By configuring this feature, you can require users to provide specific information—such as an expiration date or an approver's name—when they move a finding to the Accepted Risk state. This ensures that risk acceptance is consistently documented and periodically reviewed.
Part 1: Configure the risk acceptance workflow
As the Account Owner, you can define which fields are mandatory when a user accepts the risk of a finding.
From the side menu in your Snyk API & Web account, navigate to Settings > Scan Settings.
Locate the RISK ACCEPTANCE WORKFLOW module.
Select the checkboxes for the fields you want to require:
Expiration date: Requires the user to set a date on which the risk acceptance will automatically expire. If you select this, you can also set a maximum acceptance period (in days) to limit how far in the future the expiration date can be.
Approver name: Requires the user to enter the name of the person who approved the finding.
Approval date: Requires the user to enter the date when the finding was approved.
Click Save to apply your changes.
Part 2: How to accept a finding's risk
Once the workflow is configured, any user accepting a finding's risk is prompted to provide the required information.
Navigate to any page where findings are listed (e.g., the global Findings page or a target's details page).
Select one or more findings you wish to accept.
From the State drop-down menu, select Accepted Risk.
A dialog box is displayed, listing the custom fields you configured in Part 1.
Fill out the required information and click Accept risk.
Verify the outcome
After you submit the form, the state of the selected findings changes to Accepted Risk. This action, along with all the information you provided, is recorded in both the individual finding logs and the account audit log.
If an expiration date was set for a finding, its state is automatically reverted from Accepted Risk back to Not Fixed once that date is reached, ensuring it is re-evaluated in future scans.