---
title: "List Code Scan Findings"
method: GET
path: "/v3/enterprise/code-scans/findings"
tags: ["code-scans"]
---

# List Code Scan Findings

`GET /v3/enterprise/code-scans/findings`

List code scan findings for the enterprise account.

Findings are returned newest first. Optionally filter by ``org_ids``,
``scan_id``, ``repo_name``, ``severity``, and ``status`` (``severity`` and
``status`` accept multiple values); results are paginated with an opaque
cursor (``after`` / ``first``).

## Query parameters

- `after` string, nullable
- `first` integer
- `scan_id` string, nullable — Filter to findings produced by this scan.
- `repo_name` string, nullable — Filter to findings reported in this repository.
- `severity` string[], nullable — Filter to findings with any of these severities (critical, high, medium, low).
- `status` string[], nullable — Filter to findings with any of these statuses (open, dismissed, resolved).
- `org_ids` string[], nullable — Filter to findings in these organizations.

## Response `200`

Successful Response

- PaginatedResponseCodeScanFindingResponse
  - `end_cursor` string, nullable — Cursor to fetch the next page, or None if this is the last page.
  - `has_next_page` boolean — Whether there are more items available after this page.
  - `items` CodeScanFindingResponse[], required
    - `category` string, nullable, required — Category (rule name) the finding was classified under, if any.
    - `code_owners` string[], required — Code owners associated with the affected code.
    - `created_at` integer, required — When the finding was created (unix seconds).
    - `description` string, nullable, required — Detailed description of the vulnerability, if any.
    - `finding_id` string, required — Unique identifier for the finding.
    - `note` string, nullable, required — Additional note attached to the finding, if any.
    - `orchestrator_session_id` string, nullable, required — Orchestrator session that ran the scan that produced the finding (the scan's Devin session), if any.
    - `pr_url` string, nullable, required — URL of the remediation PR opened for this finding, if any.
    - `recommendation` string, nullable, required — Suggested remediation for the finding, if any.
    - `reference_snippets` CodeScanReferenceSnippetResponse[], required — Code snippets referenced by the finding as supporting evidence.
      - `code` string, nullable — The referenced source code, if captured.
      - `commentary` string, required — Explanation of why this snippet is relevant to the finding.
      - `end_line` integer, required — Last line of the referenced range.
      - `file_path` string, required — Path to the referenced file.
      - `start_line` integer, required — First line of the referenced range.
    - `related_finding_ids` string[] — Finding IDs of the other links in a realized attack chain. Set only on the chain's sink finding.
    - `repo_name` string, required — Repository the finding was reported in.
    - `scan_id` string, required — Identifier of the scan that produced the finding.
    - `session_id` string, nullable, required — Session that remediated the finding (and opened the PR), if any.
    - `severity` 'critical' | 'high' | 'medium' | 'low', required — Severity of the finding: critical, high, medium, or low.
    - `status` 'open' | 'dismissed' | 'resolved', required — Finding status: open, dismissed, or resolved.
    - `title` string, nullable, required — Title of the finding, if any.
  - `total` integer, nullable — Optional total count (can be omitted for performance).

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `409` — Conflict
- `422` — Unprocessable Content
- `429` — Too Many Requests

---

[API](https://skmtc.net/devin/apis/devin-api-v1.md) · [All operations](https://skmtc.net/devin/apis/devin-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/devin/devin-api-v1/revisions/e3244476af1c/schema)