---
title: "List scan result alerts"
method: GET
path: "/api/v1/scan/{scanId}/alerts"
tags: ["Scan Results"]
---

# List scan result alerts

`GET /api/v1/scan/{scanId}/alerts`

## List Scan Alerts

Lists the scan alerts associated with this scan.

A scan that has found vulnerabilities will report each finding by the HSTE Plugin that produced that finding.

An alert can be triggered multiple times, from different url paths. The pluginId associated with an alert is unique per HSTE plugin.

Scan Alerts are returned paginated and can be requested with the pagination parameters.

### Application Alert

Calling this endpoint with a given `scanId` _returns an array of one_ `applicationScanResults` object corresponding with that scan.
This `applicationScanResults` object will also include the populated `applicationAlerts field`, which is the paginated results of Scan alerts found in that scan.

The `applicationAlerts` also includes the pluginId identifying the Alert that triggered the scan.

Meaningful scan findings (also known as Alerts) contextual to a run of HawkScan.

| Parameter | Default | Description |
|:---:|:---:|:---:|
|scan|{}|The underlying scan this alert was found in.|
|pluginId|""|The id of the Zap plugin that triggered this alert.|
|name|""|The name of the Zap plugin this alert triggered for.|
|description|""|A markdown flavored description of this alert.|
|severity|""|The severity of this finding. One of "High" "Medium" or "Low".|
|references|[]|External urls and study references to understand this findings.|
|uriCount|0|The number of scanned urls that report this alert.|
|alertStatusStats|[]|Statistical snapshot of alerts by status.|
|externalAlertsResult|[]|External findings associated with this alert.|
|cweId|""|The cwe id of this alert.|

The `scan` field is available from the `applicationScanResults` object, but is not populated on the `applicationAlert`.
Each `applicationAlert` includes a `pluginId`, which can be used to list the application alert findings.

See the [Scan Results Analysis](https://apidocs.stackhawk.com/docs/scan-results-analysis) guide for further details on how to use these endpoints.


> Requires `read:scan` permission.

## Path parameters

- `scanId` string, uuid, required

## Query parameters

- `pageSize` integer
- `pageToken` integer
- `sortField` 'id' | 'name'
- `sortDir` 'asc' | 'desc'

## Response `200`

Paginated response of scan alerts.

- ApplicationListApplicationAlertsResponse — Paginated response of scan alerts.
  - `applicationScanResults` ApplicationApplicationScanResult[] — found application scan alerts.
    - `alertStats` ApplicationScanAlertStats — A summary of alert statistics from a run of HawkScan.
      - `alertStatusStats` ApplicationAlertStatusStats[] — Statistics for findings of this scan by severity and triage status.
        - `alertStatus` 'UNKNOWN' | 'FALSE_POSITIVE' | 'RISK_ACCEPTED' | 'PROMOTED' | 'ADD_COMMENT' — Triage status of this scan alert.
        - `severityStats` object — A map of finding counts by severity ("High" "Medium" "Low")
        - `totalCount` integer — Total number of findings on paths
      - `totalAlerts` integer — The total number of findings from the scan.
      - `uniqueAlerts` integer — The total number of unique findings across all paths in the scan.
    - `appHost` string — The scanned host endpoint.
    - `applicationAlerts` ApplicationApplicationAlert[] — Scan findings contextual to this application and run of HawkScan.
      - `alertStatusStats` ApplicationAlertStatusStats[] — Statistical snapshot of alerts by status.
        - `alertStatus` 'UNKNOWN' | 'FALSE_POSITIVE' | 'RISK_ACCEPTED' | 'PROMOTED' | 'ADD_COMMENT' — Triage status of this scan alert.
        - `severityStats` object — A map of finding counts by severity ("High" "Medium" "Low")
        - `totalCount` integer — Total number of findings on paths
      - `cweId` string — The cwe id of this alert.
      - `description` string — A markdown flavored description of this alert.
      - `externalAlertsResult` SastExternalAlertsResult[] — External findings associated with this alert.
        - `externalAlerts` SastExternalAlert[]
          - `codeRegion` SastCodeRegion
            - `endColumn` integer
            - `endLine` integer
            - `startColumn` integer
            - `startLine` integer
          - `codeSnippet` SastCodeSnippet
            - `lines` SastCodeLine[]
              - …
          - `cweId` string
          - `description` string
          - `filePath` string
          - `fileUrl` string
          - `id` string
          - `integrationType` 'UNKNOWN' | 'SLACK' | 'JIRA' | 'DATADOG' | 'MSTEAMS' | 'WEBHOOK' | 'JIRA_SERVER' | 'SNYK' | 'GITHUB' | 'MERGE_AZURE_DEVOPS_BOARDS' | 'VANTA' | 'AZURE_DEVOPS' | 'BITBUCKET' | 'GITLAB' | 'EMAIL' | 'GITHUB_ENTERPRISE' | 'GITLAB_SELF_HOSTED' | 'BITBUCKET_SELF_HOSTED' | 'AZURE_DEVOPS_SELF_HOSTED' | 'SEMGREP' | 'ENDOR_LABS' | 'WIZ'
          - `issueUrl` string
          - `origin` 'UNKNOWN' | 'GITHUB' | 'GITLAB' | 'AZURE_REPOS' | 'BITBUCKET' | 'SEMGREP' | 'ENDOR_LABS'
          - `severity` string
          - `title` string
        - `integrationType` 'UNKNOWN' | 'SLACK' | 'JIRA' | 'DATADOG' | 'MSTEAMS' | 'WEBHOOK' | 'JIRA_SERVER' | 'SNYK' | 'GITHUB' | 'MERGE_AZURE_DEVOPS_BOARDS' | 'VANTA' | 'AZURE_DEVOPS' | 'BITBUCKET' | 'GITLAB' | 'EMAIL' | 'GITHUB_ENTERPRISE' | 'GITLAB_SELF_HOSTED' | 'BITBUCKET_SELF_HOSTED' | 'AZURE_DEVOPS_SELF_HOSTED' | 'SEMGREP' | 'ENDOR_LABS' | 'WIZ'
        - `isAllExternalAlerts` boolean
        - `projectUrl` string
      - `name` string — The name of the Zap plugin this alert triggered for.
      - `pluginId` string — The id of the Zap plugin that triggered this alert.
      - `references` string[] — External urls and study references to understand this findings.
      - `requestMethod` string — **Deprecated** - 4/25/22
      - `scan` ScanresultsScan — Represents the core elements of a single HawkScan run. Finished scans will include ScanResults, including alerts of findings contextual to the scanned application. The Scan also represents its current operational state (STARTED / COMPLETED / ERROR). For more information, see [Scans](https://docs.stackhawk.com/web-app/scans.html).
        - `applicationId` string — the UUID applicationId corresponding to the scanned application
        - `applicationName` string — the name of the corresponding scanned application
        - `env` string — the name of the scanned environment
        - `envId` string — the UUID environmentId corresponding to the scanned environment
        - `externalUserId` string — the UUID identifier of the StackHawk user that started this scan
        - `hawkScanType` 'HAWKSCAN_TYPE_SCAN' | 'HAWKSCAN_TYPE_FLIGHTPATH' | 'HAWKSCAN_TYPE_HOSTED' | 'HAWKSCAN_TYPE_CONFIGURATION' — The type of HawkScan execution (traditional, hosted, etc.)
        - `id` string — the UUID identifier of this scan
        - `metadata` ScanresultsMetaData
          - `tags` object
        - `parentScanId` string — If this scan is a result of a retest, this is the id of the scan it retested
        - `repoId` string — a hash of the scanned repo git name
        - `status` 'UNKNOWN' | 'COMPLETED' | 'ERROR' | 'STARTED' — the current state of the running scan (STARTED / COMPLETED / ERROR)
        - `timestamp` integer — seconds since unix epoch timestamp of when the scan was started
        - `version` string — the version of HawkScan used to scan this application
      - `severity` string — The severity of this finding. One of "High" "Medium" or "Low".
      - `uriCount` integer — The number of scanned urls that report this alert.
    - `configHash` string — A hash of the configuration used for this run of HawkScan.
    - `externalAlertStats` SastExternalAlertStats[] — External finding statistics contextual to this scan result.
      - `integrationType` 'UNKNOWN' | 'SLACK' | 'JIRA' | 'DATADOG' | 'MSTEAMS' | 'WEBHOOK' | 'JIRA_SERVER' | 'SNYK' | 'GITHUB' | 'MERGE_AZURE_DEVOPS_BOARDS' | 'VANTA' | 'AZURE_DEVOPS' | 'BITBUCKET' | 'GITLAB' | 'EMAIL' | 'GITHUB_ENTERPRISE' | 'GITLAB_SELF_HOSTED' | 'BITBUCKET_SELF_HOSTED' | 'AZURE_DEVOPS_SELF_HOSTED' | 'SEMGREP' | 'ENDOR_LABS' | 'WIZ'
      - `projectUrl` string
    - `metadata` ScanresultsMetaData
      - `tags` object
    - `percentComplete` integer — Indicates completeness of a STARTED scan in the scan list. ERROR and COMPLETED scans report 100.
    - `policyName` string — Named scan policy used for this run of HawkScan.
    - `scan` ScanresultsScan — Represents the core elements of a single HawkScan run. Finished scans will include ScanResults, including alerts of findings contextual to the scanned application. The Scan also represents its current operational state (STARTED / COMPLETED / ERROR). For more information, see [Scans](https://docs.stackhawk.com/web-app/scans.html).
      - `applicationId` string — the UUID applicationId corresponding to the scanned application
      - `applicationName` string — the name of the corresponding scanned application
      - `env` string — the name of the scanned environment
      - `envId` string — the UUID environmentId corresponding to the scanned environment
      - `externalUserId` string — the UUID identifier of the StackHawk user that started this scan
      - `hawkScanType` 'HAWKSCAN_TYPE_SCAN' | 'HAWKSCAN_TYPE_FLIGHTPATH' | 'HAWKSCAN_TYPE_HOSTED' | 'HAWKSCAN_TYPE_CONFIGURATION' — The type of HawkScan execution (traditional, hosted, etc.)
      - `id` string — the UUID identifier of this scan
      - `metadata` ScanresultsMetaData
        - `tags` object
      - `parentScanId` string — If this scan is a result of a retest, this is the id of the scan it retested
      - `repoId` string — a hash of the scanned repo git name
      - `status` 'UNKNOWN' | 'COMPLETED' | 'ERROR' | 'STARTED' — the current state of the running scan (STARTED / COMPLETED / ERROR)
      - `timestamp` integer — seconds since unix epoch timestamp of when the scan was started
      - `version` string — the version of HawkScan used to scan this application
    - `scanDuration` integer — Time in seconds the scan took to run.
    - `scanErrors` ScanresultsErrorScan[] — Errors encountered from this run of HawkScan.
      - `category` string — category of error identified in the scan
      - `created` integer — seconds since unix epoch of when the errorScan was found
      - `error` string — a short message of the exception that occurred running HawkScan
      - `errorDetail` string — expanded details and stacktrace surrounding the thrown exception in HawkScan
      - `rawConf` string — the raw HawkScan configuration string, employed when this error occurred
    - `scanProgress` ScanresultsScanProgress — Scan progress instance object.
      - `globalStats` object
      - `plugins` ScanresultsPluginProgress[]
        - `alertCount` integer
        - `durationMillis` integer
        - `messageCount` integer
        - `numberRequests` integer
        - `pluginId` string
        - `pluginName` string
        - `progress` integer
        - `skippedReason` string
        - `status` 'UNKNOWN' | 'PENDING' | 'RUNNING' | 'COMPLETED' | 'SKIPPED'
      - `scanId` string
      - `siteStats` object
    - `severityStats` object — Recordings of scan counts made by severity and statistic.
    - `tags` HawkscanTag[] — Any tags associated with this scan result.
      - `name` string — The keyword name.
      - `value` string — An arbitrary value to associate with the keyword.
    - `timestamp` integer — Seconds since unix epoch time of when this was run.
    - `urlCount` integer — The number of urls scanned.
  - `nextPageToken` string — pageToken to provide for the next page of results.
  - `totalCount` integer — total number of results.

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.net/stackhawk/apis/stackhawk-public-api.md) · [All operations](https://skmtc.net/stackhawk/apis/stackhawk-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stackhawk/stackhawk-public-api/revisions/ad3dfd54cb63/schema)