<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Vulnerability Exception Management

## Exception Types

| Type | Max Duration | Required Documentation |
|---|---|---|
| `risk_acceptance` | 90 days | Business justification, risk assessment |
| `compensating_control` | 180 days | Control description, verification evidence |
| `false_positive` | Permanent | Proof finding is incorrect |
| `operational_constraint` | 365 days | Vendor timeline, workaround details |

## Approval Matrix

| Severity | Approver |
|---|---|
| Critical | CISO |
| High | Director of Security |
| Medium | Security Manager |
| Low | Team Lead |

## Nessus Exception API

| Endpoint | Description |
|---|---|
| `PUT /scans/{id}/hosts/{hid}/plugins/{pid}` | Set plugin status to accepted |
| `GET /scans/{id}/export?chapters=vuln_by_host` | Export with exception status |

## Agent Script

```bash
# Create exception
node agent.js create --cves CVE-2024-3400 --assets fw-prod-01 \
  --severity critical --type compensating_control \
  --justification "WAF rule deployed" --requested-by john@example.com \
  --controls "WAF rule active" "IDS monitoring enabled"

# Review exceptions
node agent.js review exceptions.json

# Approve exception
node agent.js approve exceptions.json --id EXC-2024-A1B2 --approved-by ciso@example.com

# Generate audit trail
node agent.js audit exceptions.json
```
