Skip to main content
Remediation actions let InfraAudit automatically fix drift and vulnerability findings in your cloud environment. Actions go through an approval gate before execution, and completed actions can be rolled back within a configurable window. Base path: /api/v1/remediation

​
GET /remediation — list remediation actions

Returns a paginated list of remediation actions. 
GET /api/v1/remediation
Authorization: Bearer <token>

​
Query parameters

​
status
string
Filter by status: pending_approval, approved, executing, completed, failed, or rolled_back.
​
resource_id
integer
Filter by resource.
​
provider_id
integer
Filter by provider.
​
page
integer
default:"1"
Page number.
​
per_page
integer
default:"20"
Results per page.

​
Response

{
  "data": [
    {
      "id": 1,
      "title": "Enable S3 server-side encryption",
      "resource_id": 5,
      "resource_name": "data-lake-bucket",
      "finding_type": "drift",
      "finding_id": 12,
      "status": "pending_approval",
      "risk": "low",
      "created_at": "2024-01-15T14:40:00Z"
    }
  ]
}
​
risk
string
Estimated risk of applying this remediation: low, medium, or high.

​
GET /remediation/ — get remediation details

Returns full details including the pre-execution snapshot, estimated risk assessment, and execution log. 
GET /api/v1/remediation/{id}
Authorization: Bearer <token>

​
POST /remediation — create remediation

Creates a new remediation action for a drift or vulnerability finding. 
POST /api/v1/remediation
Authorization: Bearer <token>
Content-Type: application/json

​
Request body

​
finding_type
string
required
The type of finding: drift or vulnerability.
​
finding_id
integer
required
The ID of the finding to remediate.
{
  "finding_type": "drift",
  "finding_id": 12
}

​
POST /remediation//approve — approve a remediation

Approves a remediation action so it can be executed. Action must be in pending_approval status. 
POST /api/v1/remediation/{id}/approve
Authorization: Bearer <token>
Content-Type: application/json

​
Request body (optional)

​
comment
string
Approval comment for the audit log.
{
  "comment": "Approved — coordinated with infra team"
}

​
POST /remediation//execute — run a remediation

Executes an approved remediation action against the cloud provider API. Action must be in approved status. 
POST /api/v1/remediation/{id}/execute
Authorization: Bearer <token>

​
Response 202

{
  "status": "executing",
  "started_at": "2024-01-15T15:00:00Z"
}

​
POST /remediation//rollback — rollback a remediation

Reverses a completed remediation action. Available within the rollback window after the action reaches completed status. 
POST /api/v1/remediation/{id}/rollback
Authorization: Bearer <token>

​
POST /remediation//reject — reject a remediation

Rejects a pending remediation action. 
POST /api/v1/remediation/{id}/reject
Authorization: Bearer <token>
Content-Type: application/json

​
Request body (optional)

​
reason
string
Reason for rejection.
{
  "reason": "Change not approved by change management"
}