Merge Duplicate Candidate — POST /api/v1/projects/{project_id}/duplicate-candidates/{candidate_id}/merge

Merge Duplicate Candidate

NON-DESTRUCTIVE merge: status → merged + optional soft-deprecate of the losing case. Never deletes a case or redirects a fingerprint.

Endpoint: POST /api/v1/projects/{project_id}/duplicate-candidates/{candidate_id}/merge

Authentication: Send a signed-in user’s access token in Authorization: Bearer <access token>, or an API key in X-API-Key: <API key>.

• Your role must be QA engineer or higher.
• You must be a member of the project. Admins always have access.

Parameters

Name	In	Required	Type	Default	Description
project_id	path	yes	string (uuid)
candidate_id	path	yes	string (uuid)
X-API-Key	header	no	string or null		API key, as an alternative to the access token (see Authentication).

Request body

Content type	Body	Required
application/json	DuplicateMergeRequest	yes

Responses

Status	Meaning	Body
200	Successful Response	DuplicateActionResponse (application/json)
422	Validation Error	HTTPValidationError (application/json)

Errors this endpoint returns, read from its source code:

• 400, with the message “candidate_id in body does not match the path”
• 403, with the message “Deprecating a duplicate merge loser requires QA_LEAD or ADMIN”
• 404

It can also return 401 if your credential is missing or expired, 403 if your credential does not allow this request, and 404 if the item does not exist or you cannot see it. Your role, your project membership and the key’s scope decide what a credential allows. See Errors and retries.

More details

• Group: Duplicate Detection
• Operation ID: merge_duplicate_candidate_api_v1_projects__project_id__duplicate_candidates__candidate_id__merge_post
• Source code: backend/app/routers/duplicates.py, line 254
• Specification: OpenAPI JSON