# Link a defect to testing entities

> Decrypted Request Payload: Provide at least one of testcaseid, teststepid, or taskid.

> For the complete documentation index, see [llms.txt](https://helpdesk.orangescrum.com/llms.txt).

Source: https://helpdesk.orangescrum.com/guide/api/endpoints/defects/defects-link

---
`POST /api/v1/partner/defects/link`

## Authorizations

- `X-API-KEY` *string* (required) — Developer API key (starts with pk_)

- `X-TIMESTAMP` *integer* (required) — Unix timestamp in seconds (within ±5 minutes of server time)

- `X-NONCE` *string* (required) — One-time random string (min 8 chars, prevents replay)

- `X-SIGNATURE` *string* (required) — HMAC-SHA256 signature of canonical string (hex-encoded)

## Headers

- `Accept` *string* (required) — Content type of response

- `Content-Type` *string* (required) — Content type of request

## Request body

Encrypted request data (AES-256-CBC). The decrypted payload fields are described above.

- `encrypted_data` *string* (required) — Base64-encoded encrypted JSON data. Encryption: AES-256-CBC with 16-byte IV prepended. Key: SHA256 hash of secret key.

## Responses

- **200** — Link a defect to testing entities — success

- **400** — Bad request — validation failed or invalid reference

- **401** — Unauthorized — invalid or missing API key

- **404** — Resource not found

- **500** — Server error
## Request samples

### cURL

```bash
curl -X POST 'https://v4-api.orangescrum.com/api/v1/partner/defects/link' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'X-API-KEY: pk_your_api_key' \
  -H 'X-TIMESTAMP: '"$(date +%s)" \
  -H 'X-NONCE: '"$(openssl rand -hex 8)" \
  -H 'X-SIGNATURE: <hmac-sha256>' \
  -d '{"encrypted_data":"<base64-aes-256-cbc-payload>"}'
```

### Python

```python
# call() is defined on the Authentication page.
from orangescrum import call

response = call(
    "/api/v1/partner/defects/link",
    { "defect_id": ..., "test_case_id": ..., "test_step_id": ..., "task_id": ... },
)
print(response)
```

### JavaScript

```javascript
// call() is defined on the Authentication page.
import { call } from './orangescrum.js';

const response = await call('/api/v1/partner/defects/link', { "defect_id": ..., "test_case_id": ..., "test_step_id": ..., "task_id": ... });
console.log(response);
```

### PHP

```php
<?php
// call() is defined on the Authentication page.
require 'orangescrum.php';

$response = call('/api/v1/partner/defects/link', json_decode('{ "defect_id": ..., "test_case_id": ..., "test_step_id": ..., "task_id": ... }', true));
print_r($response);
```