOW, CRITICAL

Please refer to the Code Insights documentation for more information.

Authorizations

Section titled “ Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “ Path Parameters ”
workspace
required
string

This can either be the workspace ID (slug) or the workspace UUID surrounded by curly-braces, for example {workspace UUID}.

repo_slug
required
string

The repository.

commit
required
string

The commit the report belongs to.

reportId
required
string

Either the uuid or external-id of the report.

annotationId
required
string

Either the uuid or external-id of the annotation.

Request Body required

Section titled “ Request Body required ”

The annotation to create or update

Media type application/json
object
type
required
string
external_id

ID of the annotation provided by the annotation creator. It can be used to identify the annotation as an alternative to it’s generated uuid. It is not used by Bitbucket, but only by the annotation creator for updating or deleting this specific annotation. Needs to be unique.

string
uuid

The UUID that can be used to identify the annotation.

string
annotation_type

The type of the report.

string
Allowed values: VULNERABILITY CODE_SMELL BUG
path

The path of the file on which this annotation should be placed. This is the path of the file relative to the git repository. If no path is provided, then it will appear in the overview modal on all pull requests where the tip of the branch is the given commit, regardless of which files were modified.

string
line

The line number that the annotation should belong to. If no line number is provided, then it will default to 0 and in a pull request it will appear at the top of the file specified by the path field.

integer
>= 1
summary

The message to display to users.

string
details

The details to show to users when clicking on the annotation.

string
result

The state of the report. May be set to PENDING and later updated.

string
Allowed values: PASSED FAILED SKIPPED IGNORED
severity

The severity of the annotation.

string
Allowed values: CRITICAL HIGH MEDIUM LOW
link

A URL linking to the annotation in an external tool.

string format: uri
created_on

The timestamp when the report was created.

string format: date-time
updated_on

The timestamp when the report was updated.

string format: date-time

Responses

Section titled “ Responses ”

200

Section titled “ 200 ”

OK

Media type application/json
object
type
required
string
external_id

ID of the annotation provided by the annotation creator. It can be used to identify the annotation as an alternative to it’s generated uuid. It is not used by Bitbucket, but only by the annotation creator for updating or deleting this specific annotation. Needs to be unique.

string
uuid

The UUID that can be used to identify the annotation.

string
annotation_type

The type of the report.

string
Allowed values: VULNERABILITY CODE_SMELL BUG
path

The path of the file on which this annotation should be placed. This is the path of the file relative to the git repository. If no path is provided, then it will appear in the overview modal on all pull requests where the tip of the branch is the given commit, regardless of which files were modified.

string
line

The line number that the annotation should belong to. If no line number is provided, then it will default to 0 and in a pull request it will appear at the top of the file specified by the path field.

integer
>= 1
summary

The message to display to users.

string
details

The details to show to users when clicking on the annotation.

string
result

The state of the report. May be set to PENDING and later updated.

string
Allowed values: PASSED FAILED SKIPPED IGNORED
severity

The severity of the annotation.

string
Allowed values: CRITICAL HIGH MEDIUM LOW
link

A URL linking to the annotation in an external tool.

string format: uri
created_on

The timestamp when the report was created.

string format: date-time
updated_on

The timestamp when the report was updated.

string format: date-time
Example 
{
  "annotation_type": "VULNERABILITY",
  "result": "PASSED",
  "severity": "CRITICAL"
}

400

Section titled “ 400 ”

The provided Annotation object is malformed or incomplete.

Media type application/json
Error

Base type for most resource objects. It defines the common type element that identifies an object’s type. It also identifies the element as Swagger’s discriminator.

object
type
required
string
error
object
message
required
string
detail
string
data

Optional structured data that is endpoint-specific.

object
key
additional properties
any
key
additional properties
any
Example generated 
{
  "type": "example",
  "error": {
    "message": "example",
    "detail": "example",
    "data": {}
  }
}