---
title: "List scan result alert findings"
method: GET
path: "/api/v1/scan/{scanId}/alert/{pluginId}"
tags: ["Scan Results"]
---

# List scan result alert findings

`GET /api/v1/scan/{scanId}/alert/{pluginId}`

## List Scan Alert Findings

Get the specific scan findings associated with this scan and plugin.

This endpoint reports details of the Alert that was triggered from a scan, with details on how to address it and the scanned application paths that triggered the alert.

Scan Alerts by plugin return paginated results of the `applicationScanAlertUri`.

### Alert Response

Calling this endpoint with a given `scanId` and `pluginId` returns an `alertResponse` object. This alert contains the paginated `applicationAlertUris`, identifying each path in the scanned host that triggered this alert.

Paginated response of the scan alert and paths associated with this finding.

| Parameter | Default | Description |
|:---:|:---:|:---:|
|alert|{}|The meaningful scan alert _finding_.|
|category|""|The category of this finding.|
|applicationScanAlertUris|[]|Path uris that triggered this alert.|
|cheetsheet|""|external url to an OWASP cheatsheet for reference.|
|appHost|""|The host URI this alert was triggered for.|
|isEachRuleLocked|false|if the scan alert and uris cannot be triaged within the StackHawk Platform.|
|nextPageToken|""|pageToken to provide for the next page of results.|
|totalCount|0|total number of results.|

### Application Alert Uri

Represents a meaningful path-level finding in a scanned application.

| Parameter | Default | Description |
|:---:|:---:|:---:|
|scan|{}|The underlying scan this application alert URI was found in.|
|pluginId|""|The id of the StackHawk/ZAP plugin that triggered this alert application alert URI.|
|uri|""|The URI of the path in the scanned application.|
|msgId|""|A unique identifier of the individual request/response pair that triggered this Alert.|
|requestMethod|""|The HTTP method used to find this path.|
|status|"UNKNOWN"|The Triaged status of this application alert.|
|matchedRuleNote|""|Message from the last time this alert was triaged.|
|matchedRuleLastUpdated|0|Timestamp of the last time this alert was updated.|
|appUriId|""|Unique identifier for this app x uri|
|alertUriId|""|Unique identifier for this alert x uri|
|matchedRuleUserId|""|The last user who triaged this alert.|
|ruleHistories|[]|The triage history of this application alert.|
|statusLink|""|Optional URL of external promotion tool linked to triaged alert.|
|findingHash|""|The SHA-256 finding hash — a stable identifier for this finding across scans.|

See the [Scan Results Analysis](https://apidocs.stackhawk.com/docs/scan-results-analysis) guide for further details on how to use these endpoints.


> Requires `read:scan` permission.

## Path parameters

- `scanId` string, uuid, required
- `pluginId` string, required

## Query parameters

- `pageSize` integer
- `pageToken` integer

## Response `200`

Paginated response of the scan alert and paths associated with this finding.

- ApplicationAlertResponse — Paginated response of the scan alert and paths associated with this finding.
  - `alert` ApplicationApplicationAlert — Meaningful scan findings (also known as Alerts) contextual to a run of HawkScan.
    - `alertStatusStats` ApplicationAlertStatusStats[] — Statistical snapshot of alerts by status.
      - `alertStatus` 'UNKNOWN' | 'FALSE_POSITIVE' | 'RISK_ACCEPTED' | 'PROMOTED' | 'ADD_COMMENT' — Triage status of this scan alert.
      - `severityStats` object — A map of finding counts by severity ("High" "Medium" "Low")
      - `totalCount` integer — Total number of findings on paths
    - `cweId` string — The cwe id of this alert.
    - `description` string — A markdown flavored description of this alert.
    - `externalAlertsResult` SastExternalAlertsResult[] — External findings associated with this alert.
      - `externalAlerts` SastExternalAlert[]
        - `codeRegion` SastCodeRegion
          - `endColumn` integer
          - `endLine` integer
          - `startColumn` integer
          - `startLine` integer
        - `codeSnippet` SastCodeSnippet
          - `lines` SastCodeLine[]
            - `number` integer
            - `text` string
        - `cweId` string
        - `description` string
        - `filePath` string
        - `fileUrl` string
        - `id` string
        - `integrationType` 'UNKNOWN' | 'SLACK' | 'JIRA' | 'DATADOG' | 'MSTEAMS' | 'WEBHOOK' | 'JIRA_SERVER' | 'SNYK' | 'GITHUB' | 'MERGE_AZURE_DEVOPS_BOARDS' | 'VANTA' | 'AZURE_DEVOPS' | 'BITBUCKET' | 'GITLAB' | 'EMAIL' | 'GITHUB_ENTERPRISE' | 'GITLAB_SELF_HOSTED' | 'BITBUCKET_SELF_HOSTED' | 'AZURE_DEVOPS_SELF_HOSTED' | 'SEMGREP' | 'ENDOR_LABS' | 'WIZ'
        - `issueUrl` string
        - `origin` 'UNKNOWN' | 'GITHUB' | 'GITLAB' | 'AZURE_REPOS' | 'BITBUCKET' | 'SEMGREP' | 'ENDOR_LABS'
        - `severity` string
        - `title` string
      - `integrationType` 'UNKNOWN' | 'SLACK' | 'JIRA' | 'DATADOG' | 'MSTEAMS' | 'WEBHOOK' | 'JIRA_SERVER' | 'SNYK' | 'GITHUB' | 'MERGE_AZURE_DEVOPS_BOARDS' | 'VANTA' | 'AZURE_DEVOPS' | 'BITBUCKET' | 'GITLAB' | 'EMAIL' | 'GITHUB_ENTERPRISE' | 'GITLAB_SELF_HOSTED' | 'BITBUCKET_SELF_HOSTED' | 'AZURE_DEVOPS_SELF_HOSTED' | 'SEMGREP' | 'ENDOR_LABS' | 'WIZ'
      - `isAllExternalAlerts` boolean
      - `projectUrl` string
    - `name` string — The name of the Zap plugin this alert triggered for.
    - `pluginId` string — The id of the Zap plugin that triggered this alert.
    - `references` string[] — External urls and study references to understand this findings.
    - `requestMethod` string — **Deprecated** - 4/25/22
    - `scan` ScanresultsScan — Represents the core elements of a single HawkScan run. Finished scans will include ScanResults, including alerts of findings contextual to the scanned application. The Scan also represents its current operational state (STARTED / COMPLETED / ERROR). For more information, see [Scans](https://docs.stackhawk.com/web-app/scans.html).
      - `applicationId` string — the UUID applicationId corresponding to the scanned application
      - `applicationName` string — the name of the corresponding scanned application
      - `env` string — the name of the scanned environment
      - `envId` string — the UUID environmentId corresponding to the scanned environment
      - `externalUserId` string — the UUID identifier of the StackHawk user that started this scan
      - `hawkScanType` 'HAWKSCAN_TYPE_SCAN' | 'HAWKSCAN_TYPE_FLIGHTPATH' | 'HAWKSCAN_TYPE_HOSTED' | 'HAWKSCAN_TYPE_CONFIGURATION' — The type of HawkScan execution (traditional, hosted, etc.)
      - `id` string — the UUID identifier of this scan
      - `metadata` ScanresultsMetaData
        - `tags` object
      - `parentScanId` string — If this scan is a result of a retest, this is the id of the scan it retested
      - `repoId` string — a hash of the scanned repo git name
      - `status` 'UNKNOWN' | 'COMPLETED' | 'ERROR' | 'STARTED' — the current state of the running scan (STARTED / COMPLETED / ERROR)
      - `timestamp` integer — seconds since unix epoch timestamp of when the scan was started
      - `version` string — the version of HawkScan used to scan this application
    - `severity` string — The severity of this finding. One of "High" "Medium" or "Low".
    - `uriCount` integer — The number of scanned urls that report this alert.
  - `appHost` string — The host URI this alert was triggered for.
  - `applicationScanAlertUris` ApplicationApplicationAlertUri[] — Path uris that triggered this alert.
    - `alertUriId` string — Unique identifier for this alert x uri
    - `appUriId` string — Unique identifier for this app x uri
    - `findingHash` string — The SHA-256 finding hash — a stable identifier for this finding across scans.
    - `matchedRuleLastUpdated` integer — Timestamp of the last time this alert was updated.
    - `matchedRuleNote` string — Message from the last time this alert was triaged.
    - `matchedRuleUserId` string — The last user who triaged this alert.
    - `msgId` string — A unique identifier of the individual request/response pair that triggered this Alert.
    - `pluginId` string — The id of the StackHawk/ZAP plugin that triggered this alert application alert URI.
    - `requestMethod` string — The HTTP method used to find this path.
    - `ruleHistories` ApplicationAlertRuleHistory[] — The triage history of this application alert.
      - `newResult` 'UNKNOWN' | 'FALSE_POSITIVE' | 'RISK_ACCEPTED' | 'PROMOTED' | 'ADD_COMMENT'
      - `note` string
      - `oldResult` 'UNKNOWN' | 'FALSE_POSITIVE' | 'RISK_ACCEPTED' | 'PROMOTED' | 'ADD_COMMENT'
      - `operation` 'CREATE' | 'UPDATE' | 'DELETE'
      - `ruleEffectiveDate` integer
      - `timestamp` integer
      - `userId` string
    - `scan` ScanresultsScan — Represents the core elements of a single HawkScan run. Finished scans will include ScanResults, including alerts of findings contextual to the scanned application. The Scan also represents its current operational state (STARTED / COMPLETED / ERROR). For more information, see [Scans](https://docs.stackhawk.com/web-app/scans.html).
      - `applicationId` string — the UUID applicationId corresponding to the scanned application
      - `applicationName` string — the name of the corresponding scanned application
      - `env` string — the name of the scanned environment
      - `envId` string — the UUID environmentId corresponding to the scanned environment
      - `externalUserId` string — the UUID identifier of the StackHawk user that started this scan
      - `hawkScanType` 'HAWKSCAN_TYPE_SCAN' | 'HAWKSCAN_TYPE_FLIGHTPATH' | 'HAWKSCAN_TYPE_HOSTED' | 'HAWKSCAN_TYPE_CONFIGURATION' — The type of HawkScan execution (traditional, hosted, etc.)
      - `id` string — the UUID identifier of this scan
      - `metadata` ScanresultsMetaData
        - `tags` object
      - `parentScanId` string — If this scan is a result of a retest, this is the id of the scan it retested
      - `repoId` string — a hash of the scanned repo git name
      - `status` 'UNKNOWN' | 'COMPLETED' | 'ERROR' | 'STARTED' — the current state of the running scan (STARTED / COMPLETED / ERROR)
      - `timestamp` integer — seconds since unix epoch timestamp of when the scan was started
      - `version` string — the version of HawkScan used to scan this application
    - `status` 'UNKNOWN' | 'FALSE_POSITIVE' | 'RISK_ACCEPTED' | 'PROMOTED' | 'ADD_COMMENT' — The Triaged status of this application alert.
    - `statusLink` string — Optional URL of external promotion tool linked to triaged alert.
    - `uri` string — The URI of the path in the scanned application.
  - `category` string — The category of this finding.
  - `cheetsheet` string — external url to an OWASP cheatsheet for reference.
  - `isEachRuleLocked` boolean — if the scan alert and uris cannot be triaged within the StackHawk Platform.
  - `nextPageToken` string — pageToken to provide for the next page of results.
  - `totalCount` integer — total number of results.

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.net/stackhawk/apis/stackhawk-public-api.md) · [All operations](https://skmtc.net/stackhawk/apis/stackhawk-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stackhawk/stackhawk-public-api/versions/ad3dfd54cb63/schema)