---
title: "Get Report Findings"
method: POST
path: "/api/reporting/{deploymentId}/findings"
tags: ["ReportsService"]
---

# Get Report Findings

`POST /api/reporting/{deploymentId}/findings`

## Path parameters

- `deploymentId` string, int64, required — The unique numerical identifier of the deployment associated with the report.

## Request body

- ProtosReportingV1GetReportFindingsRequest
  - `reportType` 'REPORT_TYPE_TOTAL_OPEN' | 'REPORT_TYPE_TOTAL_FIXED' | 'REPORT_TYPE_TOTAL_IGNORED' | 'REPORT_TYPE_TOTAL_PROVISIONALLY_IGNORED' | 'REPORT_TYPE_OPEN_BACKLOG' | 'REPORT_TYPE_BACKLOG_ACTIVITY' | 'REPORT_TYPE_PROJECT' | 'REPORT_TYPE_GUARDRAILS_ACTIVITY', enum — | value | description | |-------|---------------| | REPORT_TYPE_TOTAL_OPEN | | | REPORT_TYPE_TOTAL_FIXED | | | REPORT_TYPE_TOTAL_IGNORED | | | REPORT_TYPE_TOTAL_PROVISIONALLY_IGNORED | | | REPORT_TYPE_OPEN_BACKLOG | | | REPORT_TYPE_BACKLOG_ACTIVITY | | | REPORT_TYPE_PROJECT | | | REPORT_TYPE_GUARDRAILS_ACTIVITY | |
  - `filters` ProtosReportingV1ReportFilters
    - `timePeriod` ProtosReportingV1TimePeriod — ****************************************** Shared types ******************************************
      - `since` string, date-time
      - `until` string, date-time
    - `timeBucketSize` 'TIME_BUCKET_SIZE_DAY' | 'TIME_BUCKET_SIZE_WEEK' | 'TIME_BUCKET_SIZE_MONTH', enum — | value | description | |-------|---------------| | TIME_BUCKET_SIZE_DAY | | | TIME_BUCKET_SIZE_WEEK | | | TIME_BUCKET_SIZE_MONTH | |
    - `findingTypes` string[] — | value | description | |-------|---------------| | FINDING_TYPE_CODE | | | FINDING_TYPE_SCA | | | FINDING_TYPE_SECRETS | |
    - `findingSeverities` string[] — | value | description | |-------|---------------| | FINDING_SEVERITY_LOW | | | FINDING_SEVERITY_MEDIUM | | | FINDING_SEVERITY_HIGH | | | FINDING_SEVERITY_CRITICAL | |
    - `projects` string[] — Case sensitive project names, prefer project_ids for filtering.
    - `tags` string[]
    - `confidence` string[] — | value | description | |-------|---------------| | FINDING_CONFIDENCE_LOW | | | FINDING_CONFIDENCE_MEDIUM | | | FINDING_CONFIDENCE_HIGH | |
    - `reachability` string[] — | value | description | |-------|---------------| | FINDING_REACHABILITY_REACHABLE | | | FINDING_REACHABILITY_ALWAYS_REACHABLE | | | FINDING_REACHABILITY_CONDITIONALLY_REACHABLE | | | FINDING_REACHABILITY_NO_REACHABILITY_ANALYSIS | | | FINDING_REACHABILITY_UNREACHABLE | |
    - `validity` string[] — | value | description | |-------|---------------| | FINDING_VALIDITY_VALID | | | FINDING_VALIDITY_INVALID | | | FINDING_VALIDITY_ERROR | | | FINDING_VALIDITY_NO_VALIDATOR | |
    - `teams` string[]
    - `ruleIds` string[]
    - `aiVerdicts` string[] — | value | description | |-------|---------------| | VERDICT_TRUE_POSITIVE | | | VERDICT_FALSE_POSITIVE | | | VERDICT_NO_VERDICT | |
    - `deploymentStatuses` string[] — | value | description | |-------|---------------| | DEPLOYMENT_STATUS_UNKNOWN | | | DEPLOYMENT_STATUS_DEPLOYED | | | DEPLOYMENT_STATUS_NOT_DEPLOYED | |
    - `publicExposures` string[] — | value | description | |-------|---------------| | PUBLIC_EXPOSURE_UNKNOWN | | | PUBLIC_EXPOSURE_PUBLIC | | | PUBLIC_EXPOSURE_NOT_PUBLIC | |
    - `findingCategories` string[]
    - `projectIds` string[]
  - `cursor` string
  - `limit` integer
  - `bucketStart` string, date-time
  - `findingState` 'AGGREGATE_ISSUE_STATE_OPEN' | 'AGGREGATE_ISSUE_STATE_FIXED' | 'AGGREGATE_ISSUE_STATE_REMOVED' | 'AGGREGATE_ISSUE_STATE_IGNORED_APP' | 'AGGREGATE_ISSUE_STATE_IGNORED_CODE' | 'AGGREGATE_ISSUE_STATE_UNKNOWN' | 'AGGREGATE_ISSUE_STATE_REVIEWING' | 'AGGREGATE_ISSUE_STATE_FIXING' | 'AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP', enum — | value | description | |-------|---------------| | AGGREGATE_ISSUE_STATE_OPEN | | | AGGREGATE_ISSUE_STATE_FIXED | | | AGGREGATE_ISSUE_STATE_REMOVED | | | AGGREGATE_ISSUE_STATE_IGNORED_APP | | | AGGREGATE_ISSUE_STATE_IGNORED_CODE | | | AGGREGATE_ISSUE_STATE_UNKNOWN | | | AGGREGATE_ISSUE_STATE_REVIEWING | | | AGGREGATE_ISSUE_STATE_FIXING | | | AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP | |
  - `guardrailsState` string

## Response `200`

OK

- ProtosReportingV1GetReportFindingsResponse
  - `findings` ProtosIssuesV1Issue[]
    - `id` string — ID of the finding
    - `createdAt` string, date-time — Creation timestamp
    - `ref` string — Branch where the finding was detected
    - `syntacticId` string — Semi-unique hash of a check consisting of: Line Numbers, File Path, Rule ID, Index of finding in file, and Matched code
    - `matchBasedId` string — Semi-unique hash of a check consisting of: File Path, Rule ID, Index of finding in file, and Rule Formula with metavariable bindings substituted in
    - `ruleId` string — The ID of the associated semgrep rule
    - `status` 'ISSUE_STATUS_FIXED' | 'ISSUE_STATUS_MUTED' | 'ISSUE_STATUS_REMOVED' | 'ISSUE_STATUS_UNRESOLVED', enum — | value | description | |-------|---------------| | ISSUE_STATUS_FIXED | | | ISSUE_STATUS_MUTED | | | ISSUE_STATUS_REMOVED | | | ISSUE_STATUS_UNRESOLVED | |
    - `repository` ProtosIssuesV1IssueRepository
      - `name` string — Repository name
      - `id` string
      - `type` 'SCM_TYPE_GITHUB' | 'SCM_TYPE_GITHUB_ENTERPRISE' | 'SCM_TYPE_GITLAB' | 'SCM_TYPE_GITLAB_SELFMANAGED' | 'SCM_TYPE_BITBUCKET' | 'SCM_TYPE_BITBUCKET_DATACENTER' | 'SCM_TYPE_AZURE_DEVOPS' | 'SCM_TYPE_UNKNOWN' | 'SCM_TYPE_HARNESS', enum — | value | description | |-------|---------------| | SCM_TYPE_GITHUB | GitHub Cloud | | SCM_TYPE_GITHUB_ENTERPRISE | GitHub Enterprise | | SCM_TYPE_GITLAB | GitLab Cloud | | SCM_TYPE_GITLAB_SELFMANAGED | GitLab Self-Managed | | SCM_TYPE_BITBUCKET | Bitbucket Cloud | | SCM_TYPE_BITBUCKET_DATACENTER | Bitbucket Data Center | | SCM_TYPE_AZURE_DEVOPS | Azure DevOps | | SCM_TYPE_UNKNOWN | | | SCM_TYPE_HARNESS | Harness |
      - `primaryRef` ProtosIssuesV1IssuePrimaryRefItem
        - `id` string
        - `ref` string
    - `firstSeenScan` ProtosIssuesV1IssueScan
      - `id` string
      - `meta` object
    - `triageState` 'FINDING_TRIAGE_STATE_UNTRIAGED' | 'FINDING_TRIAGE_STATE_IGNORED' | 'FINDING_TRIAGE_STATE_REOPENED' | 'FINDING_TRIAGE_STATE_UNKNOWN' | 'FINDING_TRIAGE_STATE_REVIEWING' | 'FINDING_TRIAGE_STATE_FIXING' | 'FINDING_TRIAGE_STATE_PROVISIONALLY_IGNORED', enum — The issue's current triage state. | value | description | |-------|---------------| | FINDING_TRIAGE_STATE_UNTRIAGED | | | FINDING_TRIAGE_STATE_IGNORED | | | FINDING_TRIAGE_STATE_REOPENED | | | FINDING_TRIAGE_STATE_UNKNOWN | | | FINDING_TRIAGE_STATE_REVIEWING | | | FINDING_TRIAGE_STATE_FIXING | | | FINDING_TRIAGE_STATE_PROVISIONALLY_IGNORED | |
    - `triageReason` 'FINDING_TRIAGE_REASON_FALSE_POSITIVE' | 'FINDING_TRIAGE_REASON_NO_TIME' | 'FINDING_TRIAGE_REASON_ACCEPTABLE_RISK' | 'FINDING_TRIAGE_REASON_NO_TRIAGE_REASON' | 'FINDING_TRIAGE_REASON_UNKNOWN' | 'FINDING_TRIAGE_REASON_DUPLICATE', enum — The reason the issue was triaged. | value | description | |-------|---------------| | FINDING_TRIAGE_REASON_FALSE_POSITIVE | | | FINDING_TRIAGE_REASON_NO_TIME | | | FINDING_TRIAGE_REASON_ACCEPTABLE_RISK | | | FINDING_TRIAGE_REASON_NO_TRIAGE_REASON | | | FINDING_TRIAGE_REASON_UNKNOWN | | | FINDING_TRIAGE_REASON_DUPLICATE | |
    - `relevantSince` string, date-time — The timestamp from which this issue was relevant
    - `aggregateState` 'AGGREGATE_ISSUE_STATE_OPEN' | 'AGGREGATE_ISSUE_STATE_FIXED' | 'AGGREGATE_ISSUE_STATE_REMOVED' | 'AGGREGATE_ISSUE_STATE_IGNORED_APP' | 'AGGREGATE_ISSUE_STATE_IGNORED_CODE' | 'AGGREGATE_ISSUE_STATE_UNKNOWN' | 'AGGREGATE_ISSUE_STATE_REVIEWING' | 'AGGREGATE_ISSUE_STATE_FIXING' | 'AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP', enum — The overall state of the issue, accounting for status (controlled by scans), triaging, external events like PR closes, etc. TODO: use the `AggregateState` enum instead of raw strings. | value | description | |-------|---------------| | AGGREGATE_ISSUE_STATE_OPEN | | | AGGREGATE_ISSUE_STATE_FIXED | | | AGGREGATE_ISSUE_STATE_REMOVED | | | AGGREGATE_ISSUE_STATE_IGNORED_APP | | | AGGREGATE_ISSUE_STATE_IGNORED_CODE | | | AGGREGATE_ISSUE_STATE_UNKNOWN | | | AGGREGATE_ISSUE_STATE_REVIEWING | | | AGGREGATE_ISSUE_STATE_FIXING | | | AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP | |
    - `note` string — Comment left when triaged
    - `externalTicket` ProtosTicketingV1ExternalTicket
      - `url` string — URL of the external ticket.
      - `externalSlug` string — Identifier of the external ticket (e.g. for Jira, something like OPS-158).
      - `id` string — Nango ticket id
      - `linkedIssueIds` string[] — Semgrep issue ids that are linked to this external ticket
    - `vulnGroupKey` string — The key used to group supply chain vulns (deprecated)
    - `isBlocking` boolean — True if this issue is a blocking issue.
    - `autotriage` ProtosAiV1Autotriage
      - `id` string
      - `issueId` string
      - `verdict` 'VERDICT_TRUE_POSITIVE' | 'VERDICT_FALSE_POSITIVE' | 'VERDICT_NO_VERDICT', enum — | value | description | |-------|---------------| | VERDICT_TRUE_POSITIVE | | | VERDICT_FALSE_POSITIVE | | | VERDICT_NO_VERDICT | |
      - `reason` string — The reasoning for a false positive verdict, explaining why you might want to ignore the finding. Empty string if verdict is true positive.
      - `feedback` ProtosAiV1AutotriageFeedback
        - `autotriageId` string
        - `rating` 'RATING_GOOD' | 'RATING_BAD', enum — | value | description | |-------|---------------| | RATING_GOOD | Autotriage rated positively by a user. | | RATING_BAD | Autotriage rated negatively by a user. |
        - `note` string
      - `matchBasedId` string
      - `memoryIdsReferenced` string[]
      - `memoryIdsRendered` string[]
    - `aiTags` ProtosAiV1SensitivityTags
      - `id` string — The database id of the sensitivity tags
      - `path` string — The path of the file
      - `tags` string — The tag that is associated with the file The tags are defined in SensitivityTag
      - `sensitivity` 'SENSITIVITY_HIGH_SENSITIVITY' | 'SENSITIVITY_LOW_SENSITIVITY' | 'SENSITIVITY_NEUTRAL_SENSITIVITY', enum — The sensitivity of the given tag Sensitivities are defined in HighSensitivityTag and LowSensitivityTag | value | description | |-------|---------------| | SENSITIVITY_HIGH_SENSITIVITY | | | SENSITIVITY_LOW_SENSITIVITY | | | SENSITIVITY_NEUTRAL_SENSITIVITY | |
    - `lineOfCodeUrl` string — The URL to the specific line of code causing this issue
    - `codeSnippet` string — The code snippet causing this issue. Only available when fetching a single issue at a time via the GetIssue RPC. Deprecated in favor of `code_snippets` for multi-file support.
    - `dataflowTrace` ProtosIssuesV1IssueDataflowTrace
      - `taintSource` ProtosIssuesV1DataflowTraceLocation[]
        - `path` string
        - `start` ProtosIssuesV1DataflowTracePosition
          - `line` string
          - `col` string
          - `offset` string
        - `end` ProtosIssuesV1DataflowTracePosition
          - `line` string
          - `col` string
          - `offset` string
        - `locationUrl` string
      - `intermediateVars` ProtosIssuesV1DataflowTraceLocation[]
        - `path` string
        - `start` ProtosIssuesV1DataflowTracePosition
          - `line` string
          - `col` string
          - `offset` string
        - `end` ProtosIssuesV1DataflowTracePosition
          - `line` string
          - `col` string
          - `offset` string
        - `locationUrl` string
      - `taintSink` ProtosIssuesV1DataflowTraceLocation[]
        - `path` string
        - `start` ProtosIssuesV1DataflowTracePosition
          - `line` string
          - `col` string
          - `offset` string
        - `end` ProtosIssuesV1DataflowTracePosition
          - `line` string
          - `col` string
          - `offset` string
        - `locationUrl` string
    - `commitUrl` string — The URL of the specific commit which introduced this issue. Only available when fetching a single issue at a time via the GetIssue RPC.
    - `activityHistory` ProtosIssuesV1IssueActivityHistoryEvent[] — A chronologically-ordered list of events related to this issue (status change, ai tags, triage events). Always populated by the GetIssue RPC; populated by ListIssues only when ListIssuesRequest.include_activity_history is true.
      - `date` string, date-time
      - `title` string
      - `triageReason` string
      - `note` string
      - `actor` string
      - `historyType` 'HISTORY_TYPE_STATUS' | 'HISTORY_TYPE_TRIAGE' | 'HISTORY_TYPE_AUTOTRIAGE' | 'HISTORY_TYPE_AUTOTRIAGE_FEEDBACK' | 'HISTORY_TYPE_AI_TAG' | 'HISTORY_TYPE_ANALYSIS_STARTED' | 'HISTORY_TYPE_REVIEW_COMMENT_SILENCED' | 'HISTORY_TYPE_TICKET_CREATED' | 'HISTORY_TYPE_TICKET_ATTEMPTED' | 'HISTORY_TYPE_GUIDANCE_REGENERATION' | 'HISTORY_TYPE_SCM_MENTION' | 'HISTORY_TYPE_CLICK_TO_FIX_PR_REQUESTED' | 'HISTORY_TYPE_CLICK_TO_FIX_PR_OPENED' | 'HISTORY_TYPE_CLICK_TO_FIX_PR_FAILED' | 'HISTORY_TYPE_CLICK_TO_FIX_PR_MERGED' | 'HISTORY_TYPE_EXCEPTION_REQUEST_CREATED' | 'HISTORY_TYPE_EXCEPTION_REQUEST_APPROVED' | 'HISTORY_TYPE_EXCEPTION_REQUEST_REJECTED', enum — | value | description | |-------|---------------| | HISTORY_TYPE_STATUS | | | HISTORY_TYPE_TRIAGE | | | HISTORY_TYPE_AUTOTRIAGE | | | HISTORY_TYPE_AUTOTRIAGE_FEEDBACK | | | HISTORY_TYPE_AI_TAG | | | HISTORY_TYPE_ANALYSIS_STARTED | | | HISTORY_TYPE_REVIEW_COMMENT_SILENCED | | | HISTORY_TYPE_TICKET_CREATED | | | HISTORY_TYPE_TICKET_ATTEMPTED | | | HISTORY_TYPE_GUIDANCE_REGENERATION | | | HISTORY_TYPE_SCM_MENTION | | | HISTORY_TYPE_CLICK_TO_FIX_PR_REQUESTED | | | HISTORY_TYPE_CLICK_TO_FIX_PR_OPENED | | | HISTORY_TYPE_CLICK_TO_FIX_PR_FAILED | | | HISTORY_TYPE_CLICK_TO_FIX_PR_MERGED | | | HISTORY_TYPE_EXCEPTION_REQUEST_CREATED | | | HISTORY_TYPE_EXCEPTION_REQUEST_APPROVED | | | HISTORY_TYPE_EXCEPTION_REQUEST_REJECTED | |
      - `exceptionRequestDetails` ProtosIssuesV1ActivityHistoryEventExceptionRequestDetails
        - `actionSource` 'FINDING_EXCEPTION_REQUEST_SOURCE_SCM_COMMENT' | 'FINDING_EXCEPTION_REQUEST_SOURCE_SEMGREP_APPSEC_PLATFORM' | 'FINDING_EXCEPTION_REQUEST_SOURCE_API', enum — | value | description | |-------|---------------| | FINDING_EXCEPTION_REQUEST_SOURCE_SCM_COMMENT | | | FINDING_EXCEPTION_REQUEST_SOURCE_SEMGREP_APPSEC_PLATFORM | | | FINDING_EXCEPTION_REQUEST_SOURCE_API | |
    - `relatedIssues` ProtosIssuesV1IssueRelatedIssue[] — A list of related issues (with the same match based ID). Only available when fetching a single issue at a time via the GetIssue RPC.
      - `id` string
      - `ref` string
      - `pullRequestId` string
      - `aggregateState` 'AGGREGATE_ISSUE_STATE_OPEN' | 'AGGREGATE_ISSUE_STATE_FIXED' | 'AGGREGATE_ISSUE_STATE_REMOVED' | 'AGGREGATE_ISSUE_STATE_IGNORED_APP' | 'AGGREGATE_ISSUE_STATE_IGNORED_CODE' | 'AGGREGATE_ISSUE_STATE_UNKNOWN' | 'AGGREGATE_ISSUE_STATE_REVIEWING' | 'AGGREGATE_ISSUE_STATE_FIXING' | 'AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP', enum — | value | description | |-------|---------------| | AGGREGATE_ISSUE_STATE_OPEN | | | AGGREGATE_ISSUE_STATE_FIXED | | | AGGREGATE_ISSUE_STATE_REMOVED | | | AGGREGATE_ISSUE_STATE_IGNORED_APP | | | AGGREGATE_ISSUE_STATE_IGNORED_CODE | | | AGGREGATE_ISSUE_STATE_UNKNOWN | | | AGGREGATE_ISSUE_STATE_REVIEWING | | | AGGREGATE_ISSUE_STATE_FIXING | | | AGGREGATE_ISSUE_STATE_PROVISIONALLY_IGNORED_APP | |
      - `createdAt` string, date-time
    - `remediation` ProtosAiV1Remediation
      - `issueId` string — The issue id that the remediation is for
      - `matchBasedId` string — The match based id of the issue that remediation is for
      - `autofix` ProtosAiV1Autofix
        - `id` string — The database id of the autofix
        - `fixCode` string — The code to fix the issue This is the entire code block that is already fixed
        - `fixDiff` string — The diff to fix the issue This is the diff to apply to the vulnerable code to fix the issue
        - `explanation` string — The explanation of the autofix The model may explain additional context about the autofix that it is unable to Fix inside the limitations of a single diff, e.g. changes in another file or environment variables
        - `url` string — The url to the autofix pr/mr comment
      - `guidance` ProtosAiV1Guidance
        - `id` string — The database id of the guidance
        - `summary` string — The summary of the guidance_text
        - `guidanceText` string — The step by step instructions on how to fix the issue
        - `memoryIdsUsed` string[] — The IDs of memories that were used to generate this guidance
    - `lastSeenScan` ProtosIssuesV1IssueScan
      - `id` string
      - `meta` object
    - `filePath` string — The path to the file in which this issue was found.
    - `line` integer — The first line number in which this issue was found.
    - `endLine` integer — The end line number in which this issue was found (if the offending code spans several lines).
    - `column` integer — The start column number within the line in which this issue was found.
    - `endColumn` integer — The end column number within the last line in which this issue was found (if applicable).
    - `severity` 'SEVERITY_HIGH' | 'SEVERITY_MEDIUM' | 'SEVERITY_LOW' | 'SEVERITY_CRITICAL', enum — The severity ("seriousness") of the issue. | value | description | |-------|---------------| | SEVERITY_HIGH | | | SEVERITY_MEDIUM | | | SEVERITY_LOW | | | SEVERITY_CRITICAL | |
    - `message` string — An optional message that helps describe the issue in more detail.
    - `rulePath` string — The full path of the rule used to generate this issue.
    - `confidence` 'CONFIDENCE_HIGH' | 'CONFIDENCE_MEDIUM' | 'CONFIDENCE_LOW', enum — The confidence in false-positive rate of an issue. | value | description | |-------|---------------| | CONFIDENCE_HIGH | | | CONFIDENCE_MEDIUM | | | CONFIDENCE_LOW | |
    - `ruleUrl` string — The url of the rule used to generate this issue.
    - `ruleReferences` string[] — A list of external references (URLs) which help describe or provide context for the rule used to generate this issue.
    - `ruleOrigin` 'RULE_ORIGIN_CUSTOM' | 'RULE_ORIGIN_COMMUNITY' | 'RULE_ORIGIN_PRO_RULES', enum — The origin of the rule (pro rules, semgrep community, or a custom rule) | value | description | |-------|---------------| | RULE_ORIGIN_CUSTOM | | | RULE_ORIGIN_COMMUNITY | | | RULE_ORIGIN_PRO_RULES | |
    - `ruleHashId` string — The hash of the associated rule.
    - `ruleCweNames` string[] — The names of the CWEs associated with this issue's rule.
    - `ruleOwaspNames` string[] — The names of the OWASP categories associated with this issue's rule.
    - `ruleset` string — The ruleset to which this issue's rule belongs (if applicable).
    - `policySlug` string — A slugified version of the associated rule's policy.
    - `category` string — The issue's category (or "other" if none).
    - `ruleSupersededBy` ProtosIssuesV1SupersededRule[] — A list of rules which supersede this issue's rule.
      - `product` 'RULE_TYPE_SAST' | 'RULE_TYPE_SCA' | 'RULE_TYPE_SECRETS', enum — | value | description | |-------|---------------| | RULE_TYPE_SAST | | | RULE_TYPE_SCA | | | RULE_TYPE_SECRETS | |
      - `rulePath` string
    - `issueType` 'ISSUE_TYPE_SAST' | 'ISSUE_TYPE_SCA' | 'ISSUE_TYPE_SECRETS' | 'ISSUE_TYPE_RESEARCH' | 'ISSUE_TYPE_AI_SAST', enum — The product which owns this issue, e.g. SAST (code), SCA (supply chain), etc. | value | description | |-------|---------------| | ISSUE_TYPE_SAST | Detected by Code rules | | ISSUE_TYPE_SCA | Detected by Supply Chain rules | | ISSUE_TYPE_SECRETS | Detected by Secrets rules | | ISSUE_TYPE_RESEARCH | Detected by research rules or scanners | | ISSUE_TYPE_AI_SAST | Detected by AI detection code scanning |
    - `issueParentId` string — Parent ID of the finding. Present for all types.
    - `ticketAttempts` ProtosTicketingV1TicketAttempt[] — The failed attempts at ticket creation
      - `attemptedAt` string, date-time — Date that the ticket was last attempted
      - `responseMessage` string — The (error) message returned when the attempt was made
    - `sastAttributes` ProtosIssuesV1IssueSastAttributes — Groups the fields of Issue that are specific to the SAST product
    - `scaAttributes` ProtosIssuesV1IssueScaAttributes — Groups the fields of Issue that are specific to the SCA product
      - `severity` 'SEVERITY_HIGH' | 'SEVERITY_MEDIUM' | 'SEVERITY_LOW' | 'SEVERITY_CRITICAL', enum — Severity of the SCA issue (TODO: reconcile this with the Issue.severity field, which *should* agree but doesn't necessarily agree yet) | value | description | |-------|---------------| | SEVERITY_HIGH | | | SEVERITY_MEDIUM | | | SEVERITY_LOW | | | SEVERITY_CRITICAL | |
      - `vulnDatabaseIdentifier` string — ID of the CVE or GHSA from upon which this SCA issue's rule is based
      - `reachability` 'REACHABILITY_CONDITIONALLY_REACHABLE' | 'REACHABILITY_ALWAYS_REACHABLE' | 'REACHABILITY_REACHABLE' | 'REACHABILITY_UNREACHABLE' | 'REACHABILITY_UNKNOWN', enum — SCA issue's reachability (whether the issue is reachable from the client's code and, if so, how) | value | description | |-------|---------------| | REACHABILITY_CONDITIONALLY_REACHABLE | | | REACHABILITY_ALWAYS_REACHABLE | | | REACHABILITY_REACHABLE | | | REACHABILITY_UNREACHABLE | | | REACHABILITY_UNKNOWN | |
      - `reachableCondition` string — For SCA issues which are conditionally reachable, this will store a human-readable description of the condition.
      - `cwes` string[] — Stands for "common weakness enumeration": a taxonomy for identifying the common sources of software flaws (e.g., buffer overflows, failure to check input data)
      - `foundDependency` ProtosIssuesV1ScaAttributesFoundDependency
        - `package` string — Name of the dependency's package
        - `version` string — The Version of the dependency
        - `transitivity` 'UNKNOWN_TRANSITIVITY' | 'TRANSITIVE' | 'DIRECT', enum — The transitivity (whether or not a dependency is directly imported into a project) of the dependency | value | description | |-------|---------------| | UNKNOWN_TRANSITIVITY | | | TRANSITIVE | | | DIRECT | |
        - `lockfileLineUrl` string — The URL (on the SCM) to the line in the lockfile at which the dependency is defined (might not exist if the dependency was surfaced in a non SCM context)
        - `filePath` string — The relative path (from the project root) to the lockfile in which the dependency is defined
        - `ecosystem` 'no_package_manager' | 'npm' | 'pypi' | 'gomod' | 'cargo' | 'maven' | 'gem' | 'composer' | 'nuget' | 'pub' | 'swiftpm' | 'hex' | 'cocoapods' | 'mix' | 'opam', enum — Package ecosystem (enum defined in sca/vi/sca.proto) to which the dependency belongs | value | description | |-------|---------------| | no_package_manager | | | npm | | | pypi | | | gomod | | | cargo | | | maven | | | gem | | | composer | | | nuget | | | pub | | | swiftpm | | | hex | | | cocoapods | | | mix | | | opam | |
        - `manifestFilePath` string — The relative path (from the project root) to the manifest file which defines the subproject which the dependency is part of
      - `fixRecommendations` ProtosIssuesV1ScaAttributesFixRecommendation[] — A list of Semgrep's dependency upgrade recommendations which would addressing the SCA issue's underlying rule.
        - `package` string
        - `version` string
      - `bestFix` ProtosIssuesV1ScaAttributesFixRecommendation
        - `package` string
        - `version` string
      - `epssScore` ProtosScaV1EpssScore — Represents a single "Exploit Prediction Scoring System" score (https://www.first.org/epss/)
        - `score` number, float
        - `percentile` number, float
        - `updatedAt` string, date-time
        - `categorization` 'EPSS_PROBABILITY_LOW' | 'EPSS_PROBABILITY_MEDIUM' | 'EPSS_PROBABILITY_HIGH' | 'EPSS_PROBABILITY_NONE', enum — | value | description | |-------|---------------| | EPSS_PROBABILITY_LOW | | | EPSS_PROBABILITY_MEDIUM | | | EPSS_PROBABILITY_HIGH | | | EPSS_PROBABILITY_NONE | |
      - `rulePublishDate` string, date-time — the date the associated rule was published
      - `scaRuleKind` 'SCA_RULE_KIND_REACHABLE' | 'SCA_RULE_KIND_UPGRADE_ONLY' | 'SCA_RULE_KIND_MALICIOUS_DEPENDENCY' | 'SCA_RULE_KIND_LEGACY', enum — SCA issue's kind (malicious, reachable, upgrade-only, etc.). Note that this repeats some information that is included in `reachability` and `transitivity`. TODO: consolidate with `reachability` and `transitivity` when we roll out TR for everyone. | value | description | |-------|---------------| | SCA_RULE_KIND_REACHABLE | | | SCA_RULE_KIND_UPGRADE_ONLY | | | SCA_RULE_KIND_MALICIOUS_DEPENDENCY | | | SCA_RULE_KIND_LEGACY | |
      - `scaMatchInfo` ProtosIssuesV1ScaAttributesScaMatchInfo
        - `matchKind` 'SCA_MATCH_KIND_LOCKFILE_ONLY' | 'SCA_MATCH_KIND_DIRECT_REACHABLE' | 'SCA_MATCH_KIND_DIRECT_UNREACHABLE' | 'SCA_MATCH_KIND_TRANSITIVE_REACHABLE' | 'SCA_MATCH_KIND_TRANSITIVE_UNREACHABLE' | 'SCA_MATCH_KIND_TRANSITIVE_UNDETERMINED', enum — | value | description | |-------|---------------| | SCA_MATCH_KIND_LOCKFILE_ONLY | | | SCA_MATCH_KIND_DIRECT_REACHABLE | | | SCA_MATCH_KIND_DIRECT_UNREACHABLE | | | SCA_MATCH_KIND_TRANSITIVE_REACHABLE | | | SCA_MATCH_KIND_TRANSITIVE_UNREACHABLE | | | SCA_MATCH_KIND_TRANSITIVE_UNDETERMINED | |
        - `analyzedPackages` ProtosIssuesV1ScaAttributesFoundDependency[]
          - `package` string — Name of the dependency's package
          - `version` string — The Version of the dependency
          - `transitivity` 'UNKNOWN_TRANSITIVITY' | 'TRANSITIVE' | 'DIRECT', enum — The transitivity (whether or not a dependency is directly imported into a project) of the dependency | value | description | |-------|---------------| | UNKNOWN_TRANSITIVITY | | | TRANSITIVE | | | DIRECT | |
          - `lockfileLineUrl` string — The URL (on the SCM) to the line in the lockfile at which the dependency is defined (might not exist if the dependency was surfaced in a non SCM context)
          - `filePath` string — The relative path (from the project root) to the lockfile in which the dependency is defined
          - `ecosystem` 'no_package_manager' | 'npm' | 'pypi' | 'gomod' | 'cargo' | 'maven' | 'gem' | 'composer' | 'nuget' | 'pub' | 'swiftpm' | 'hex' | 'cocoapods' | 'mix' | 'opam', enum — Package ecosystem (enum defined in sca/vi/sca.proto) to which the dependency belongs | value | description | |-------|---------------| | no_package_manager | | | npm | | | pypi | | | gomod | | | cargo | | | maven | | | gem | | | composer | | | nuget | | | pub | | | swiftpm | | | hex | | | cocoapods | | | mix | | | opam | |
          - `manifestFilePath` string — The relative path (from the project root) to the manifest file which defines the subproject which the dependency is part of
        - `transitiveMatches` ProtosIssuesV1ScaMatchInfoTransitiveMatch[]
          - `dependency` ProtosIssuesV1ScaAttributesFoundDependency
            - `package` string — Name of the dependency's package
            - `version` string — The Version of the dependency
            - `transitivity` 'UNKNOWN_TRANSITIVITY' | 'TRANSITIVE' | 'DIRECT', enum — The transitivity (whether or not a dependency is directly imported into a project) of the dependency | value | description | |-------|---------------| | UNKNOWN_TRANSITIVITY | | | TRANSITIVE | | | DIRECT | |
            - `lockfileLineUrl` string — The URL (on the SCM) to the line in the lockfile at which the dependency is defined (might not exist if the dependency was surfaced in a non SCM context)
            - `filePath` string — The relative path (from the project root) to the lockfile in which the dependency is defined
            - `ecosystem` 'no_package_manager' | 'npm' | 'pypi' | 'gomod' | 'cargo' | 'maven' | 'gem' | 'composer' | 'nuget' | 'pub' | 'swiftpm' | 'hex' | 'cocoapods' | 'mix' | 'opam', enum — Package ecosystem (enum defined in sca/vi/sca.proto) to which the dependency belongs | value | description | |-------|---------------| | no_package_manager | | | npm | | | pypi | | | gomod | | | cargo | | | maven | | | gem | | | composer | | | nuget | | | pub | | | swiftpm | | | hex | | | cocoapods | | | mix | | | opam | |
            - `manifestFilePath` string — The relative path (from the project root) to the manifest file which defines the subproject which the dependency is part of
          - `path` string
          - `line` string
      - `introducedBy` ProtosIssuesV1ScaAttributesIntroducingDependency[] — The distinct direct dependencies that introduced this transitive dependency. Empty for direct dependencies (not applicable).
        - `package` string
        - `version` string
    - `secretsAttributes` ProtosIssuesV1IssueSecretsAttributes — Groups the fields of Issue that are specific to the Secrets product
      - `validationState` 'VALIDATION_STATE_CONFIRMED_VALID' | 'VALIDATION_STATE_CONFIRMED_INVALID' | 'VALIDATION_STATE_VALIDATION_ERROR' | 'VALIDATION_STATE_NO_VALIDATOR', enum — | value | description | |-------|---------------| | VALIDATION_STATE_CONFIRMED_VALID | | | VALIDATION_STATE_CONFIRMED_INVALID | | | VALIDATION_STATE_VALIDATION_ERROR | | | VALIDATION_STATE_NO_VALIDATOR | |
      - `secretType` string
      - `historicalInfo` ProtosSecretsV1HistoricalInfo
        - `gitCommit` string — Git commit at which the finding is present. Used by "historical" scans, which scan non-HEAD commits in the git history. Relevant for finding, e.g., secrets which are buried in the git history which we wouldn't find at HEAD
        - `gitCommitTimestamp` string, date-time
        - `gitBlob` string — Git blob at which the finding is present. Sent in addition to the commit since some SCMs have permalinks which use the blob sha, so this information is useful when generating links back to the SCM.
    - `subcategories` string[] — The issue's subcategories
    - `refUrl` string — The URL of the specific commit which introduced this issue. Only available when fetching a single issue at a time via the GetIssue RPC.
    - `codeowners` ProtosAiV1Codeowner[]
      - `id` string
      - `name` string
      - `isTeam` boolean
      - `members` ProtosAiV1Codeowner[]
    - `codeSnippets` ProtosIssuesV1IssueCodeSnippet[] — The content of files involved in this issue. Only available when fetching a single issue at a time via the GetIssue RPC.
      - `path` string
      - `content` string
    - `ruleExplanation` ProtosAiV1RuleExplanation — RuleExplanation contains AI-generated explanations for why a rule flagged specific code
      - `id` string — The database id of the rule explanation
      - `summary` string — A concise summary of the rule explanation
      - `explanation` string — The full detailed explanation of why this rule flagged the code
    - `ruleDisplayName` string — The human-readable display name of the rule (e.g., "Hardcoded secret"). Only available when fetching a single issue at a time via the GetIssue RPC.
    - `clickToFixPrUrl` string — The URL of the Click-to-Fix PR that was opened to fix this issue (if any). Available in the GetIssue RPC and in list responses that opt into it.
    - `aiImpact` string — AI Detection only: LLM-generated description of the vulnerability's impact. Only available when fetching a single issue at a time via the GetIssue RPC.
    - `aiExploitConditions` ProtosAiV1ExploitCondition[] — AI Detection only: Conditions that must be true for the vulnerability to be exploitable. Only available when fetching a single issue at a time via the GetIssue RPC.
      - `description` string — Plain english description of the step
      - `confirmed` boolean — Whether the LLM was able to confirm this condition is met
    - `clickToFixCommitMsg` string — The commit message for the Click-to-Fix PR (if any). Only available when fetching a single issue at a time via the GetIssue RPC.
    - `exceptionRequest` ProtosIssuesV1IssueExceptionRequestSummary — A summary of the exception request state for a finding, shaped for the findings list UI. Only returned when include_exception_request_info is true.
      - `exceptionState` 'FINDING_EXCEPTION_REQUEST_STATE_REQUESTED' | 'FINDING_EXCEPTION_REQUEST_STATE_APPROVED' | 'FINDING_EXCEPTION_REQUEST_STATE_REJECTED', enum — Current state of the exception request. | value | description | |-------|---------------| | FINDING_EXCEPTION_REQUEST_STATE_REQUESTED | | | FINDING_EXCEPTION_REQUEST_STATE_APPROVED | | | FINDING_EXCEPTION_REQUEST_STATE_REJECTED | |
      - `requesterLogin` string — Login of the user who submitted the request. Absent if created programmatically.
      - `requesterNote` string — Note provided by the requester.
      - `requesterTriageReason` 'FINDING_TRIAGE_REASON_FALSE_POSITIVE' | 'FINDING_TRIAGE_REASON_NO_TIME' | 'FINDING_TRIAGE_REASON_ACCEPTABLE_RISK' | 'FINDING_TRIAGE_REASON_NO_TRIAGE_REASON' | 'FINDING_TRIAGE_REASON_UNKNOWN' | 'FINDING_TRIAGE_REASON_DUPLICATE', enum — Triage reason provided by the requester. | value | description | |-------|---------------| | FINDING_TRIAGE_REASON_FALSE_POSITIVE | | | FINDING_TRIAGE_REASON_NO_TIME | | | FINDING_TRIAGE_REASON_ACCEPTABLE_RISK | | | FINDING_TRIAGE_REASON_NO_TRIAGE_REASON | | | FINDING_TRIAGE_REASON_UNKNOWN | | | FINDING_TRIAGE_REASON_DUPLICATE | |
      - `requesterActionSource` 'FINDING_EXCEPTION_REQUEST_SOURCE_SCM_COMMENT' | 'FINDING_EXCEPTION_REQUEST_SOURCE_SEMGREP_APPSEC_PLATFORM' | 'FINDING_EXCEPTION_REQUEST_SOURCE_API', enum — Source system that originated the request. | value | description | |-------|---------------| | FINDING_EXCEPTION_REQUEST_SOURCE_SCM_COMMENT | | | FINDING_EXCEPTION_REQUEST_SOURCE_SEMGREP_APPSEC_PLATFORM | | | FINDING_EXCEPTION_REQUEST_SOURCE_API | |
      - `reviewerLogin` string — Login of the reviewer. Only populated when exception_state is APPROVED or REJECTED.
      - `requestId` string — Unique identifier for this exception request.
      - `reviewId` string — Unique identifier for this exception review.
      - `issueId` string — ID of the issue this exception request applies to.
      - `createdAt` string, date-time — The timestamp when the exception request was created.
      - `reviewedAt` string, date-time — When the exception request was last reviewed.
    - `clickToFixPrId` string — The SCM-agnostic PR identifier for the Click-to-Fix PR (if any). Available in the GetIssue RPC and in list responses that opt into it. Prefer this over parsing the PR number from click_to_fix_pr_url.
    - `triagePermission` 'TRIAGE_PERMISSION_IGNORE' | 'TRIAGE_PERMISSION_REQUEST' | 'TRIAGE_PERMISSION_NONE', enum — The triage permission for this issue: whether a developer may ignore it themselves, must request an exception, or cannot triage it at all. Only defined when the developer approvals feature is enabled. | value | description | |-------|---------------| | TRIAGE_PERMISSION_IGNORE | | | TRIAGE_PERMISSION_REQUEST | | | TRIAGE_PERMISSION_NONE | |
    - `isArchived` boolean — True if this finding's project is archived (Semgrep-initiated via is_semgrep_archived, or SCM-archived).
  - `cursor` string
  - `total` integer
  - `totalCode` integer
  - `totalSca` integer
  - `totalSecrets` integer

---

[API](https://skmtc.net/semgrep/apis/semgrep-web-app.md) · [All operations](https://skmtc.net/semgrep/apis/semgrep-web-app/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/semgrep/semgrep-web-app/versions/6483eeecd582/schema)