---
title: "POST /ListFindings"
method: POST
path: "/ListFindings"
---

# POST /ListFindings

`POST /ListFindings`

Lists the security findings for a pentest job.

## Request body

- object
  - `maxResults` integer — Maximum results for pagination.
  - `pentestJobId` string — The unique identifier of the pentest job to list findings for.
  - `codeReviewJobId` string — The unique identifier of the code review job to list findings for. Mutually exclusive with pentestJobId.
  - `agentSpaceId` string, required — The unique identifier of the agent space.
  - `nextToken` string — Pagination token.
  - `riskType` string — Filter findings by risk type.
  - `riskLevel` 'UNKNOWN' | 'INFORMATIONAL' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' — Risk severity level.
  - `status` 'ACTIVE' | 'RESOLVED' | 'ACCEPTED' | 'FALSE_POSITIVE' — Finding status.
  - `confidence` 'FALSE_POSITIVE' | 'UNCONFIRMED' | 'LOW' | 'MEDIUM' | 'HIGH' — Finding confidence level.
  - `name` string — Filter findings by name.

## Response `200`

Success

- ListFindingsOutput — Output for the ListFindings operation.
  - `findingsSummaries` FindingSummary[] — The list of finding summaries.
    - `findingId` string, required — The unique identifier of the finding.
    - `agentSpaceId` string, required — The unique identifier of the agent space associated with the finding.
    - `pentestId` string — The unique identifier of the pentest associated with the finding.
    - `pentestJobId` string — The unique identifier of the pentest job that produced the finding.
    - `codeReviewId` string — The unique identifier of the code review associated with the finding.
    - `codeReviewJobId` string — The unique identifier of the code review job that produced the finding.
    - `name` string — The name of the finding.
    - `status` 'ACTIVE' | 'RESOLVED' | 'ACCEPTED' | 'FALSE_POSITIVE' — The current status of the finding.
    - `riskType` string — The type of security risk identified by the finding.
    - `riskLevel` 'UNKNOWN' | 'INFORMATIONAL' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL' — The risk level of the finding.
    - `confidence` 'FALSE_POSITIVE' | 'UNCONFIRMED' | 'LOW' | 'MEDIUM' | 'HIGH' — The confidence level of the finding.
    - `validationStatus` 'CONFIRMED' | 'NOT_REPRODUCED' | 'VALIDATION_FAILED' | 'VALIDATING' | 'NOT_VALIDATED' — The simulated validation status of the finding.
    - `createdAt` string, date-time — The date and time the finding was created, in UTC format.
    - `updatedAt` string, date-time — The date and time the finding was last updated, in UTC format.
  - `nextToken` string — A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request. For subsequent calls, use the nextToken value returned from the previous request.

---

[API](https://skmtc.net/aws/apis/securityagent.md) · [All operations](https://skmtc.net/aws/apis/securityagent/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/securityagent/versions/cad56717d636/schema)