Sign in
latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-216381,9552.9 MB

f2cf3228f366

Findings

Search

Search findings using full-text query and filters for severity, state, type, and app. Each Finding row is large (risk factors, evidence, target, tags) — request a small page_size (≤10) to keep responses small.

post/api/v1/findings/search

Request body

appIdsstring[] nullable

Filter by app IDs (OR within field).

appResourceIdsstring[] nullable

Filter by app resource IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_id is in this list. An app resource is app-scoped, so pair with app_ids (and app_resource_type_ids) to hit the composite (tenant_id, app_id, app_resource_type_id, app_resource_id) index.

appResourceTraitIdsstring[] nullable

Filter to findings whose target resource's type carries any of these traits (e.g. the builtin agent / secret trait ids). OR within field; empty = not applied.

appResourceTypeIdsstring[] nullable

Filter by app resource type IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_type_id is in this list.

appUserIdsstring[] nullable

Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list.

appUserTypesstring[] nullable

Filter to findings whose target is an app user of these types (OR within field). Empty = not applied.

connectorIdsstring[] nullable

Filter by connector IDs (OR within field). Matches findings whose target.connector_target.connector_id is in this list.

customSubTypesstring[] nullable

Filter by custom sub-type (OR within field). Matches custom findings whose custom_sub_type equals any listed value.

decoyIdsstring[] nullable

Filter by decoy IDs (OR within field). Matches findings whose target.decoy_target.decoy_id is in this list.

findingTypesstring[] nullable

Filter by finding type (OR within field).

includeUnassignedboolean

When true, includes findings with no effective identity-user owner. An explicit predicate for direct API callers who prefer a bool over the "unassigned" sentinel in owner_identity_user_ids; both signals are accepted.

nhiTypesstring[] nullable

Filter to findings whose target resource's nhi_type is one of these (OR within field). Empty = not applied; pass all NhiType values to match any nhi resource.

ownerIdentityUserIdsstring[] nullable

Filter by effective owner identity-user IDs (OR within field). Matches findings whose effective owner (assigned_owner if set, else computed_owner) resolves to an identity user in this list. The reserved "unassigned" sentinel token selects findings with no effective identity-user owner; real identity-user IDs are exactly 27 alphanumerics so the token cannot collide.

pageSizeinteger

Maximum number of findings to return per page.

pageTokenstring

Pagination token from a previous response.

querystring

Free text search query.

scopeToAppOwnerboolean

When true, restricts results to findings for apps you own. The caller is resolved from request credentials (no user id is read from the request), so results are always limited to your own apps.

severitiesstring[] nullable

Filter by severities (OR within field).

sourceKindsstring[] nullable

Filter by source kind (OR within field).

statesstring[] nullable

Filter by states (OR within field).

Response

Successful response

nextPageTokenstring

The nextPageToken field.