---
title: "List attack path findings"
method: GET
path: "/api/v2/attack-paths/findings"
tags: ["Attack Paths", "Enterprise"]
---

# List attack path findings

`GET /api/v2/attack-paths/findings`

Returns a unified, paginated list of attack path findings. Defaults to active findings of both relationship and list types unless filtered otherwise.

## Query parameters

- `sort_by` string — Sort by column. Can be used multiple times; prepend a hyphen for descending order. See parameter description for details about which columns are sortable.
- `severity` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `finding_type` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `finding` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `title` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `platform` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `environment_id` string[]
- `environment_name` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `asset_group_tag_id` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `zone_name` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `source_principal_id` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `source_principal_kind` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `source_principal_name` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `target_principal_id` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `target_principal_kind` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `target_principal_name` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `status` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `first_seen` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `last_seen` string — Filter results by column string value. Valid filter predicates are `eq`, `~eq`, `neq`.
- `skip` integer — The number of items to skip in a paginated response.
- `limit` integer — The limit of results requested by the client.

## Response `200`

OK

- object
  - `count` integer — The total number of results.
  - `skip` integer — The number of items to skip in a paginated response.
  - `limit` integer — The limit of results requested by the client.
  - `data` object[]
    - `severity` 'critical' | 'high' | 'moderate' | 'low' — Severity level.
    - `finding_type` 'relationship' | 'list' — The type of finding.
    - `finding` string — Finding name.
    - `title` string — Human-readable finding title. May vary based on the zone context (e.g., "Tier Zero" vs "Privilege Zone" variants).
    - `platform` string — Platform the finding belongs to.
    - `environment_id` string — Environment identifier.
    - `environment_name` string — Human-readable environment display name resolved from the graph. Falls back to environment_id when unavailable.
    - `asset_group_tag_id` integer — Asset group tag identifier.
    - `zone_name` string — Human-readable zone name. Empty when the finding is not tied to a named zone.
    - `source_principal_id` string — Source principal identifier. Omitted for list findings.
    - `source_principal_kind` string — Source principal kind. Omitted for list findings.
    - `source_principal_name` string — Source principal display name resolved from principal properties. Empty when unavailable or for list findings.
    - `target_principal_id` string — Target principal identifier.
    - `target_principal_kind` string — Target principal kind.
    - `target_principal_name` string — Target principal display name resolved from principal properties. Empty when unavailable.
    - `status` 'active' | 'accepted' | 'remediated' | 'deprecated' | 'orphaned' — Finding status.
    - `first_seen` string, date-time — Timestamp of when the finding was first created.
    - `last_seen` string, date-time — Timestamp of last update.

## Other responses

- `400` — **Bad Request** This could be due to one of the following reasons: - JSON payload is missing or malformed - Path or query parameters are missing or invalid/malformed - The data sent is not valid (ex- sending a `string` in an `integer` field)
- `401` — **Unauthorized** This endpoint failed an authentication requirement. Either the client tried to access a protected endpoint without being authenticated, or an auth validation failed (ex- invalid credentials or expired token).
- `403` — **Forbidden** This is most commonly caused by an authenticated client trying to access a resource that it does not have permission for.
- `404` — **Not Found** This error typically comes from operations where a valid ID was passed to the request to look up an entity but the entity could not be found.
- `429` — **Too Many Requests** The client has sent too many requests within a certain time window and tripped the rate limiting middleware.
- `500` — **Internal Server Error** This is usually the result of either an unexpected database or application error. The client may try modifying or resending the request, but the error is likely not related to the client doing something wrong.

---

[API](https://skmtc.net/specterops/apis/bloodhound-api.md) · [All operations](https://skmtc.net/specterops/apis/bloodhound-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/specterops/bloodhound-api/revisions/b7bbf50b77e7/schema)