COcodeant
Security Hotlist

List Hotlist Findings

Changed on

Returns the organization's ranked security Hotlist — the same prioritized list shown on the CodeAnt Hotlist page. Every SCA, SAST, secrets, IaC, cloud (CSPM) and AI-exploitation finding across the organization is deduplicated and scored on severity, EPSS/CVSS, CISA KEV membership, confirmed exploitability, dependency reachability, secret validation and production context, then returned highest priority first alongside summary rollups, facets for filter discovery, and cursor pagination. Ticket, assignee and SLA state is synced live from the linked Jira, Linear, GitHub, Azure DevOps or GitLab issue.

The Hotlist is served from a materialized snapshot: the first call after a rebuild returns 202 while it is built — retry after retry_after_seconds.

post/api/security/hotlist/findings

Request

  • Base URL
    https://api.codeant.ai
  • URL
    https://api.codeant.ai/api/security/hotlist/findings
  • Auth
    HTTP bearer

Request body

platform'github' | 'gitlab' | 'bitbucket' | 'azure_devops' required

Git platform of the organization

orgstring required

Organization / workspace slug

github_base_urlstring

Self-hosted instance URL (also gitlab_base_url / bitbucket_base_url / azure_devops_base_url). Defaults to the cloud host.

searchstring

Case-insensitive substring match over the finding title, identifier, location and file path.

limitinteger

Findings per page.

cursorstring

Opaque next_cursor from the previous page. A cursor is bound to the snapshot revision and to the exact filters + search it was issued for; changing either, or a rebuild of the Hotlist, returns 409 HOTLIST_CURSOR_STALE and pagination must restart.

Example request

{
  "github_base_url": "https://github.com"
}

Response

Ranked findings returned

statestring
snapshot_revisionstring

Revision of the snapshot this page was served from.

scoring_versionstring
updated_atstring date-time
source_freshnessobject

Last time each scanner's data was folded into the snapshot.

facetsobject

Available filter values with their counts, keyed by the dimensions of HotlistFilters.

sla_configobject

SLA in days configured per severity; null means no SLA for that severity.

total_filteredinteger

Findings matching the request across all pages.

next_cursorstring nullable

Pass back as cursor to fetch the next page; null on the last page.

has_moreboolean

Example response

{
  "state": "ready",
  "scoring_version": "hotlist-v2",
  "items": [
    {
      "id": "9f2c1d7a4b6e0f3c8a5d2e1b7c4f6a09",
      "title": "CVE-2024-21538",
      "subtitle": "cross-spawn @ 7.0.3",
      "priorityScore": 82.5,
      "priorityBoosts": [
        {
          "key": "kev",
          "label": "CISA KEV"
        }
      ],
      "complianceFrameworks": [
        "soc2"
      ],
      "ticketProvider": "Jira",
      "providerStatus": {
        "name": "In Progress",
        "type": "started"
      },
      "providerIssueKey": "COD-1110"
    }
  ]
}

Changes