---
title: "Get Finding Transformation Rule"
method: GET
path: "/api/v1/findings/transformation-rules/{id}"
tags: ["Finding Transformation Rules"]
---

# Get Finding Transformation Rule

`GET /api/v1/findings/transformation-rules/{id}`

Retrieve a single finding transformation rule by ID.

## Path parameters

- `id` string, required — The ID of the finding transformation rule to retrieve.

## Response `200`

Successful response

- C1ApiFindingV1GetFindingTransformationRuleResponse — The GetFindingTransformationRuleResponse message.
  - `transformationRule` C1ApiFindingV1FindingTransformationRule — FindingTransformationRule transforms a finding at processing time, before routing runs. Rules fall through: every matching rule applies its transforms in ascending evaluation_order; the last rule to write a given field wins.
    - `appId` string — The appId field.
    - `condition` string — CEL boolean over the Finding object; empty matches all. Evaluated over base/immutable inputs only (see the transformation env).
    - `createdAt` string, date-time, nullable
    - `description` string — The description field.
    - `displayName` string — The displayName field.
    - `enabled` boolean — The enabled field.
    - `evaluationOrder` integer — Application order (ascending; last-applied rule wins per field). A sequence, not a precedence rank.
    - `findingType` 'FINDING_TYPE_UNSPECIFIED' | 'FINDING_TYPE_SIMILAR_USERNAME_MATCH' | 'FINDING_TYPE_SERVICE_ACCOUNT_MISCLASSIFICATION' | 'FINDING_TYPE_NHI_UNOWNED' | 'FINDING_TYPE_SERVICE_ACCOUNT_UNOWNED' | 'FINDING_TYPE_DECOY_CREDENTIAL_USED' | 'FINDING_TYPE_CUSTOM' | 'FINDING_TYPE_CONNECTOR_ANOMALY_DETECTION_DISABLED' | 'FINDING_TYPE_DEACTIVATED_OWNER' | 'FINDING_TYPE_UNUSED_SECRET' | 'FINDING_TYPE_CREDENTIAL_PUBLICLY_EXPOSED' | 'FINDING_TYPE_DECOY_PUBLICLY_EXPOSED' | 'FINDING_TYPE_CREDENTIAL_EXPIRING' — The findingType field.
    - `id` string — The id field.
    - `templateId` string — The templateId field.
    - `transforms` C1ApiFindingV1FindingTransform[], nullable — Ordered transforms applied when the rule matches.
      - `removeTags` C1ApiFindingV1RemoveTags — The RemoveTags message.
        - `keys` string[], nullable — The keys field.
      - `setSeverity` C1ApiFindingV1SetSeverity — The SetSeverity message.
        - `severity` 'FINDING_SEVERITY_UNSPECIFIED' | 'FINDING_SEVERITY_INFO' | 'FINDING_SEVERITY_LOW' | 'FINDING_SEVERITY_MEDIUM' | 'FINDING_SEVERITY_HIGH' | 'FINDING_SEVERITY_CRITICAL' — The severity field.
      - `setTags` C1ApiFindingV1SetTags — The SetTags message.
        - `tags` object — The tags field.
    - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)