---
title: "Get Finding Routing Rule"
method: GET
path: "/api/v1/findings/routing-rules/{id}"
tags: ["Finding Routing Rules"]
---

# Get Finding Routing Rule

`GET /api/v1/findings/routing-rules/{id}`

Retrieve a single finding routing rule by ID.

## Path parameters

- `id` string, required — The ID of the finding routing rule to retrieve.

## Response `200`

Successful response

- C1ApiFindingV1GetFindingRoutingRuleResponse — The GetFindingRoutingRuleResponse message.
  - `routingRule` C1ApiFindingV1FindingRoutingRule — The FindingRoutingRule message.
    - `action` C1ApiFindingV1FindingRoutingRuleAction — The FindingRoutingRuleAction message. This message contains a oneof named action. Only a single field of the following list may be set at a time: - createTask - suppress - snooze - acceptRisk
      - `acceptRisk` C1ApiFindingV1AcceptRiskRoutingAction — AcceptRiskRoutingAction accepts the risk for a matched finding for a relative duration (resolved to risk_acceptance_expires_at = now + duration at execution time).
        - `duration` string, duration, nullable
        - `reason` string — The reason field.
      - `createTask` C1ApiFindingV1CreateTaskAction — The CreateTaskAction message.
        - `policyId` string — The policyId field.
      - `snooze` C1ApiFindingV1SnoozeRoutingAction — SnoozeRoutingAction snoozes a matched finding for a relative duration (resolved to snooze_until = now + duration at execution time).
        - `duration` string, duration, nullable
        - `reason` string — The reason field.
      - `suppress` C1ApiFindingV1SuppressRoutingAction — The SuppressRoutingAction message.
        - `reason` string — The reason field.
    - `appId` string — The appId field.
    - `condition` string — The condition field.
    - `createdAt` string, date-time, nullable
    - `description` string — The description field.
    - `dispatchers` C1ApiFindingV1FindingDispatcher[], nullable — Dispatchers that fire when the rule matches ("Then dispatch"). Max 10.
      - `displayName` string — Human-facing label. Optional.
      - `enabled` boolean — Per-dispatcher kill switch.
      - `invokeFunction` C1ApiFindingV1InvokeFunctionDispatcher — InvokeFunctionDispatcher runs a published C1 function by id.
        - `args` object — Arguments passed to the function, keyed by arg name (v0: verbatim values; CEL evaluation is a later phase).
        - `functionCommitId` string — Optional pinned function commit; empty floats to the published commit.
        - `functionId` string — ID of the published function to invoke.
      - `key` string — Stable id within the rule; survives edits, part of the dispatch idempotency key. Minted server-side when empty.
      - `notify` C1ApiFindingV1NotifyDispatcher — NotifyDispatcher emits a notifications_v2 notification about the matched finding. Exactly one of audience / slack_channel is set: audience notifies people (each on whichever channels they enabled in their own notification settings), slack_channel posts to one channel.
        - `audience` C1ApiFindingV1FindingAudience — FindingAudience resolves to a set of identity user IDs to notify. Step-less: notifications have no escalation ladder. An empty resolution falls back to enabled system owners rather than notifying nobody. This message contains a oneof named typ. Only a single field of the following list may be set at a time: - users
          - `users` C1ApiFindingV1FindingAudienceUsers — The FindingAudienceUsers message.
            - `userIds` string[], nullable — The userIds field.
        - `batchWindowSeconds` integer — Wait-group window in seconds; 0 sends immediately. A quiet-period length, not a fixed delay — the batcher slides it forward on each arrival.
        - `detailLevel` 'FINDING_NOTIFY_DETAIL_LEVEL_UNSPECIFIED' | 'FINDING_NOTIFY_DETAIL_LEVEL_SUMMARY' | 'FINDING_NOTIFY_DETAIL_LEVEL_FULL_DETAIL' — How much the notification reveals. Defaults to SUMMARY.
        - `slackChannel` C1ApiFindingV1SlackChannelTarget — SlackChannelTarget names one Slack channel. Exactly one of channel_name / channel_id is set; a name is resolved at send time, so an unresolvable name fails the dispatch rather than the rule edit.
          - `channelId` string — The channelId field.
          - `channelName` string — The channelName field.
      - `notifyOnOutcome` C1ApiFindingV1FindingDispatchOutcomeNotify — FindingDispatchOutcomeNotify notifies recipients once a dispatch settles.
        - `onDone` boolean — The onDone field.
        - `onError` boolean — The onError field.
        - `recipients` string[], nullable — The recipients field.
      - `tierOverride` 'FINDING_DISPATCH_TIER_UNSPECIFIED' | 'FINDING_DISPATCH_TIER_AUTO' | 'FINDING_DISPATCH_TIER_REQUIRES_APPROVAL' — Author tier override; may only tighten the derived tier.
      - `triggerAutomation` C1ApiFindingV1TriggerAutomationDispatcher — TriggerAutomationDispatcher runs a C1 automation by id (the "Run now" path).
        - `automationId` string — ID of the C1 automation/workflow to run.
        - `inputMapping` object — Inputs passed to the automation, keyed by input name (v0: verbatim values; CEL evaluation is a later phase).
      - `webhook` C1ApiFindingV1WebhookDispatcher — WebhookDispatcher POSTs to a registered webhook (webhooks v3).
        - `payloadTemplate` string — Optional payload template; empty uses the default finding payload.
        - `webhookId` string — ID of a registered webhook to POST to.
    - `displayName` string — The displayName field.
    - `enabled` boolean — The enabled field.
    - `findingType` 'FINDING_TYPE_UNSPECIFIED' | 'FINDING_TYPE_SIMILAR_USERNAME_MATCH' | 'FINDING_TYPE_SERVICE_ACCOUNT_MISCLASSIFICATION' | 'FINDING_TYPE_NHI_UNOWNED' | 'FINDING_TYPE_SERVICE_ACCOUNT_UNOWNED' | 'FINDING_TYPE_DECOY_CREDENTIAL_USED' | 'FINDING_TYPE_CUSTOM' | 'FINDING_TYPE_CONNECTOR_ANOMALY_DETECTION_DISABLED' | 'FINDING_TYPE_DEACTIVATED_OWNER' | 'FINDING_TYPE_UNUSED_SECRET' | 'FINDING_TYPE_CREDENTIAL_PUBLICLY_EXPOSED' | 'FINDING_TYPE_DECOY_PUBLICLY_EXPOSED' | 'FINDING_TYPE_CREDENTIAL_EXPIRING' — The findingType field.
    - `id` string — The id field.
    - `priority` integer — The priority field.
    - `templateId` string — The templateId field.
    - `updatedAt` string, date-time, nullable

---

[API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)