---
title: "GET /v1beta/projects/{project}/findings"
method: GET
path: "/v1beta/projects/{project}/findings"
tags: ["threatintelligence"]
---

# GET /v1beta/projects/{project}/findings

`GET /v1beta/projects/{project}/findings`

Get a list of findings that meet the filter criteria.

## Path parameters

- `project` string, required

## Query parameters

- `filter` string
- `orderBy` string
- `pageToken` string
- `pageSize` integer

## Headers

- `x-goog-user-project` string, required

## Response `default`

Successful operation

- ListFindingsResponse — Response message for ListFindings.
  - `findings` Finding[] — List of findings.
    - `name` string — Identifier. Server generated name for the finding (leave clear during creation). Format: projects/{project}/findings/{finding}
    - `provider` string, required — Required. Logical source of this finding (name of the sub-engine).
    - `displayName` string, required — Required. A short descriptive title for the finding <= 250 chars. EX: "Actor 'baddy' offering $1000 for credentials of 'goodguy'".
    - `detail` FindingDetail, required — Wrapper class that contains the union struct for all the various findings detail specific classes.
      - `initialAccessBroker` InitialAccessBrokerFindingDetail — A detail object for an Initial Access Broker (IAB) finding.
        - `matchScore` number, float, required — Required. Reference to the match score of the IAB finding. This is a float value between 0 and 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.
        - `severity` 'SEVERITY_UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the IAB finding. This indicates the potential impact of the threat.
        - `documentId` string, required — Required. The unique identifier of the document that triggered the IAB finding. This ID can be used to retrieve the content of the document for further analysis.
      - `dataLeak` DataLeakFindingDetail — A detail object for a Data Leak finding.
        - `matchScore` number, float, required — Required. Reference to the match score of the Data Leak finding. This is a float value greater than 0 and less than or equal to 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.
        - `severity` 'SEVERITY_UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the Data Leak finding. This indicates the potential impact of the threat.
        - `documentId` string, required — Required. The unique identifier of the document that triggered the Data Leak finding. This ID can be used to retrieve the content of the document for further analysis.
      - `insiderThreat` InsiderThreatFindingDetail — A detail object for a InsiderThreat finding.
        - `matchScore` number, float, required — Required. Reference to the match score of the InsiderThreat finding. This is a float value greater than 0 and less than or equal to 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.
        - `severity` 'SEVERITY_UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Required. The severity of the InsiderThreat finding. This indicates the potential impact of the threat.
        - `documentId` string, required — Required. The unique identifier of the document that triggered the InsiderThreat finding. This ID can be used to retrieve the content of the document for further analysis.
      - `detailType` string — Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.
    - `severity` number, float — Optional. Deprecated: Use the `severity_analysis` field instead. Base severity score from the finding source.
    - `reoccurrenceTimes` string[] — Output only. When identical finding (same labels and same details) has re-occurred.
    - `relevanceAnalysis` RelevanceAnalysis — Structured relevance analysis for a threat.
      - `relevant` boolean — Indicates whether the threat is considered relevant.
      - `confidence` 'CONFIDENCE_LEVEL_UNSPECIFIED' | 'CONFIDENCE_LEVEL_LOW' | 'CONFIDENCE_LEVEL_MEDIUM' | 'CONFIDENCE_LEVEL_HIGH'
      - `reasoning` string — Human-readable explanation from the matcher, detailing why a particular result is considered relevant or not relevant.
      - `evidence` Evidence — Details the evidence used to determine the relevance verdict.
        - `commonThemes` string[] — A list of semantic themes or concepts found to be common, related, or aligned between the sources, supporting the verdict.
        - `distinctThemes` string[] — A list of semantic themes or descriptions unique to one source or semantically distant.
      - `relevanceLevel` 'RELEVANCE_LEVEL_UNSPECIFIED' | 'RELEVANCE_LEVEL_LOW' | 'RELEVANCE_LEVEL_MEDIUM' | 'RELEVANCE_LEVEL_HIGH'
    - `severityAnalysis` SeverityAnalysis — Structured severity analysis for a threat.
      - `severityLevel` 'SEVERITY_LEVEL_UNSPECIFIED' | 'SEVERITY_LEVEL_LOW' | 'SEVERITY_LEVEL_MEDIUM' | 'SEVERITY_LEVEL_HIGH'
      - `confidence` 'CONFIDENCE_LEVEL_UNSPECIFIED' | 'CONFIDENCE_LEVEL_LOW' | 'CONFIDENCE_LEVEL_MEDIUM' | 'CONFIDENCE_LEVEL_HIGH'
      - `reasoning` string — Human-readable explanation from the model, detailing why a particular result is considered to have a certain severity.
    - `aiSummary` string — Optional. AI summary of the alert.
    - `audit` Audit — Tracks basic CRUD facts.
      - `updateTime` string, date-time — Output only. Time of creation or last update.
      - `createTime` string, date-time — Output only. Time of creation.
      - `creator` string — Output only. Agent that created or updated the record, could be a UserId or a JobId.
      - `updater` string — Output only. Agent that last updated the record, could be a UserId or a JobId.
    - `alert` string — Optional. Name of the alert that this finding is bound to.
    - `configurations` string[] — Optional. Configuration names that are bound to this finding.
  - `nextPageToken` string — Page token.

---

[API](https://skmtc.net/virustotal/apis/threat-landscape.md) · [All operations](https://skmtc.net/virustotal/apis/threat-landscape/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/virustotal/threat-landscape/versions/d61b85e6a6b3/schema)