# **Problem** Enabling auto-resolve flows (SAST Vulnerability Resolution, SAST FP Detection, Dependency Scanning auto-remediation, Vulnerability Context/Enrichment) today requires per-project, per-flow setup. There's no way for a customer to turn these on consistently, at scale, across a group or a set of projects in one action. Per Michael's sync with the Security Insights Group: the primary ask is group-level enablement, on/off only, consistent at scale, first; configuration parameters (CWE, severity thresholds, etc.) can come in a later iteration for the UI, though the API itself is not restricted this way. ## **Goal** Ship the API that lets a customer enable, disable, and fully configure each auto-resolve flow, whether that's a simple on/off toggle or detailed parameter-level configuration. The API is not limited to enablement: a customer integrating directly against it can customize immediately. It's the companion UI epic that's limited to enablement only, not this one. ## **Scope** * Enable/disable and parameter-level configuration API for each flow, at group or project level: * SAST Vulnerability Resolution (#21944): severity, CWE class, auto-run vs. manual, Vulnerability Context Metadata (#21760) * SAST FP Detection (`#582100`): severity, CWE class, auto-run vs. manual * Dependency Scanning auto-remediation (#21462): severity, fix type (major/minor/patch), MR count cap, auto-run vs. manual, Vulnerability Context Metadata (#21760) * Vulnerability Context/Enrichment agent (#20894): severity, auto-run vs. manual * Secret Detection FP analysis: on/off only, no additional parameters exist for this flow * Two preset buckets: Standard (recommended default) and Aggressive (maximum coverage), available as a shortcut for API and UI consumers alike, on top of the full parameter-level configuration. * Enablement and configuration work at group level and across multiple projects in a single call. * Configuration surface: apply at the project level (project security configuration page) or group level; support selecting tracked branches (or all tracked branches); support selecting projects by security attribute. * Build order (agreed with the Security Insights Group): API-first, sequenced FP, then VE, then VR. UI follows in the same order. ## **Out of scope** * Trigger selection (pipeline execution, MR creation, cron) and orchestration/policy logic: tracked in Auto-Resolve Configuration Profiles - Orchestration Run. * Secret Detection auto-remediation: explicitly not on the roadmap. * Any UI for parameter-level configuration: the enablement UI epic exposes only the two preset buckets; the per-scanner Customization epics build the parameter UI on top of this API. **Related work items:** #21944, `#582100`, #21462, #20894, #21760