---
title: "List security findings"
method: GET
path: "/api/v2/security/findings"
tags: ["Security Monitoring"]
---

# List security findings

`GET /api/v2/security/findings`

Get a list of security findings that match a search query. [See the schema for security findings](https://docs.datadoghq.com/security/guide/findings-schema/).

### Query Syntax

This endpoint uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.

Example: `@severity:(critical OR high) @status:open team:platform`

## Query parameters

- `filter[query]` string
- `page[cursor]` string
- `page[limit]` integer
- `sort` '@detection_changed_at' | '-@detection_changed_at' — The sort parameters when querying security findings.

## Response `200`

OK

- ListSecurityFindingsResponse — The expected response schema when listing security findings.
  - `data` SecurityFindingsData[] — Array of security findings matching the search query.
    - `attributes` SecurityFindingsAttributes — The JSON object containing all attributes of the security finding.
      - `attributes` object — The custom attributes of the security finding.
      - `tags` string[] — List of tags associated with the security finding.
      - `timestamp` integer — The Unix timestamp at which the detection changed for the resource. Same value as @detection_changed_at.
    - `id` string — The unique ID of the security finding.
    - `type` 'finding' — The type of the security finding resource.
  - `links` SecurityFindingsLinks — Links for pagination.
    - `next` string — Link for the next page of results. Note that paginated requests can also be made using the POST endpoint.
  - `meta` SecurityFindingsMeta — Metadata about the response.
    - `elapsed` integer — The time elapsed in milliseconds.
    - `page` SecurityFindingsPage — Pagination information.
      - `after` string — The cursor used to get the next page of results.
    - `request_id` string — The identifier of the request.
    - `status` 'done' | 'timeout' — The status of the response.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)