# POST /api/v1/org/{orgId}/app/{appId}/env/{envId}/findings/triage/notes

**Bulk add notes to findings by hash**

Bulk add notes to findings by their finding hash within a single application environment. Unlike the full triage endpoint, this endpoint adds notes only — it does not change finding statuses.

## Finding Hashes

Finding hashes are SHA-256 identifiers that uniquely identify a finding across scans. You can discover finding hashes from:
- `GET /api/v1/reports/org/{orgId}/findings` — the `findingHash` field on each finding
- `GET /api/v1/scan/{scanId}/alert/{pluginId}` — the `findingHash` field on each alert URI

## Behavior

- The `status` field in each action is silently ignored — only the `note` is applied. No triage status is changed by this endpoint.
- Each action must include a non-blank `note`.
- This endpoint is available to all authenticated org members without any feature flag requirement.

## Limits

- Maximum **100 actions** per request
- One request per organization/application/environment combination

## Partial Success

The endpoint always returns HTTP 200 for valid requests. Individual action failures (e.g., finding hash not found) are reported per-result with `success: false` and an `error` message. Successful actions are still applied even if some fail.

> 🧾 Audited
> This is recorded as `ALERT_RULE_TRIAGED` [User Activity](https://apidocs.stackhawk.com/reference/listauditactivity#user-activity-types).

## Parameters

- `orgId` (in: path, string<uuid>) *(required)* — UUID identifier for this StackHawk Organization.
- `appId` (in: path, string<uuid>) *(required)* — UUID identifier for this StackHawk Application.
- `envId` (in: path, string<uuid>) *(required)* — UUID identifier for this StackHawk Environment.

## Request Body

### application/json

- `actions` (application.FindingTriageAction[]) — The list of triage actions to apply.
  - `findingHash` (string) — The SHA-256 finding hash identifying the specific finding.
  - `note` (string) — Optional note explaining the triage decision.
  - `status` (string) — The triage action: FALSE_POSITIVE, RISK_ACCEPTED, UNKNOWN, or ADD_COMMENT.
- `applicationId` (string) — The application containing the findings.
- `environmentId` (string) — The environment where the findings were detected.
- `organizationId` (string) — The organization that owns the application.
- `userId` (string) — The user performing the triage actions (inferred from API key, not user-supplied).

## Responses

### 200 — Response from bulk triage — echoes the result of each requested action.

#### application/json

- `applicationId` (string) — The application ID.
- `environmentId` (string) — The environment ID.
- `organizationId` (string) — The organization ID.
- `results` (application.FindingTriageResult[]) — Results for each requested triage action, in the same order as the request.
  - `error` (string) — Error message if the triage action failed (e.g., finding hash not found).
  - `findingHash` (string) — The finding hash that was triaged.
  - `note` (string) — The note on the finding after the action was applied.
  - `status` (string) — The current triage status of this finding after the action was applied.
  - `success` (boolean) — Whether the triage action succeeded.
  - `updatedAt` (string) — Timestamp of when the triage was applied.

#### application/x-protobuf

- `applicationId` (string) — The application ID.
- `environmentId` (string) — The environment ID.
- `organizationId` (string) — The organization ID.
- `results` (application.FindingTriageResult[]) — Results for each requested triage action, in the same order as the request.
  - `error` (string) — Error message if the triage action failed (e.g., finding hash not found).
  - `findingHash` (string) — The finding hash that was triaged.
  - `note` (string) — The note on the finding after the action was applied.
  - `status` (string) — The current triage status of this finding after the action was applied.
  - `success` (boolean) — Whether the triage action succeeded.
  - `updatedAt` (string) — Timestamp of when the triage was applied.

### 400 — Bad Request

- (no body)

### 401 — Unauthorized

- (no body)