---
title: "List Issues"
method: POST
path: "/api/agent/deployments/{deploymentId}/issues"
tags: ["IssuesService"]
---

# List Issues

`POST /api/agent/deployments/{deploymentId}/issues`

List an organization's recent issues with filtering, sorting, and pagination

## Path parameters

- `deploymentId` string, required

## Request body

- ProtosIssuesV1ListIssuesRequest
  - `deploymentId` string — Specifies the deployment to which the issues belong.
  - `issueType` 'ISSUE_TYPE_SAST' | 'ISSUE_TYPE_SCA' | 'ISSUE_TYPE_SECRETS' | 'ISSUE_TYPE_RESEARCH' | 'ISSUE_TYPE_AI_SAST', enum — Deprecated: use issue_types instead. Filters issues to those with the specified type. | value | description | |-------|---------------| | ISSUE_TYPE_SAST | Detected by Code rules | | ISSUE_TYPE_SCA | Detected by Supply Chain rules | | ISSUE_TYPE_SECRETS | Detected by Secrets rules | | ISSUE_TYPE_RESEARCH | Detected by research rules or scanners | | ISSUE_TYPE_AI_SAST | Detected by AI detection code scanning |
  - `sortBy` 'SORT_BY_SEVERITY' | 'SORT_BY_REF' | 'SORT_BY_REPO' | 'SORT_BY_RULE' | 'SORT_BY_RELEVANT_SINCE' | 'SORT_BY_STATE', enum — Specifies the field to sort the results by. | value | description | |-------|---------------| | SORT_BY_SEVERITY | | | SORT_BY_REF | | | SORT_BY_REPO | | | SORT_BY_RULE | | | SORT_BY_RELEVANT_SINCE | | | SORT_BY_STATE | |
  - `sortDirection` 'SORT_DIRECTION_ASC' | 'SORT_DIRECTION_DESC', enum — Specifies the direction to sort the results. | value | description | |-------|---------------| | SORT_DIRECTION_ASC | | | SORT_DIRECTION_DESC | |
  - `limit` integer — Sets the page size of the paginated list of issues.
  - `cursor` string — Cursor used for pagination -- passing no value or an empty string effectively requests the first page.
  - `filter` ProtosIssuesV1IssuesFilter
    - `ids` string[] — Filters issues to those whose ids match any of the specified values. Applies to all issue types.
    - `since` string, date-time — Filters issues relevant since the specified timestamp. Applies to all issue types.
    - `until` string, date-time — Filters issues created before the specified timestamp. Applies to all issue types.
    - `repositoryNames` string[] — Filters issues which belong to a repo with one of the specified names. Applies to all issue types.
    - `repositoryIds` string[] — Filters issues which belong to a repo with one of the specified ids. Applies to all issue types.
    - `repositoryTags` string[] — Filters issues which belong to a repo with one of the specified tags. Applies to all issue types.
    - `refs` string[] — Filters issues which were found in a ref with one of the specified names. Applies to all issue types.
    - `repositoryRefIds` string[] — Filters issues which were found on the repo and ref associated with the repo ref id. Applies to all issue types.
    - `aiVerdicts` string[] — Filters issues whose autotriage verdict matches one of the specified values. Applies to all issue types. | value | description | |-------|---------------| | VERDICT_TRUE_POSITIVE | | | VERDICT_FALSE_POSITIVE | | | VERDICT_NO_VERDICT | |
    - `aiSensitivities` string[] — Filters issues whose autotriage tag matches one of the specified values. Applies to all issue types.
    - `status` string[] — Filters issues whose status matches one of the specified values. Applies to all issue types. Deprecated in favor of `aggregate_issue_states`, which is the forward-looking state filter. | value | description | |-------|---------------| | ISSUE_STATUS_FIXED | | | ISSUE_STATUS_MUTED | | | ISSUE_STATUS_REMOVED | | | ISSUE_STATUS_UNRESOLVED | |
    - `tab` 'ISSUE_TAB_OPEN' | 'ISSUE_TAB_IGNORED' | 'ISSUE_TAB_CLOSED' | 'ISSUE_TAB_REVIEWING' | 'ISSUE_TAB_FIXING' | 'ISSUE_TAB_PROVISIONALLY_IGNORED', enum — Filters issues whose general status (open, ignored, fixed) matches one of the specified values. Applies to all issue types. | value | description | |-------|---------------| | ISSUE_TAB_OPEN | | | ISSUE_TAB_IGNORED | | | ISSUE_TAB_CLOSED | | | ISSUE_TAB_REVIEWING | | | ISSUE_TAB_FIXING | | | ISSUE_TAB_PROVISIONALLY_IGNORED | |
    - `teamNames` string[] — Filter issues which belong to a repo assigned to one of the specified teams. Applies to all issue types.
    - `actions` string[] — Filters SAST issues whose action mode matches one of the specified values. Only applies when the provided issue_type is SAST. Deprecated: action mode is tied to the legacy policy model and has no effect for deployments on unified policies. This filter will be removed in a future release. | value | description | |-------|---------------| | MODE_MONITOR | Monitor mode, silently report findings | | MODE_COMMENT | Comment mode, leaves PR comments but does not block | | MODE_BLOCK | Block mode, leaves PR comments and blocks PR | | MODE_DISABLED | Disabled mode, not active |
    - `policySlugs` string[] — Filters SAST issues whose policy slug matches one of the specified values. Deprecated in favor of `action`. Only applies when the provided issue_type is SAST.
    - `rules` string[] — Filters SAST issues whose rule paths match one of the specified values. Only applies when the provided issue_type is SAST.
    - `ruleIds` string[] — Filters issues whose rule id matches one of the specified values. Applies to all issue types.
    - `rulesets` string[] — Filters SAST issues whose ruleset name matches one of the specified values. Only applies when the provided issue_type is SAST.
    - `categories` string[] — Filters SAST issues whose category matches one of the specified values. Only applies when the provided issue_type is SAST.
    - `confidences` string[] — Filters SAST issues whose confidence rating matches one of the specified values. Only applies when the provided issue_type is SAST. | value | description | |-------|---------------| | CONFIDENCE_HIGH | | | CONFIDENCE_MEDIUM | | | CONFIDENCE_LOW | |
    - `severities` string[] — Filters SAST issues whose severity matches one of the specified values. Only applies when the provided issue_type is SAST. | value | description | |-------|---------------| | SEVERITY_HIGH | | | SEVERITY_MEDIUM | | | SEVERITY_LOW | | | SEVERITY_CRITICAL | |
    - `transitivities` string[] — Filters supply chain issues whose transitivity matches one of the specified values. Only applies when the provided issue_type is SCA. | value | description | |-------|---------------| | UNKNOWN_TRANSITIVITY | | | TRANSITIVE | | | DIRECT | |
    - `exposures` string[] — Filters supply chain issues whose exposure (a.k.a. "reachability") matches one of the specified values. Only applies when the provided issue_type is SCA. | value | description | |-------|---------------| | UNKNOWN_EXPOSURE | | | UNREACHABLE | | | REACHABLE | |
    - `dependencies` string[] — Filters supply chain issues found in a dependency whose name matches any of the specified values. Only applies when the provided issue_type is SCA.
    - `cves` string[] — Filters supply chain issues belonging to a CVE whose name matches the specified value. Only applies when the provided issue_type is SCA.
    - `source` string[] — Filters issues whose source matches one of the specified values. Applies to SAST now, and maybe Secrets in the future. | value | description | |-------|---------------| | SOURCE_PRO | From Pro rules | | SOURCE_COMMUNITY | From Semgrep Community rules | | SOURCE_CUSTOM | From Custom rules |
    - `reachabilities` string[] — Filters supply chain issues whose reachability matches one of the specified values. Only applies when the provided issue_type is SCA. | value | description | |-------|---------------| | REACHABILITY_CONDITIONALLY_REACHABLE | | | REACHABILITY_ALWAYS_REACHABLE | | | REACHABILITY_REACHABLE | | | REACHABILITY_UNREACHABLE | | | REACHABILITY_UNKNOWN | |
    - `issueParentIds` string[] — Filters issues to those whose issue parent ids match any of the specified values. Applies to all types.
    - `validationStates` string[] — Filters secrets issues whose validation state matches one of the specified values. Only applies when the provided issue_type is SECRETS. | value | description | |-------|---------------| | VALIDATION_STATE_CONFIRMED_VALID | | | VALIDATION_STATE_CONFIRMED_INVALID | | | VALIDATION_STATE_VALIDATION_ERROR | | | VALIDATION_STATE_NO_VALIDATOR | |
    - `secretTypes` string[] — Filters secrets issues whose secret type matches one of the specified values. Only applies when the provided issue_type is SECRETS.
    - `repoVisibilities` string[] — Filters secrets issues whose status matches one of the specified values. Only applies when the provided issue_type is SECRETS. | value | description | |-------|---------------| | REPOSITORY_VISIBILITY_PUBLIC | | | REPOSITORY_VISIBILITY_PRIVATE | | | REPOSITORY_VISIBILITY_UNKNOWN | |
    - `excludeHistorical` boolean — Filters out historical secrets issues if true. Only applies when the provided issue_type is SECRETS.
    - `onPrimaryBranch` boolean — Filter down to only issues that are - or are not - found on the default branch of their project.
    - `epssProbabilities` string[] — Filters supply chain issues whose corresponding EPSS scores fall in one of the specified buckets. Only applies when the provided issue_type is SCA. | value | description | |-------|---------------| | EPSS_PROBABILITY_LOW | | | EPSS_PROBABILITY_MEDIUM | | | EPSS_PROBABILITY_HIGH | | | EPSS_PROBABILITY_NONE | |
    - `triageReasons` string[] — Filters issues whose triage reason matches one of the specified values. Applies to all issue types. | value | description | |-------|---------------| | FINDING_TRIAGE_REASON_FALSE_POSITIVE | | | FINDING_TRIAGE_REASON_NO_TIME | | | FINDING_TRIAGE_REASON_ACCEPTABLE_RISK | | | FINDING_TRIAGE_REASON_NO_TRIAGE_REASON | | | FINDING_TRIAGE_REASON_UNKNOWN | | | FINDING_TRIAGE_REASON_DUPLICATE | |
    - `timeFilter` 'TIME_FILTER_RELEVANT_SINCE' | 'TIME_FILTER_TRIAGED_AT' | 'TIME_FILTER_FIXED_AT', enum — Filters issues by date based on different attributes related to status changes or triaging | value | description | |-------|---------------| | TIME_FILTER_RELEVANT_SINCE | | | TIME_FILTER_TRIAGED_AT | | | TIME_FILTER_FIXED_AT | |
    - `includeTicketed` boolean — Filters issues based on if they have a nango_external_ticket associated with them
    - `backlogType` 'ISSUE_BACKLOG_TYPE_PROD' | 'ISSUE_BACKLOG_TYPE_PREPROD', enum — Filters issues to either all (prod), or only those with review comments (pre-prod). Only applies when the provided issue_type is SAST. TODO: once experiment is successful, prod should mean only issues in actual production (very similar to on_primary_branch) TODO: verify if review_comment is correct for SCA/SECRETS and enable this filter for those issue types too | value | description | |-------|---------------| | ISSUE_BACKLOG_TYPE_PROD | | | ISSUE_BACKLOG_TYPE_PREPROD | |
    - `scaRuleKind` string[] — Filters supply chain issues by its kind (malicious dependency, reachable, upgrade-only, legacy). Only applies when the provided issue_type is SCA. | value | description | |-------|---------------| | SCA_RULE_KIND_REACHABLE | | | SCA_RULE_KIND_UPGRADE_ONLY | | | SCA_RULE_KIND_MALICIOUS_DEPENDENCY | | | SCA_RULE_KIND_LEGACY | |
    - `aiMemoryWillFlipVerdict` string — Filters issues where a given memory ID's preanalysi shows the AI verdict would change. Supports only one memory ID at a time.
    - `aiMemoryReferenced` string — Filters issues to those which have an AI memory referenced. Applies to SAST issues only.
    - `includeAiMemoryRendered` boolean — Filters for issues based on if they have any AI memory rendered. Applies to SAST issues only.
    - `aiMemoryRendered` string — Filters issues to those which have a specific AI memory rendered. Applies to SAST issues only.
    - `memoryIdInScope` string — Filters to issues that are in scope of the given memory. Applies to SAST issues only.
    - `relativeSince` 'RELATIVE_SINCE_ONE_DAY' | 'RELATIVE_SINCE_ONE_WEEK' | 'RELATIVE_SINCE_ONE_MONTH' | 'RELATIVE_SINCE_THREE_MONTHS' | 'RELATIVE_SINCE_SIX_MONTHS' | 'RELATIVE_SINCE_ONE_YEAR' | 'RELATIVE_SINCE_ALL_TIME' | 'RELATIVE_SINCE_ONE_MINUTE', enum — Filters issues relevant since the specified relative time. Applies to all issue types. | value | description | |-------|---------------| | RELATIVE_SINCE_ONE_DAY | | | RELATIVE_SINCE_ONE_WEEK | | | RELATIVE_SINCE_ONE_MONTH | | | RELATIVE_SINCE_THREE_MONTHS | | | RELATIVE_SINCE_SIX_MONTHS | | | RELATIVE_SINCE_ONE_YEAR | | | RELATIVE_SINCE_ALL_TIME | | | RELATIVE_SINCE_ONE_MINUTE | |
    - `repositoryDeploymentStatuses` string[] — Filters issues to whose projects are deployed in an environment. Applies to all issue types. | value | description | |-------|---------------| | DEPLOYMENT_STATUS_UNKNOWN | | | DEPLOYMENT_STATUS_DEPLOYED | | | DEPLOYMENT_STATUS_NOT_DEPLOYED | |
    - `upgradeGuidance` string[] — Filters supply chain issues whose upgrade guidance matches one of the specified values. Only applies when the provided issue_type is SCA. Deprecated in favor of `upgrade_guidance_filters`. | value | description | |-------|---------------| | BREAKING_CHANGE_TYPE_PARAMETER_CHANGE | The symbol has a breaking change due to a change in the parameters of the function. This includes changes in the number of parameters, their names, their types, etc. | | BREAKING_CHANGE_TYPE_FUNCTION_OR_CLASS_REMOVAL | The symbol has a breaking change due to the removal of a function or class. This means that the function or class is no longer available in the target version. | | BREAKING_CHANGE_TYPE_FUNCTION_RENAME | The symbol has a breaking change due to a change in the name of the function or class. | | BREAKING_CHANGE_TYPE_LOGIC_CHANGE | The symbol has a breaking change due to a change in the logic of the function or class. This means that the function or class still exists, but its behavior has changed in a way that may affect the code that uses it. | | BREAKING_CHANGE_TYPE_NOT_BREAKING | The symbol does not have a breaking change, meaning it can be used in the target version without any issues. |
    - `repositoryPublicExposures` string[] — Filters issues to those whose deployed services are publicly accessible. Applies to all issue types. | value | description | |-------|---------------| | PUBLIC_EXPOSURE_UNKNOWN | | | PUBLIC_EXPOSURE_PUBLIC | | | PUBLIC_EXPOSURE_NOT_PUBLIC | |
    - `clickToFixPrStates` string[] — Filters issues by their Click to Fix PR state. Only applies when the provided issue_type is SAST or SCA. | value | description | |-------|---------------| | CLICK_TO_FIX_PR_STATE_OPEN | | | CLICK_TO_FIX_PR_STATE_MERGED | | | CLICK_TO_FIX_PR_STATE_NO_PR | |
    - `advisoryIds` string[] — Filters supply chain issues by advisory IDs (CVE, GHSA, MAL, etc.). Only applies when the provided issue_type is SCA.
    - `aggregateIssueStates` string[] — Filters issues whose aggregate state matches one of the specified values. Applies to all issue types. Only supported in the Duplo code path. | value | description | |-------|---------------| | AGGREGATE_ISSUE_STATE_OPEN | | | AGGREGATE_ISSUE_STATE_FIXED | | | AGGREGATE_ISSUE_STATE_REMOVED | | | AGGREGATE_ISSUE_STATE_IGNORED_APP | | | AGGREGATE_ISSUE_STATE_IGNORED_CODE | | | AGGREGATE_ISSUE_STATE_UNKNOWN | | | AGGREGATE_ISSUE_STATE_REVIEWING | | | AGGREGATE_ISSUE_STATE_FIXING | | | AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP | |
    - `upgradeGuidanceFilters` string[] — Filters supply chain issues by generic upgrade guidance selections (safe or breaking). Only applies when the provided issue_type is SCA. | value | description | |-------|---------------| | UPGRADE_GUIDANCE_SELECTION_SAFE | | | UPGRADE_GUIDANCE_SELECTION_BREAKING | |
    - `filterIssueTypes` string[] — Frontend-only: this field is included in IssuesFilter to leverage proto-generated TypeScript types for filter state management and URL serialization. When non-empty, restricts the duplo combined Code view to show only the specified issue types. The backend ignores this field. | value | description | |-------|---------------| | ISSUE_TYPE_SAST | Detected by Code rules | | ISSUE_TYPE_SCA | Detected by Supply Chain rules | | ISSUE_TYPE_SECRETS | Detected by Secrets rules | | ISSUE_TYPE_RESEARCH | Detected by research rules or scanners | | ISSUE_TYPE_AI_SAST | Detected by AI detection code scanning |
    - `filePaths` string[] — Fuzzy file path search. Filters issues whose file path matches one of the specified values using analyzed text search (splits on / . _ - etc. and supports typo tolerance). Only works when Duplo is enabled for the deployment — ignored otherwise. Accepts an array of strings but currently only the first value is used.
    - `includeArchived` boolean — When true, include findings on archived projects in results. By default (unset/false), findings on archived projects are hidden from all product tabs and their counts — but only for deployments that have archived projects (gated by the `appex.has_archived_projects` config). Applies to all issue types. Archival is a separate dimension from aggregate state, so this is an independent toggle rather than an `aggregate_issue_states` value.
  - `issueTypes` string[] — Filters issues to those with any of the specified types (based on the product which produced these issues). When empty, falls back to the deprecated issue_type field for backward compatibility. | value | description | |-------|---------------| | ISSUE_TYPE_SAST | Detected by Code rules | | ISSUE_TYPE_SCA | Detected by Supply Chain rules | | ISSUE_TYPE_SECRETS | Detected by Secrets rules | | ISSUE_TYPE_RESEARCH | Detected by research rules or scanners | | ISSUE_TYPE_AI_SAST | Detected by AI detection code scanning |
  - `includeRemediation` boolean — When true, include AI remediation info (autofix and guidance) for each issue in the response. Defaults to false.
  - `includeActivityHistory` boolean — When true, include activity history (status changes, triage events, etc.) for each issue in the response. Defaults to false.
  - `includeIsArchived` boolean — When true, populate the is_archived field on each issue in the response. Defaults to false.

## Response `200`

OK

- ProtosIssuesV1ListIssuesResponse
  - `issues` ProtosIssuesV1ListIssuesResponseIssueSummary[]
    - `issue` ProtosIssuesV1Issue
      - `id` string — ID of the finding
      - `createdAt` string, date-time — Creation timestamp
      - `ref` string — Branch where the finding was detected
      - `syntacticId` string — Semi-unique hash of a check consisting of: Line Numbers, File Path, Rule ID, Index of finding in file, and Matched code
      - `matchBasedId` string — Semi-unique hash of a check consisting of: File Path, Rule ID, Index of finding in file, and Rule Formula with metavariable bindings substituted in
      - `ruleId` string — The ID of the associated semgrep rule
      - `status` 'ISSUE_STATUS_FIXED' | 'ISSUE_STATUS_MUTED' | 'ISSUE_STATUS_REMOVED' | 'ISSUE_STATUS_UNRESOLVED', enum — | value | description | |-------|---------------| | ISSUE_STATUS_FIXED | | | ISSUE_STATUS_MUTED | | | ISSUE_STATUS_REMOVED | | | ISSUE_STATUS_UNRESOLVED | |
      - `repository` ProtosIssuesV1IssueRepository
        - `name` string — Repository name
        - `id` string
        - `type` 'SCM_TYPE_GITHUB' | 'SCM_TYPE_GITHUB_ENTERPRISE' | 'SCM_TYPE_GITLAB' | 'SCM_TYPE_GITLAB_SELFMANAGED' | 'SCM_TYPE_BITBUCKET' | 'SCM_TYPE_BITBUCKET_DATACENTER' | 'SCM_TYPE_AZURE_DEVOPS' | 'SCM_TYPE_UNKNOWN' | 'SCM_TYPE_HARNESS', enum — | value | description | |-------|---------------| | SCM_TYPE_GITHUB | GitHub Cloud | | SCM_TYPE_GITHUB_ENTERPRISE | GitHub Enterprise | | SCM_TYPE_GITLAB | GitLab Cloud | | SCM_TYPE_GITLAB_SELFMANAGED | GitLab Self-Managed | | SCM_TYPE_BITBUCKET | Bitbucket Cloud | | SCM_TYPE_BITBUCKET_DATACENTER | Bitbucket Data Center | | SCM_TYPE_AZURE_DEVOPS | Azure DevOps | | SCM_TYPE_UNKNOWN | | | SCM_TYPE_HARNESS | Harness |
        - `primaryRef` ProtosIssuesV1IssuePrimaryRefItem
          - `id` string
          - `ref` string
      - `firstSeenScan` ProtosIssuesV1IssueScan
        - `id` string
        - `meta` object
      - `triageState` 'FINDING_TRIAGE_STATE_UNTRIAGED' | 'FINDING_TRIAGE_STATE_IGNORED' | 'FINDING_TRIAGE_STATE_REOPENED' | 'FINDING_TRIAGE_STATE_UNKNOWN' | 'FINDING_TRIAGE_STATE_REVIEWING' | 'FINDING_TRIAGE_STATE_FIXING' | 'FINDING_TRIAGE_STATE_PROVISIONALLY_IGNORED', enum — The issue's current triage state. | value | description | |-------|---------------| | FINDING_TRIAGE_STATE_UNTRIAGED | | | FINDING_TRIAGE_STATE_IGNORED | | | FINDING_TRIAGE_STATE_REOPENED | | | FINDING_TRIAGE_STATE_UNKNOWN | | | FINDING_TRIAGE_STATE_REVIEWING | | | FINDING_TRIAGE_STATE_FIXING | | | FINDING_TRIAGE_STATE_PROVISIONALLY_IGNORED | |
      - `triageReason` 'FINDING_TRIAGE_REASON_FALSE_POSITIVE' | 'FINDING_TRIAGE_REASON_NO_TIME' | 'FINDING_TRIAGE_REASON_ACCEPTABLE_RISK' | 'FINDING_TRIAGE_REASON_NO_TRIAGE_REASON' | 'FINDING_TRIAGE_REASON_UNKNOWN' | 'FINDING_TRIAGE_REASON_DUPLICATE', enum — The reason the issue was triaged. | value | description | |-------|---------------| | FINDING_TRIAGE_REASON_FALSE_POSITIVE | | | FINDING_TRIAGE_REASON_NO_TIME | | | FINDING_TRIAGE_REASON_ACCEPTABLE_RISK | | | FINDING_TRIAGE_REASON_NO_TRIAGE_REASON | | | FINDING_TRIAGE_REASON_UNKNOWN | | | FINDING_TRIAGE_REASON_DUPLICATE | |
      - `relevantSince` string, date-time — The timestamp from which this issue was relevant
      - `aggregateState` 'AGGREGATE_ISSUE_STATE_OPEN' | 'AGGREGATE_ISSUE_STATE_FIXED' | 'AGGREGATE_ISSUE_STATE_REMOVED' | 'AGGREGATE_ISSUE_STATE_IGNORED_APP' | 'AGGREGATE_ISSUE_STATE_IGNORED_CODE' | 'AGGREGATE_ISSUE_STATE_UNKNOWN' | 'AGGREGATE_ISSUE_STATE_REVIEWING' | 'AGGREGATE_ISSUE_STATE_FIXING' | 'AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP', enum — The overall state of the issue, accounting for status (controlled by scans), triaging, external events like PR closes, etc. TODO: use the `AggregateState` enum instead of raw strings. | value | description | |-------|---------------| | AGGREGATE_ISSUE_STATE_OPEN | | | AGGREGATE_ISSUE_STATE_FIXED | | | AGGREGATE_ISSUE_STATE_REMOVED | | | AGGREGATE_ISSUE_STATE_IGNORED_APP | | | AGGREGATE_ISSUE_STATE_IGNORED_CODE | | | AGGREGATE_ISSUE_STATE_UNKNOWN | | | AGGREGATE_ISSUE_STATE_REVIEWING | | | AGGREGATE_ISSUE_STATE_FIXING | | | AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP | |
      - `note` string — Comment left when triaged
      - `externalTicket` ProtosTicketingV1ExternalTicket
        - `url` string — URL of the external ticket.
        - `externalSlug` string — Identifier of the external ticket (e.g. for Jira, something like OPS-158).
        - `id` string — Nango ticket id
        - `linkedIssueIds` string[] — Semgrep issue ids that are linked to this external ticket
      - `vulnGroupKey` string — The key used to group supply chain vulns (deprecated)
      - `isBlocking` boolean — True if this issue is a blocking issue.
      - `autotriage` ProtosAiV1Autotriage
        - `id` string
        - `issueId` string
        - `verdict` 'VERDICT_TRUE_POSITIVE' | 'VERDICT_FALSE_POSITIVE' | 'VERDICT_NO_VERDICT', enum — | value | description | |-------|---------------| | VERDICT_TRUE_POSITIVE | | | VERDICT_FALSE_POSITIVE | | | VERDICT_NO_VERDICT | |
        - `reason` string — The reasoning for a false positive verdict, explaining why you might want to ignore the finding. Empty string if verdict is true positive.
        - `feedback` ProtosAiV1AutotriageFeedback
          - `autotriageId` string
          - `rating` 'RATING_GOOD' | 'RATING_BAD', enum — | value | description | |-------|---------------| | RATING_GOOD | Autotriage rated positively by a user. | | RATING_BAD | Autotriage rated negatively by a user. |
          - `note` string
        - `matchBasedId` string
        - `memoryIdsReferenced` string[]
        - `memoryIdsRendered` string[]
      - `aiTags` ProtosAiV1SensitivityTags
        - `id` string — The database id of the sensitivity tags
        - `path` string — The path of the file
        - `tags` string — The tag that is associated with the file The tags are defined in SensitivityTag
        - `sensitivity` 'SENSITIVITY_HIGH_SENSITIVITY' | 'SENSITIVITY_LOW_SENSITIVITY' | 'SENSITIVITY_NEUTRAL_SENSITIVITY', enum — The sensitivity of the given tag Sensitivities are defined in HighSensitivityTag and LowSensitivityTag | value | description | |-------|---------------| | SENSITIVITY_HIGH_SENSITIVITY | | | SENSITIVITY_LOW_SENSITIVITY | | | SENSITIVITY_NEUTRAL_SENSITIVITY | |
      - `lineOfCodeUrl` string — The URL to the specific line of code causing this issue
      - `codeSnippet` string — The code snippet causing this issue. Only available when fetching a single issue at a time via the GetIssue RPC. Deprecated in favor of `code_snippets` for multi-file support.
      - `dataflowTrace` ProtosIssuesV1IssueDataflowTrace
        - `taintSource` ProtosIssuesV1DataflowTraceLocation[]
          - `path` string
          - `start` ProtosIssuesV1DataflowTracePosition
            - `line` string
            - `col` string
            - `offset` string
          - `end` ProtosIssuesV1DataflowTracePosition
            - `line` string
            - `col` string
            - `offset` string
          - `locationUrl` string
        - `intermediateVars` ProtosIssuesV1DataflowTraceLocation[]
          - `path` string
          - `start` ProtosIssuesV1DataflowTracePosition
            - `line` string
            - `col` string
            - `offset` string
          - `end` ProtosIssuesV1DataflowTracePosition
            - `line` string
            - `col` string
            - `offset` string
          - `locationUrl` string
        - `taintSink` ProtosIssuesV1DataflowTraceLocation[]
          - `path` string
          - `start` ProtosIssuesV1DataflowTracePosition
            - `line` string
            - `col` string
            - `offset` string
          - `end` ProtosIssuesV1DataflowTracePosition
            - `line` string
            - `col` string
            - `offset` string
          - `locationUrl` string
      - `commitUrl` string — The URL of the specific commit which introduced this issue. Only available when fetching a single issue at a time via the GetIssue RPC.
      - `activityHistory` ProtosIssuesV1IssueActivityHistoryEvent[] — A chronologically-ordered list of events related to this issue (status change, ai tags, triage events). Always populated by the GetIssue RPC; populated by ListIssues only when ListIssuesRequest.include_activity_history is true.
        - `date` string, date-time
        - `title` string
        - `triageReason` string
        - `note` string
        - `actor` string
        - `historyType` 'HISTORY_TYPE_STATUS' | 'HISTORY_TYPE_TRIAGE' | 'HISTORY_TYPE_AUTOTRIAGE' | 'HISTORY_TYPE_AUTOTRIAGE_FEEDBACK' | 'HISTORY_TYPE_AI_TAG' | 'HISTORY_TYPE_ANALYSIS_STARTED' | 'HISTORY_TYPE_REVIEW_COMMENT_SILENCED' | 'HISTORY_TYPE_TICKET_CREATED' | 'HISTORY_TYPE_TICKET_ATTEMPTED' | 'HISTORY_TYPE_GUIDANCE_REGENERATION' | 'HISTORY_TYPE_SCM_MENTION' | 'HISTORY_TYPE_CLICK_TO_FIX_PR_REQUESTED' | 'HISTORY_TYPE_CLICK_TO_FIX_PR_OPENED' | 'HISTORY_TYPE_CLICK_TO_FIX_PR_FAILED' | 'HISTORY_TYPE_CLICK_TO_FIX_PR_MERGED' | 'HISTORY_TYPE_EXCEPTION_REQUEST_CREATED' | 'HISTORY_TYPE_EXCEPTION_REQUEST_APPROVED' | 'HISTORY_TYPE_EXCEPTION_REQUEST_REJECTED', enum — | value | description | |-------|---------------| | HISTORY_TYPE_STATUS | | | HISTORY_TYPE_TRIAGE | | | HISTORY_TYPE_AUTOTRIAGE | | | HISTORY_TYPE_AUTOTRIAGE_FEEDBACK | | | HISTORY_TYPE_AI_TAG | | | HISTORY_TYPE_ANALYSIS_STARTED | | | HISTORY_TYPE_REVIEW_COMMENT_SILENCED | | | HISTORY_TYPE_TICKET_CREATED | | | HISTORY_TYPE_TICKET_ATTEMPTED | | | HISTORY_TYPE_GUIDANCE_REGENERATION | | | HISTORY_TYPE_SCM_MENTION | | | HISTORY_TYPE_CLICK_TO_FIX_PR_REQUESTED | | | HISTORY_TYPE_CLICK_TO_FIX_PR_OPENED | | | HISTORY_TYPE_CLICK_TO_FIX_PR_FAILED | | | HISTORY_TYPE_CLICK_TO_FIX_PR_MERGED | | | HISTORY_TYPE_EXCEPTION_REQUEST_CREATED | | | HISTORY_TYPE_EXCEPTION_REQUEST_APPROVED | | | HISTORY_TYPE_EXCEPTION_REQUEST_REJECTED | |
        - `exceptionRequestDetails` ProtosIssuesV1ActivityHistoryEventExceptionRequestDetails
          - `actionSource` 'FINDING_EXCEPTION_REQUEST_SOURCE_SCM_COMMENT' | 'FINDING_EXCEPTION_REQUEST_SOURCE_SEMGREP_APPSEC_PLATFORM' | 'FINDING_EXCEPTION_REQUEST_SOURCE_API', enum — | value | description | |-------|---------------| | FINDING_EXCEPTION_REQUEST_SOURCE_SCM_COMMENT | | | FINDING_EXCEPTION_REQUEST_SOURCE_SEMGREP_APPSEC_PLATFORM | | | FINDING_EXCEPTION_REQUEST_SOURCE_API | |
      - `relatedIssues` ProtosIssuesV1IssueRelatedIssue[] — A list of related issues (with the same match based ID). Only available when fetching a single issue at a time via the GetIssue RPC.
        - `id` string
        - `ref` string
        - `pullRequestId` string
        - `aggregateState` 'AGGREGATE_ISSUE_STATE_OPEN' | 'AGGREGATE_ISSUE_STATE_FIXED' | 'AGGREGATE_ISSUE_STATE_REMOVED' | 'AGGREGATE_ISSUE_STATE_IGNORED_APP' | 'AGGREGATE_ISSUE_STATE_IGNORED_CODE' | 'AGGREGATE_ISSUE_STATE_UNKNOWN' | 'AGGREGATE_ISSUE_STATE_REVIEWING' | 'AGGREGATE_ISSUE_STATE_FIXING' | 'AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP', enum — | value | description | |-------|---------------| | AGGREGATE_ISSUE_STATE_OPEN | | | AGGREGATE_ISSUE_STATE_FIXED | | | AGGREGATE_ISSUE_STATE_REMOVED | | | AGGREGATE_ISSUE_STATE_IGNORED_APP | | | AGGREGATE_ISSUE_STATE_IGNORED_CODE | | | AGGREGATE_ISSUE_STATE_UNKNOWN | | | AGGREGATE_ISSUE_STATE_REVIEWING | | | AGGREGATE_ISSUE_STATE_FIXING | | | AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP | |
        - `createdAt` string, date-time
      - `remediation` ProtosAiV1Remediation
        - `issueId` string — The issue id that the remediation is for
        - `matchBasedId` string — The match based id of the issue that remediation is for
        - `autofix` ProtosAiV1Autofix
          - `id` string — The database id of the autofix
          - `fixCode` string — The code to fix the issue This is the entire code block that is already fixed
          - `fixDiff` string — The diff to fix the issue This is the diff to apply to the vulnerable code to fix the issue
          - `explanation` string — The explanation of the autofix The model may explain additional context about the autofix that it is unable to Fix inside the limitations of a single diff, e.g. changes in another file or environment variables
          - `url` string — The url to the autofix pr/mr comment
        - `guidance` ProtosAiV1Guidance
          - `id` string — The database id of the guidance
          - `summary` string — The summary of the guidance_text
          - `guidanceText` string — The step by step instructions on how to fix the issue
          - `memoryIdsUsed` string[] — The IDs of memories that were used to generate this guidance
      - `lastSeenScan` ProtosIssuesV1IssueScan
        - `id` string
        - `meta` object
      - `filePath` string — The path to the file in which this issue was found.
      - `line` integer — The first line number in which this issue was found.
      - `endLine` integer — The end line number in which this issue was found (if the offending code spans several lines).
      - `column` integer — The start column number within the line in which this issue was found.
      - `endColumn` integer — The end column number within the last line in which this issue was found (if applicable).
      - `severity` 'SEVERITY_HIGH' | 'SEVERITY_MEDIUM' | 'SEVERITY_LOW' | 'SEVERITY_CRITICAL', enum — The severity ("seriousness") of the issue. | value | description | |-------|---------------| | SEVERITY_HIGH | | | SEVERITY_MEDIUM | | | SEVERITY_LOW | | | SEVERITY_CRITICAL | |
      - `message` string — An optional message that helps describe the issue in more detail.
      - `rulePath` string — The full path of the rule used to generate this issue.
      - `confidence` 'CONFIDENCE_HIGH' | 'CONFIDENCE_MEDIUM' | 'CONFIDENCE_LOW', enum — The confidence in false-positive rate of an issue. | value | description | |-------|---------------| | CONFIDENCE_HIGH | | | CONFIDENCE_MEDIUM | | | CONFIDENCE_LOW | |
      - `ruleUrl` string — The url of the rule used to generate this issue.
      - `ruleReferences` string[] — A list of external references (URLs) which help describe or provide context for the rule used to generate this issue.
      - `ruleOrigin` 'RULE_ORIGIN_CUSTOM' | 'RULE_ORIGIN_COMMUNITY' | 'RULE_ORIGIN_PRO_RULES', enum — The origin of the rule (pro rules, semgrep community, or a custom rule) | value | description | |-------|---------------| | RULE_ORIGIN_CUSTOM | | | RULE_ORIGIN_COMMUNITY | | | RULE_ORIGIN_PRO_RULES | |
      - `ruleHashId` string — The hash of the associated rule.
      - `ruleCweNames` string[] — The names of the CWEs associated with this issue's rule.
      - `ruleOwaspNames` string[] — The names of the OWASP categories associated with this issue's rule.
      - `ruleset` string — The ruleset to which this issue's rule belongs (if applicable).
      - `policySlug` string — A slugified version of the associated rule's policy.
      - `category` string — The issue's category (or "other" if none).
      - `ruleSupersededBy` ProtosIssuesV1SupersededRule[] — A list of rules which supersede this issue's rule.
        - `product` 'RULE_TYPE_SAST' | 'RULE_TYPE_SCA' | 'RULE_TYPE_SECRETS', enum — | value | description | |-------|---------------| | RULE_TYPE_SAST | | | RULE_TYPE_SCA | | | RULE_TYPE_SECRETS | |
        - `rulePath` string
      - `issueType` 'ISSUE_TYPE_SAST' | 'ISSUE_TYPE_SCA' | 'ISSUE_TYPE_SECRETS' | 'ISSUE_TYPE_RESEARCH' | 'ISSUE_TYPE_AI_SAST', enum — The product which owns this issue, e.g. SAST (code), SCA (supply chain), etc. | value | description | |-------|---------------| | ISSUE_TYPE_SAST | Detected by Code rules | | ISSUE_TYPE_SCA | Detected by Supply Chain rules | | ISSUE_TYPE_SECRETS | Detected by Secrets rules | | ISSUE_TYPE_RESEARCH | Detected by research rules or scanners | | ISSUE_TYPE_AI_SAST | Detected by AI detection code scanning |
      - `issueParentId` string — Parent ID of the finding. Present for all types.
      - `ticketAttempts` ProtosTicketingV1TicketAttempt[] — The failed attempts at ticket creation
        - `attemptedAt` string, date-time — Date that the ticket was last attempted
        - `responseMessage` string — The (error) message returned when the attempt was made
      - `sastAttributes` ProtosIssuesV1IssueSastAttributes — Groups the fields of Issue that are specific to the SAST product
      - `scaAttributes` ProtosIssuesV1IssueScaAttributes — Groups the fields of Issue that are specific to the SCA product
        - `severity` 'SEVERITY_HIGH' | 'SEVERITY_MEDIUM' | 'SEVERITY_LOW' | 'SEVERITY_CRITICAL', enum — Severity of the SCA issue (TODO: reconcile this with the Issue.severity field, which *should* agree but doesn't necessarily agree yet) | value | description | |-------|---------------| | SEVERITY_HIGH | | | SEVERITY_MEDIUM | | | SEVERITY_LOW | | | SEVERITY_CRITICAL | |
        - `vulnDatabaseIdentifier` string — ID of the CVE or GHSA from upon which this SCA issue's rule is based
        - `reachability` 'REACHABILITY_CONDITIONALLY_REACHABLE' | 'REACHABILITY_ALWAYS_REACHABLE' | 'REACHABILITY_REACHABLE' | 'REACHABILITY_UNREACHABLE' | 'REACHABILITY_UNKNOWN', enum — SCA issue's reachability (whether the issue is reachable from the client's code and, if so, how) | value | description | |-------|---------------| | REACHABILITY_CONDITIONALLY_REACHABLE | | | REACHABILITY_ALWAYS_REACHABLE | | | REACHABILITY_REACHABLE | | | REACHABILITY_UNREACHABLE | | | REACHABILITY_UNKNOWN | |
        - `reachableCondition` string — For SCA issues which are conditionally reachable, this will store a human-readable description of the condition.
        - `cwes` string[] — Stands for "common weakness enumeration": a taxonomy for identifying the common sources of software flaws (e.g., buffer overflows, failure to check input data)
        - `foundDependency` ProtosIssuesV1ScaAttributesFoundDependency
          - `package` string — Name of the dependency's package
          - `version` string — The Version of the dependency
          - `transitivity` 'UNKNOWN_TRANSITIVITY' | 'TRANSITIVE' | 'DIRECT', enum — The transitivity (whether or not a dependency is directly imported into a project) of the dependency | value | description | |-------|---------------| | UNKNOWN_TRANSITIVITY | | | TRANSITIVE | | | DIRECT | |
          - `lockfileLineUrl` string — The URL (on the SCM) to the line in the lockfile at which the dependency is defined (might not exist if the dependency was surfaced in a non SCM context)
          - `filePath` string — The relative path (from the project root) to the lockfile in which the dependency is defined
          - `ecosystem` 'no_package_manager' | 'npm' | 'pypi' | 'gomod' | 'cargo' | 'maven' | 'gem' | 'composer' | 'nuget' | 'pub' | 'swiftpm' | 'hex' | 'cocoapods' | 'mix' | 'opam', enum — Package ecosystem (enum defined in sca/vi/sca.proto) to which the dependency belongs | value | description | |-------|---------------| | no_package_manager | | | npm | | | pypi | | | gomod | | | cargo | | | maven | | | gem | | | composer | | | nuget | | | pub | | | swiftpm | | | hex | | | cocoapods | | | mix | | | opam | |
          - `manifestFilePath` string — The relative path (from the project root) to the manifest file which defines the subproject which the dependency is part of
        - `fixRecommendations` ProtosIssuesV1ScaAttributesFixRecommendation[] — A list of Semgrep's dependency upgrade recommendations which would addressing the SCA issue's underlying rule.
          - `package` string
          - `version` string
        - `bestFix` ProtosIssuesV1ScaAttributesFixRecommendation
          - `package` string
          - `version` string
        - `epssScore` ProtosScaV1EpssScore — Represents a single "Exploit Prediction Scoring System" score (https://www.first.org/epss/)
          - `score` number, float
          - `percentile` number, float
          - `updatedAt` string, date-time
          - `categorization` 'EPSS_PROBABILITY_LOW' | 'EPSS_PROBABILITY_MEDIUM' | 'EPSS_PROBABILITY_HIGH' | 'EPSS_PROBABILITY_NONE', enum — | value | description | |-------|---------------| | EPSS_PROBABILITY_LOW | | | EPSS_PROBABILITY_MEDIUM | | | EPSS_PROBABILITY_HIGH | | | EPSS_PROBABILITY_NONE | |
        - `rulePublishDate` string, date-time — the date the associated rule was published
        - `scaRuleKind` 'SCA_RULE_KIND_REACHABLE' | 'SCA_RULE_KIND_UPGRADE_ONLY' | 'SCA_RULE_KIND_MALICIOUS_DEPENDENCY' | 'SCA_RULE_KIND_LEGACY', enum — SCA issue's kind (malicious, reachable, upgrade-only, etc.). Note that this repeats some information that is included in `reachability` and `transitivity`. TODO: consolidate with `reachability` and `transitivity` when we roll out TR for everyone. | value | description | |-------|---------------| | SCA_RULE_KIND_REACHABLE | | | SCA_RULE_KIND_UPGRADE_ONLY | | | SCA_RULE_KIND_MALICIOUS_DEPENDENCY | | | SCA_RULE_KIND_LEGACY | |
        - `scaMatchInfo` ProtosIssuesV1ScaAttributesScaMatchInfo
          - `matchKind` 'SCA_MATCH_KIND_LOCKFILE_ONLY' | 'SCA_MATCH_KIND_DIRECT_REACHABLE' | 'SCA_MATCH_KIND_DIRECT_UNREACHABLE' | 'SCA_MATCH_KIND_TRANSITIVE_REACHABLE' | 'SCA_MATCH_KIND_TRANSITIVE_UNREACHABLE' | 'SCA_MATCH_KIND_TRANSITIVE_UNDETERMINED', enum — | value | description | |-------|---------------| | SCA_MATCH_KIND_LOCKFILE_ONLY | | | SCA_MATCH_KIND_DIRECT_REACHABLE | | | SCA_MATCH_KIND_DIRECT_UNREACHABLE | | | SCA_MATCH_KIND_TRANSITIVE_REACHABLE | | | SCA_MATCH_KIND_TRANSITIVE_UNREACHABLE | | | SCA_MATCH_KIND_TRANSITIVE_UNDETERMINED | |
          - `analyzedPackages` ProtosIssuesV1ScaAttributesFoundDependency[]
            - `package` string — Name of the dependency's package
            - `version` string — The Version of the dependency
            - `transitivity` 'UNKNOWN_TRANSITIVITY' | 'TRANSITIVE' | 'DIRECT', enum — The transitivity (whether or not a dependency is directly imported into a project) of the dependency | value | description | |-------|---------------| | UNKNOWN_TRANSITIVITY | | | TRANSITIVE | | | DIRECT | |
            - `lockfileLineUrl` string — The URL (on the SCM) to the line in the lockfile at which the dependency is defined (might not exist if the dependency was surfaced in a non SCM context)
            - `filePath` string — The relative path (from the project root) to the lockfile in which the dependency is defined
            - `ecosystem` 'no_package_manager' | 'npm' | 'pypi' | 'gomod' | 'cargo' | 'maven' | 'gem' | 'composer' | 'nuget' | 'pub' | 'swiftpm' | 'hex' | 'cocoapods' | 'mix' | 'opam', enum — Package ecosystem (enum defined in sca/vi/sca.proto) to which the dependency belongs | value | description | |-------|---------------| | no_package_manager | | | npm | | | pypi | | | gomod | | | cargo | | | maven | | | gem | | | composer | | | nuget | | | pub | | | swiftpm | | | hex | | | cocoapods | | | mix | | | opam | |
            - `manifestFilePath` string — The relative path (from the project root) to the manifest file which defines the subproject which the dependency is part of
          - `transitiveMatches` ProtosIssuesV1ScaMatchInfoTransitiveMatch[]
            - `dependency` ProtosIssuesV1ScaAttributesFoundDependency
              - …
            - `path` string
            - `line` string
        - `introducedBy` ProtosIssuesV1ScaAttributesIntroducingDependency[] — The distinct direct dependencies that introduced this transitive dependency. Empty for direct dependencies (not applicable).
          - `package` string
          - `version` string
      - `secretsAttributes` ProtosIssuesV1IssueSecretsAttributes — Groups the fields of Issue that are specific to the Secrets product
        - `validationState` 'VALIDATION_STATE_CONFIRMED_VALID' | 'VALIDATION_STATE_CONFIRMED_INVALID' | 'VALIDATION_STATE_VALIDATION_ERROR' | 'VALIDATION_STATE_NO_VALIDATOR', enum — | value | description | |-------|---------------| | VALIDATION_STATE_CONFIRMED_VALID | | | VALIDATION_STATE_CONFIRMED_INVALID | | | VALIDATION_STATE_VALIDATION_ERROR | | | VALIDATION_STATE_NO_VALIDATOR | |
        - `secretType` string
        - `historicalInfo` ProtosSecretsV1HistoricalInfo
          - `gitCommit` string — Git commit at which the finding is present. Used by "historical" scans, which scan non-HEAD commits in the git history. Relevant for finding, e.g., secrets which are buried in the git history which we wouldn't find at HEAD
          - `gitCommitTimestamp` string, date-time
          - `gitBlob` string — Git blob at which the finding is present. Sent in addition to the commit since some SCMs have permalinks which use the blob sha, so this information is useful when generating links back to the SCM.
      - `subcategories` string[] — The issue's subcategories
      - `refUrl` string — The URL of the specific commit which introduced this issue. Only available when fetching a single issue at a time via the GetIssue RPC.
      - `codeowners` ProtosAiV1Codeowner[]
        - `id` string
        - `name` string
        - `isTeam` boolean
        - `members` ProtosAiV1Codeowner[]
      - `codeSnippets` ProtosIssuesV1IssueCodeSnippet[] — The content of files involved in this issue. Only available when fetching a single issue at a time via the GetIssue RPC.
        - `path` string
        - `content` string
      - `ruleExplanation` ProtosAiV1RuleExplanation — RuleExplanation contains AI-generated explanations for why a rule flagged specific code
        - `id` string — The database id of the rule explanation
        - `summary` string — A concise summary of the rule explanation
        - `explanation` string — The full detailed explanation of why this rule flagged the code
      - `ruleDisplayName` string — The human-readable display name of the rule (e.g., "Hardcoded secret"). Only available when fetching a single issue at a time via the GetIssue RPC.
      - `clickToFixPrUrl` string — The URL of the Click-to-Fix PR that was opened to fix this issue (if any). Available in the GetIssue RPC and in list responses that opt into it.
      - `aiImpact` string — AI Detection only: LLM-generated description of the vulnerability's impact. Only available when fetching a single issue at a time via the GetIssue RPC.
      - `aiExploitConditions` ProtosAiV1ExploitCondition[] — AI Detection only: Conditions that must be true for the vulnerability to be exploitable. Only available when fetching a single issue at a time via the GetIssue RPC.
        - `description` string — Plain english description of the step
        - `confirmed` boolean — Whether the LLM was able to confirm this condition is met
      - `clickToFixCommitMsg` string — The commit message for the Click-to-Fix PR (if any). Only available when fetching a single issue at a time via the GetIssue RPC.
      - `exceptionRequest` ProtosIssuesV1IssueExceptionRequestSummary — A summary of the exception request state for a finding, shaped for the findings list UI. Only returned when include_exception_request_info is true.
        - `exceptionState` 'FINDING_EXCEPTION_REQUEST_STATE_REQUESTED' | 'FINDING_EXCEPTION_REQUEST_STATE_APPROVED' | 'FINDING_EXCEPTION_REQUEST_STATE_REJECTED', enum — Current state of the exception request. | value | description | |-------|---------------| | FINDING_EXCEPTION_REQUEST_STATE_REQUESTED | | | FINDING_EXCEPTION_REQUEST_STATE_APPROVED | | | FINDING_EXCEPTION_REQUEST_STATE_REJECTED | |
        - `requesterLogin` string — Login of the user who submitted the request. Absent if created programmatically.
        - `requesterNote` string — Note provided by the requester.
        - `requesterTriageReason` 'FINDING_TRIAGE_REASON_FALSE_POSITIVE' | 'FINDING_TRIAGE_REASON_NO_TIME' | 'FINDING_TRIAGE_REASON_ACCEPTABLE_RISK' | 'FINDING_TRIAGE_REASON_NO_TRIAGE_REASON' | 'FINDING_TRIAGE_REASON_UNKNOWN' | 'FINDING_TRIAGE_REASON_DUPLICATE', enum — Triage reason provided by the requester. | value | description | |-------|---------------| | FINDING_TRIAGE_REASON_FALSE_POSITIVE | | | FINDING_TRIAGE_REASON_NO_TIME | | | FINDING_TRIAGE_REASON_ACCEPTABLE_RISK | | | FINDING_TRIAGE_REASON_NO_TRIAGE_REASON | | | FINDING_TRIAGE_REASON_UNKNOWN | | | FINDING_TRIAGE_REASON_DUPLICATE | |
        - `requesterActionSource` 'FINDING_EXCEPTION_REQUEST_SOURCE_SCM_COMMENT' | 'FINDING_EXCEPTION_REQUEST_SOURCE_SEMGREP_APPSEC_PLATFORM' | 'FINDING_EXCEPTION_REQUEST_SOURCE_API', enum — Source system that originated the request. | value | description | |-------|---------------| | FINDING_EXCEPTION_REQUEST_SOURCE_SCM_COMMENT | | | FINDING_EXCEPTION_REQUEST_SOURCE_SEMGREP_APPSEC_PLATFORM | | | FINDING_EXCEPTION_REQUEST_SOURCE_API | |
        - `reviewerLogin` string — Login of the reviewer. Only populated when exception_state is APPROVED or REJECTED.
        - `requestId` string — Unique identifier for this exception request.
        - `reviewId` string — Unique identifier for this exception review.
        - `issueId` string — ID of the issue this exception request applies to.
        - `createdAt` string, date-time — The timestamp when the exception request was created.
        - `reviewedAt` string, date-time — When the exception request was last reviewed.
      - `clickToFixPrId` string — The SCM-agnostic PR identifier for the Click-to-Fix PR (if any). Available in the GetIssue RPC and in list responses that opt into it. Prefer this over parsing the PR number from click_to_fix_pr_url.
      - `triagePermission` 'TRIAGE_PERMISSION_IGNORE' | 'TRIAGE_PERMISSION_REQUEST' | 'TRIAGE_PERMISSION_NONE', enum — The triage permission for this issue: whether a developer may ignore it themselves, must request an exception, or cannot triage it at all. Only defined when the developer approvals feature is enabled. | value | description | |-------|---------------| | TRIAGE_PERMISSION_IGNORE | | | TRIAGE_PERMISSION_REQUEST | | | TRIAGE_PERMISSION_NONE | |
      - `isArchived` boolean — True if this finding's project is archived (Semgrep-initiated via is_semgrep_archived, or SCM-archived).
    - `reviewCount` string
    - `triageCount` string
    - `allRefs` string[]
    - `aiSilencedCount` string
    - `allReviewThreadIds` string[]
    - `allReviewComments` ProtosIssuesV1ListIssuesResponseReviewComment[]
      - `isInline` boolean
      - `threadId` string
  - `cursor` string

---

[API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/versions/6483eeecd582/schema)