<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Vulnerability Exception Process — API Reference

## Jira Exception Workflow

```bash
# Create exception request ticket
curl -s -X POST "https://jira.internal/rest/api/2/issue" \
  -H "Authorization: Bearer $JIRA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": {
      "project": {"key": "VULN"},
      "summary": "Exception: CVE-2024-6387 on web-prod-01",
      "issuetype": {"name": "Exception Request"},
      "priority": {"name": "High"},
      "customfield_10100": "compensating-control",
      "customfield_10101": "2026-06-15",
      "labels": ["vuln-exception", "compensating-control"]
    }
  }'

# Transition to approved
curl -s -X POST "https://jira.internal/rest/api/2/issue/VULN-123/transitions" \
  -H "Authorization: Bearer $JIRA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"transition": {"id": "31"}, "fields": {"customfield_10102": "VP Security"}}'

# Search expiring exceptions
curl -s "https://jira.internal/rest/api/2/search" \
  -H "Authorization: Bearer $JIRA_TOKEN" \
  -G --data-urlencode 'jql=project=VULN AND issuetype="Exception Request" AND cf[10101] <= endOfWeek()'
```

## ServiceNow Exception Management

```bash
# Create exception record
curl -s -X POST "https://INSTANCE.service-now.com/api/now/table/sn_vul_exception" \
  -H "Authorization: Bearer $SN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"vulnerability": "CVE-2024-6387", "asset": "web-prod-01", "type": "compensating_control"}'

# Query active exceptions
curl -s "https://INSTANCE.service-now.com/api/now/table/sn_vul_exception" \
  -H "Authorization: Bearer $SN_TOKEN" \
  --data-urlencode "sysparm_query=state=active^expiration<javascript:gs.daysAgo(-14)"
```

## DefectDojo Risk Acceptance

```bash
# Create risk acceptance
curl -s -X POST "https://defectdojo.internal/api/v2/risk_acceptance/" \
  -H "Authorization: Token $DD_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"accepted_findings": [123], "owner": 1, "expiration_date": "2026-06-15"}'

# List active risk acceptances
curl -s "https://defectdojo.internal/api/v2/risk_acceptance/?is_expired=false" \
  -H "Authorization: Token $DD_TOKEN"
```

## Exception Authority Matrix

| Severity | Max Exception Duration | Approval Required |
|----------|----------------------|-------------------|
| Critical | 7 days | CISO |
| High | 30 days | VP Security |
| Medium | 90 days | Director |
| Low | 180 days | Team Lead |
