Using API to set vulnerability analysisState

[pakagi]

Hello,
I'm trying to use API to set state of vulnerability. Have a working api key etc, sending PUT request to /api/v1/analysis (port 8081), using also ""Content-Type: application/json" - but still getting java errors when trying various payload.

Please, is there any documentation how is the payload exactly expected to look ? On the doc "REST API" page, I see almost nothing :-(

I'm trying e.g. payload like:

{ "component": "23778a6f-13a9-4c90-a612-0600ccd60437", "vulnerability": "ca8cab61-5122-4a9d-ad7b-6c4d6e519ec9", "analysisState": "IN_TRIAGE" }

but get "Uncaught internal server error", and container log shows:

java.lang.NullPointerException

The dependencytrack version is 4.14.0.

[nscuro]

Ah, a NPE should definitely not happen!

Can you please share the logs around / after the java.lang.NullPointerException? Those should point us to where the issue is.

is there any documentation how is the payload exactly expected to look ?

We expose an OpenAPI specification at /api/openapi.yaml.

[pakagi]

There is just this in the docker logs of the apiserver container:

2026-03-17 11:25:03,094 ERROR [GlobalExceptionHandler] Uncaught internal server error [principal=odt_JOD2cSIU********************************, requestUri=/v1/analysis, requestId=8d1e7c9c-e2a8-4313-a108-daf820f219e8, requestMethod=PUT]
java.lang.NullPointerException

We expose an OpenAPI specification at /api/openapi.yaml

Thx, will check.

[pakagi]

I tried to blindly reboot the whole server where DT is running, and now on repeated attempt it gave longer error:

2026-03-17 11:38:47,186 ERROR [GlobalExceptionHandler] Uncaught internal server error [principal=odt_JOD2cSIU********************************, requestUri=/v1/analysis, requestId=9ea12a11-80b1-42b3-b507-ec17f6a68470, requestMethod=PUT]
java.lang.NullPointerException: Cannot invoke "String.length()" because "<parameter1>" is null
	at java.base/java.util.UUID.fromString(Unknown Source)
	at alpine.persistence.AbstractAlpineQueryManager.getObjectByUuid(AbstractAlpineQueryManager.java:467)
	at org.dependencytrack.resources.v1.AnalysisResource.updateAnalysis(AnalysisResource.java:160)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52)
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:146)
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:189)
	at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:176)
	at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:93)
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:470)
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:394)
	at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:80)
	at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:274)
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
	at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
	at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
	at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266)
	at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253)
	at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:703)
	at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:422)
	at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:374)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:355)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:309)
	at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:202)
	at org.eclipse.jetty.ee11.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1393)
	at org.eclipse.jetty.ee11.servlet.ServletHolder.handle(ServletHolder.java:750)
	at org.eclipse.jetty.ee11.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1668)
	at alpine.server.filters.ContentSecurityPolicyFilter.doFilter(ContentSecurityPolicyFilter.java:225)
	at org.eclipse.jetty.ee11.servlet.FilterHolder.doFilter(FilterHolder.java:205)
	at org.eclipse.jetty.ee11.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
	at alpine.server.filters.ClickjackingFilter.doFilter(ClickjackingFilter.java:93)
	at org.eclipse.jetty.ee11.servlet.FilterHolder.doFilter(FilterHolder.java:205)
	at org.eclipse.jetty.ee11.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
	at alpine.server.filters.WhitelistUrlFilter.doFilter(WhitelistUrlFilter.java:166)
	at org.eclipse.jetty.ee11.servlet.FilterHolder.doFilter(FilterHolder.java:208)
	at org.eclipse.jetty.ee11.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
	at org.eclipse.jetty.ee11.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1602)
	at org.eclipse.jetty.ee11.servlet.ServletChannel.dispatch(ServletChannel.java:868)
	at org.eclipse.jetty.ee11.servlet.ServletChannel.handle(ServletChannel.java:449)
	at org.eclipse.jetty.ee11.servlet.ServletHandler.handle(ServletHandler.java:470)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:546)
	at org.eclipse.jetty.ee11.servlet.SessionHandler.handle(SessionHandler.java:763)
	at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1224)
	at org.eclipse.jetty.server.Server.handle(Server.java:197)
	at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:787)
	at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:420)
	at org.eclipse.jetty.server.internal.HttpConnection$FillableCallback.succeeded(HttpConnection.java:1809)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
	at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:54)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:492)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.epcRunTask(AdaptiveExecutionStrategy.java:428)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:401)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:255)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:204)
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:317)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:1009)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1239)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1194)
	at java.base/java.lang.Thread.run(Unknown Source)

[nscuro]

I see. You need to provide the UUID of the project as well, via the project field.

[pakagi]

That helped, thanks a lot :-)