Defects API

The Defects API lets you list, read, create and update defects in a Qualflare project over REST at https://api.qualflare.com/api/v1/defects, authenticated with a project access token.

The four endpoints, each with its own section below:

List defects

List defects returns one page of the project's defects, newest first unless you sort them.

GET /api/v1/defects

Needs a project access token whose creator has the Viewer role or higher in the project.

curl -sS -g "https://api.qualflare.com/api/v1/defects?severity[]=critical&status[]=active" \
  -H "Authorization: Bearer $QF_TOKEN"

Returns 200: A page of defects: items and paging, 14 defects per page.

• The filter names end in [] and can repeat: severity[]=high&severity[]=critical. The curl example passes -g so curl sends the brackets as they are.
• category[] takes the categories Qualflare gives defects, and environment[] an environment identifier.

Get a defect

Get a defect returns one defect by its number, and for a defect from a failure cluster, that cluster's label, status and severity.

GET /api/v1/defect/{seq}

Needs a project access token whose creator has the Viewer role or higher in the project.

curl -sS "https://api.qualflare.com/api/v1/defect/7" \
  -H "Authorization: Bearer $QF_TOKEN"

Returns 200: The defect.

{
  "seq": 7,
  "name": "Checkout total ignores the coupon",
  "severity": "high",
  "status": "active",
  "category": "unknown",
  "rootCauses": [],
  "automation": "manual",
  "isClosed": false,
  "description": "The order total stays at the full price after a valid coupon is applied.",
  "expected": "The total drops by 10%.",
  "actual": "The total is unchanged.",
  "teamSeq": 2,
  "teamName": "Payments",
  "environmentId": 3,
  "environmentName": "Staging",
  "clusterId": null,
  "clusterLabel": null,
  "clusterStatus": null,
  "clusterSeverity": null,
  "closedAt": null,
  "reopenedAt": null,
  "reopenedReason": null,
  "createdAt": "2026-10-28T09:30:05Z",
  "updatedAt": "2026-10-28T10:02:44Z"
}

• A number that isn't a defect of the project answers 404 with defect not found.

Create a defect

Create a defect files a new defect in the project.

POST /api/v1/defects

Needs a project access token created with Allow writes, whose creator has the Editor role or higher in the project.

curl -sS -X POST "https://api.qualflare.com/api/v1/defects" \
  -H "Authorization: Bearer $QF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Checkout total ignores the coupon", "severity": "high", "environmentUid": "staging"}'

Returns 201: The new defect.

• name and severity are required. name holds up to 128 characters (the API accepts 255, but longer text fails to save). environmentUid is an environment identifier; description, expected and actual take up to 10,000 characters each.
• A new defect starts active, in the unknown category.
• An environmentUid that isn't an environment of the project answers 400 with environment not found, here and in Update a defect.

Update a defect

Update a defect changes the fields you send and returns the defect.

PUT /api/v1/defect/{seq}

Needs a project access token created with Allow writes, whose creator has the Editor role or higher in the project.

curl -sS -X PUT "https://api.qualflare.com/api/v1/defect/7" \
  -H "Authorization: Bearer $QF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status": "closed"}'

Returns 200: The updated defect.

• status takes active, action_required, false_positive or closed; reopened can't be sent. A reopened defect goes back to active.
• A number that isn't a defect of the project answers 404 with defect not found.

Defect fields

Every defect the Defects API returns has these fields:

CLI and MCP equivalents

The qf CLI and the MCP server run the same reads, and the MCP server the same writes, so they return the same JSON:

Related

• Guides: Defects
• Reference: Failure clusters API
• CLI/API: Qualflare API