v1

latestOpenAPI 3.0.32026-07-22238629559.2 KB

FindingsService

List code, supply chain, or AI-powered scan findings

Request the list of code, supply chain, or AI-powered scan findings in an organization, paginated in pages of 100 entries and limited by the since timestamp. Findings are returned by relevant_since descending (see since in the Query Parameters list). Examples: List SAST findings with pagination, List SCA findings since timestamp, List AI-powered scan findings, List findings with filters.

get/api/v1/deployments/{deploymentSlug}/findings

Path parameters

deploymentSlugstring required

Slug of the deployment name. Can be found at /deployments, or in your Settings in the web UI.

Example:your-deployment

Query parameters

issue_type'sast' | 'sca' | 'ai_sast'

Type of findings to return. If not specified, returns sast (Code) findings. Can be sast (Code), sca (Supply Chain), or ai_sast (AI-powered scan). Valid values: sast, sca, ai_sast

Example:sca

sincenumber double

What timestamp should the results start at? If not specified, returns results from all timestamps. Provide epoch timestamp in seconds. Filters using the relevant_since field: the timestamp when this finding was detected by Semgrep (the first time, or when reintroduced).

Example:1636942398.45

pageinteger

Which page of the results do you require? If not specified, returns first page. Pages are numbered from zero (0).

Example:1

dedupboolean

Deduplicates findings across all your refs/branches if true. If not specified, returns all findings across all refs/branches without deduplicating them. Set this to true if you are not filtering for a particular set of refs/branches in order to match the counts listed in the Semgrep UI.

Example:true

page_sizeinteger

Maximum number of records per returned page. If not specified, defaults to 100 records. Minimum: 100, Maximum: 3000

Example:100

reposstring[]

Which repositories (by name) do you want to include? If not specified, includes all.

[
  "myorg/repo1",
  "myorg/repo2"
]

repository_idsinteger[]

Which repositories (by ID) do you want to include? If not specified, includes all.

[
  1,
  2,
  3
]

Which status do you want to include? If not specified, includes all statuses. Findings in the removed state are always excluded from this endpoint. Valid values: open, fixed, ignored, reviewing, fixing, provisionally_ignored

Example:open

triage_reasonsstring[]

Which triage reasons do you want to include? If not specified, includes all. This filter is applicable when status is ignored. Valid values: acceptable_risk, false_positive, no_time, no_triage_reason, duplicate

[
  "acceptable_risk",
  "false_positive"
]

severitiesstring[]

What severities of issues do you want to include? If not specified, returns all. Valid values: low, medium, high, critical

[
  "low",
  "high"
]

refstring

Which ref (branch) do you want to filter for?

Example:refs/pull/1234/merge

policiesstring[]

Which policy modes do you want to include? If not specified, includes all. Monitor: rule-board-audit, Comment: rule-board-pr-comments, Block: rule-board-block. This filter is applicable when issue_type is sast or unspecified.

[
  "rule-board-block",
  "rule-board-pr-comments",
  "rule-board-audit"
]

rulesstring[]

Which rule names do you want to include? If not specified, includes all. This filter is applicable when issue_type is sast or unspecified.

[
  "typescript.react.security.audit.react-no-refs.react-no-refs",
  "ajinabraham.njsscan.hardcoded_secrets.node_username"
]

categoriesstring[]

Which categories of findings do you want to include? If not specified, includes all. This filter is applicable when issue_type is sast or unspecified.

[
  "security",
  "correctness",
  "caching"
]

confidence'low' | 'medium' | 'high'

Which rule confidence level do you want to include? If not specified, includes all. This filter is applicable when issue_type is sast or unspecified. Valid values: low, medium, high

Example:high

autotriage_verdict'true_positive' | 'false_positive'

Which autotriage verdict do you want to include? If not specified, includes all. This filter is applicable when issue_type is sast or unspecified. Valid values: true_positive, false_positive

Example:true_positive

component_tagsstring[]

Which component tags do you want to include? If not specified, includes all.

[
  "user authentication",
  "user data"
]

exposuresstring[]

List of exposures or reachability types to filter by. If not specified, returns findings across all exposures. This filter is applicable when issue_type=sca is specified. Valid values: reachable, always_reachable, conditionally_reachable, unreachable, unknown

[
  "reachable",
  "always_reachable"
]

transitivitiesstring[]

List of transitivities to filter by. If not specified, returns all transitivities. This filter is applicable when issue_type=sca is specified. Valid values: direct, transitive, unknown

[
  "transitive"
]

is_maliciousboolean

Filter SCA findings by whether they are from malicious dependencies. If not specified, returns all SCA findings. This filter is only applicable when issue_type=sca is specified.

true: Returns only findings from malicious dependencies
false: Returns only findings from all other reachabilities (reachable in code, always reachable, conditionally reachable, etc.)

Example:true

click_to_fix_pr_statestring[]

Filter findings by Click-to-Fix PR state. If not specified, returns all findings regardless of autofix PR status. This filter applies to both sast and sca issue types. Valid values: open, merged

[
  "open",
  "merged"
]

Response

Example response

{
  "findings": [
    {
      "assistant": {
        "autofix": {
          "fix_code": "cookie.setHttpOnly(true);\\nresponse.addCookie(cookie);"
        },
        "autotriage": {
          "reason": "The matched code is used for a non-security related feature.",
          "verdict": "false_positive"
        },
        "component": {
          "risk": "high",
          "tag": "user data"
        },
        "guidance": {
          "summary": "Use a template rendering engine such as EJS instead of string concatenation."
        },
        "rule_explanation": {
          "explanation": "This code is vulnerable to SQL injection because user input from the `username` parameter is directly concatenated into the SQL query string without sanitization or parameterization.",
          "summary": "User input directly concatenated into SQL query"
        }
      },
      "categories": [
        "security"
      ],
      "click_to_fix_failures": [
        {
          "created_at": "2024-01-15T10:30:00.000Z",
          "reason": "merge conflict in target branch"
        }
      ],
      "click_to_fix_prs": [
        {
          "created_at": "2024-01-15T10:30:00.000Z",
          "url": "https://github.com/myorg/myrepo/pull/123"
        }
      ],
      "confidence": "medium",
      "created_at": "2020-11-18T23:28:12.391Z",
      "external_ticket": {
        "external_slug": "OPS-158"
      },
      "first_seen_scan_id": 1234,
      "id": 1234567,
      "line_of_code_url": "https://github.com/semgrep/semgrep/blob/39f95450a7d4d70e54c9edbd109bed8210a36889/src/core_cli/Core_CLI.ml#L1",
      "location": {
        "column": 8,
        "end_column": 16,
        "end_line": 124,
        "file_path": "frontend/src/corpComponents/Code.tsx",
        "line": 120
      },
      "match_based_id": "0f8c79a6f7e0ff2f908ff5bc366ae1548465069bae8892088051e1c3b4b12c6b8df37d5bcbb181eb868aa79f81f239d14bf2336d552786ab8ccdc7279adf07a6_1",
      "ref": "refs/pull/1234/merge",
      "relevant_since": "2020-11-18T23:28:12.391Z",
      "repository": {
        "name": "semgrep",
        "url": "https://github.com/semgrep/semgrep"
      },
      "review_comments": [
        {
          "external_discussion_id": "af04762b69acfb74c8f9"
        }
      ],
      "rule": {
        "category": "security",
        "confidence": "high",
        "cwe_names": [
          "CWE-319: Cleartext Transmission of Sensitive Information"
        ],
        "message": "This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible.",
        "name": "html.security.plaintext-http-link.plaintext-http-link",
        "owasp_names": [
          "A03:2017 - Sensitive Data Exposure",
          "A02:2021 - Cryptographic Failures"
        ],
        "subcategories": [
          "vuln"
        ],
        "vulnerability_classes": [
          "Mishandled Sensitive Information"
        ]
      },
      "rule_name": "typescript.react.security.audit.react-no-refs.react-no-refs",
      "severity": "medium",
      "sourcing_policy": {
        "id": 120,
        "name": "Default Policy",
        "slug": "default-policy"
      },
      "state": "unresolved",
      "state_updated_at": "2020-11-19T23:28:12.391Z",
      "status": "open",
      "syntactic_id": "440eeface888e78afceac3dc7d4cc2cf",
      "triage_comment": "This finding is from the test repo",
      "triage_reason": "acceptable_risk",
      "triage_state": "untriaged",
      "triaged_at": "2020-11-19T23:28:12.391Z"
    }
  ]
}