Sign in
latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-216381,9552.9 MB

f2cf3228f366

Findings

Search

Search returns audit events filtered by finding, actor, type, or app. Authorized as VIEWER -- the same role required to read the finding itself.

post/api/v1/search/finding_audits

Request body

actorPrincipalIdstring

The actorPrincipalId field.

actorSubjectstring

Partial match via full-text search over the denormalized actor email / display name column.

appIdstring

Empty skips the filter; non-empty must be a 27-char alphanumeric id.

eventTypesstring[] nullable

Filter by one or more event types. Empty means any.

findingIdstring

Filter to a single finding. The detail-page timeline uses this. Empty skips the filter; non-empty must be a 27-char alphanumeric id.

pageSizeinteger

The pageSize field.

pageTokenstring

The pageToken field.

sincestring date-time nullable
untilstring date-time nullable

Response

Successful response

nextPageTokenstring

The nextPageToken field.