---
title: "GET /audit/findings/{findingId}"
method: GET
path: "/audit/findings/{findingId}"
---

# GET /audit/findings/{findingId}

`GET /audit/findings/{findingId}`

Gets information about a single audit finding. Properties include the reason for noncompliance, the severity of the issue, and the start time when the audit that returned the finding.

Requires permission to access the [DescribeAuditFinding](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions) action.

## Path parameters

- `findingId` string, required

## Response `200`

Success

- DescribeAuditFindingResponse
  - `finding` AuditFinding — The findings (results) of the audit.
    - `findingId` string — A unique identifier for this set of audit findings. This identifier is used to apply mitigation tasks to one or more sets of findings.
    - `taskId` string — The ID of the audit that generated this result (finding).
    - `checkName` string — The audit check that generated this result.
    - `taskStartTime` string, date-time — The time the audit started.
    - `findingTime` string, date-time — The time the result (finding) was discovered.
    - `severity` 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' — The severity of the result (finding).
    - `nonCompliantResource` object — The resource that was found to be noncompliant with the audit check.
      - `resourceType` 'DEVICE_CERTIFICATE' | 'CA_CERTIFICATE' | 'IOT_POLICY' | 'COGNITO_IDENTITY_POOL' | 'CLIENT_ID' | 'ACCOUNT_SETTINGS' | 'ROLE_ALIAS' | 'IAM_ROLE' | 'ISSUER_CERTIFICATE' — The type of the noncompliant resource.
      - `resourceIdentifier` object — Information that identifies the noncompliant resource.
        - `deviceCertificateId` string — The ID of the certificate attached to the resource.
        - `caCertificateId` string — The ID of the CA certificate used to authorize the certificate.
        - `cognitoIdentityPoolId` string — The ID of the Amazon Cognito identity pool.
        - `clientId` string — The client ID.
        - `policyVersionIdentifier` object — The version of the policy associated with the resource.
          - `policyName` string — The name of the policy.
          - `policyVersionId` string — The ID of the version of the policy associated with the resource.
        - `account` string — The account with which the resource is associated.
        - `iamRoleArn` string — The ARN of the IAM role that has overly permissive actions.
        - `roleAliasArn` string — The ARN of the role alias that has overly permissive actions.
        - `issuerCertificateIdentifier` object — The issuer certificate identifier.
          - `issuerCertificateSubject` string — The subject of the issuer certificate.
          - `issuerId` string — The issuer ID.
          - `issuerCertificateSerialNumber` string — The issuer certificate serial number.
        - `deviceCertificateArn` string — The ARN of the identified device certificate.
      - `additionalInfo` object — Other information about the noncompliant resource.
    - `relatedResources` RelatedResource[] — The list of related resources.
      - `resourceType` 'DEVICE_CERTIFICATE' | 'CA_CERTIFICATE' | 'IOT_POLICY' | 'COGNITO_IDENTITY_POOL' | 'CLIENT_ID' | 'ACCOUNT_SETTINGS' | 'ROLE_ALIAS' | 'IAM_ROLE' | 'ISSUER_CERTIFICATE' — The type of resource.
      - `resourceIdentifier` object — Information that identifies the resource.
        - `deviceCertificateId` string — The ID of the certificate attached to the resource.
        - `caCertificateId` string — The ID of the CA certificate used to authorize the certificate.
        - `cognitoIdentityPoolId` string — The ID of the Amazon Cognito identity pool.
        - `clientId` string — The client ID.
        - `policyVersionIdentifier` object — The version of the policy associated with the resource.
          - `policyName` string — The name of the policy.
          - `policyVersionId` string — The ID of the version of the policy associated with the resource.
        - `account` string — The account with which the resource is associated.
        - `iamRoleArn` string — The ARN of the IAM role that has overly permissive actions.
        - `roleAliasArn` string — The ARN of the role alias that has overly permissive actions.
        - `issuerCertificateIdentifier` object — The issuer certificate identifier.
          - `issuerCertificateSubject` string — The subject of the issuer certificate.
          - `issuerId` string — The issuer ID.
          - `issuerCertificateSerialNumber` string — The issuer certificate serial number.
        - `deviceCertificateArn` string — The ARN of the identified device certificate.
      - `additionalInfo` object — Other information about the resource.
    - `reasonForNonCompliance` string — The reason the resource was noncompliant.
    - `reasonForNonComplianceCode` string — A code that indicates the reason that the resource was noncompliant.
    - `isSuppressed` boolean — Indicates whether the audit finding was suppressed or not during reporting.

## Other responses

- `480` — ResourceNotFoundException
- `481` — InvalidRequestException
- `482` — ThrottlingException
- `483` — InternalFailureException

---

[API](https://skmtc.net/aws/apis/iot.md) · [All operations](https://skmtc.net/aws/apis/iot/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/iot/revisions/deef5c4b09f0/schema)