Get evidence for a finding (keys and first page of evidence)

Returns evidence keys (schema) and a paginated first page of evidence rows for the finding in one call. Resolves the finding to its match and orchestrates evidence_key + evidence from bdf-matches. Use query params for pagination (e.g. page=2 for subsequent pages).

get/org/findings/{finding_id}/evidence

Request

  • Base URL: https://api.blumira.com/public-api/v1
  • URL: https://api.blumira.com/public-api/v1/org/findings/{finding_id}/evidence
  • Auth: HTTP bearer

Path parameters

finding_idstring uuid required

Finding ID of the object, e.g., "00110011-0000-0000-0000-000000000000"

Query parameters

pageinteger

Page to return, e.g., "2"

page_sizeinteger

Number of records per page to return, e.g., "3"

limitinteger

Maximum number of records to return, e.g., "200"

order_bystring

Order records by field, e.g., "created", "created;asc", "created;desc", "name;desc,created;desc"

Headers

Authorizationstring required

Bearer followed by JWT, e.g., "Bearer eyJh...enA"

Response

Evidence keys and paginated evidence rows for the finding

dataEvidenceRowDynamic[] required

Paginated evidence rows; each object has keys from evidence_keys.

evidence_keysstring[]

Field names that appear in each evidence row (data items). Use these to interpret the keys of each object in data. Sorted alphabetically; __time_matched is the reserved field for the evidence created timestamp.

statusstring required

Status of request

Example response

{
  "evidence_keys": [
    "__time_matched",
    "src_ip",
    "user"
  ],
  "links": {
    "next": "/v1/{path}?page=2&page_size=25",
    "self": "/v1/{path}?page=1&page_size=25"
  },
  "meta": {
    "page": 1,
    "page_size": 100,
    "total_items": 156,
    "total_pages": 2
  },
  "status": "OK"
}

Changes

No recorded changes to this operation across all 1 revision of this API.