Bulk Waivers API

Overview

The Firewall Bulk Waivers API extends the Firewall waiver APIs to create multiple repository policy waivers in a single request. It supports both quarantine violations (FAIL) and non-quarantine violations (WARN).

This API is atomic, if any violation fails validation, the entire request is rolled back and no waivers are created. Duplicate violation IDs are automatically deduplicated, and violations that already have applicable waivers are skipped without error. A maximum of 1000 violation IDs can be processed per request.

The Bulk Waivers feature supports bulk creation of waivers only. There is no bulk waiver request workflow for later approval.

Required permission: Waive Policy Violations

Endpoint

POST /api/v2/firewall/repositories/{ownerType}/{ownerId}/waivers/bulk

Path Parameter

Parameter	Type	Required	Description
`ownerType`	string	Yes	Scope of the waiver. One of: `organization`, `repository`, `repository_manager`, `repository_container`.
`ownerId`	string	Yes	ID corresponding to `ownerType`. All submitted violations must belong to this owner’s tenant hierarchy. Use `organization` with `ROOT_ORGANIZATION_ID` to apply across all repositories in the root organization scope.

Request Body

The request body must be a JSON object in the following format:

{
  "violationIds": ["violation-id-1", "violation-id-2"],
  "apiWaiverOptionsDTO": {
    "comment": "string",
    "matcherStrategy": "EXACT_COMPONENT",
    "expiryTime": "2026-04-30T23:59:59.999Z",
    "waiverReasonId": "string",
    "expireWhenRemediationAvailable": false
  }
}

Request Body Properties

Property	Type	Required	Description
`violationIds`	array<string>	Yes	List of repository policy violation IDs to waive. Maximum 1000 per request. Duplicate IDs are deduplicated automatically. Already-waived violations are skipped without error.
`apiWaiverOptionsDTO`	object	Yes	Waiver configuration options applied to all submitted violations.

Waiver Options Properties

Property	Type	Required	Default	Description
`comment`	string	No	`null`	Comment describing why the violations are being waived.
`matcherStrategy`	string	Yes	-	Supported values: `EXACT_COMPONENT, ALL_VERSIONS`.
`expiryTime`	string	No	`null`	Optional expiration date/time in ISO 8601 format. Must be in the future if provided.
`waiverReasonId`	string	No	`null`	Optional Waiver Reason ID.
`expireWhenRemediationAvailable`	boolean	No	`false`	Automatically expires the waiver when remediation becomes available. Only valid with `EXACT_COMPONENT`.

Behavior and Validation

Only Firewall repository policy violations can be bulk waived with this endpoint.
All violations must belong to the specified owner’s tenant hierarchy.
Only EXACT_COMPONENT and ALL_VERSIONS are supported.
If expireWhenRemediationAvailable=true, matcherStrategy must be EXACT_COMPONENT.
If expiryTime is provided, it must validate as a future date on the server.
The endpoint returns 204 No Content when the bulk waiver is created successfully.

Example:

Basic Firewall Bulk Waiver Creation Request:

curl -X POST \    
"https://your-server/api/v2Responses/firewall/repositories/repository/repo-12345/waivers/bulk" \
  -H "Content-Type: application/json" \
  -u username:password \
  -d '{
    "violationIds": [
      "violation-id-1",
      "violation-id-2",
      "violation-id-3"
    ],
    "apiWaiverOptionsDTO": {
      "comment": "Bulk waiver for approved internal dependencies",
      "matcherStrategy": "EXACT_COMPONENT",
      "expiryTime": "2026-04-30T23:59:59.999Z"
    }
  }

Responses

HTTP Status	Description
`204`	Bulk waiver created successfully.
`400`	Bad request, including invalid IDs, invalid owner scope, invalid waiver options, unsupported matcher strategy, or more than 1000 violation IDs.
`403`	User lacks permission or Firewall license is not active.
`404`	A repository associated with a submitted violation could not be found.