---
title: "List Hotlist Findings"
method: POST
path: "/api/security/hotlist/findings"
tags: ["Security Hotlist"]
---

# List Hotlist Findings

`POST /api/security/hotlist/findings`

## Request

- Base URL: `https://api.codeant.ai`
- URL: `https://api.codeant.ai/api/security/hotlist/findings`
- Auth: HTTP bearer

Returns the organization's ranked security Hotlist — the same prioritized list shown on the CodeAnt Hotlist page. Every SCA, SAST, secrets, IaC, cloud (CSPM) and AI-exploitation finding across the organization is deduplicated and scored on severity, EPSS/CVSS, CISA KEV membership, confirmed exploitability, dependency reachability, secret validation and production context, then returned highest priority first alongside `summary` rollups, `facets` for filter discovery, and cursor pagination. Ticket, assignee and SLA state is synced live from the linked Jira, Linear, GitHub, Azure DevOps or GitLab issue.

The Hotlist is served from a materialized snapshot: the first call after a rebuild returns `202` while it is built — retry after `retry_after_seconds`.

## Request body

- HotlistFindingsRequest: Ranked Hotlist page request.
  - `platform` 'github' | 'gitlab' | 'bitbucket' | 'azure_devops', required: Git platform of the organization
  - `org` string, required: Organization / workspace slug
  - `github_base_url` string: Self-hosted instance URL (also gitlab_base_url / bitbucket_base_url / azure_devops_base_url). Defaults to the cloud host.
  - `filters` HotlistFilters: Values within one dimension are ORed; dimensions are ANDed together. Omit a dimension, or send an empty list, to leave it unfiltered. Use the `facets` of a previous response to discover the values available in your organization.
    - `types` string[]: Scanner that produced the finding.
    - `severities` string[]
    - `locations` string[]: Repository full names, or cloud account identifiers for Infrastructure findings.
    - `ticket_statuses` string[]
    - `assignees` string[]: Assignee email (lowercased) or provider user id, as returned in each finding's `assignee`.
    - `provider_statuses` string[]: Native workflow state names from the linked ticket provider, e.g. `In Progress`.
    - `sla_statuses` string[]
    - `compliance` string[]
    - `validation` string[]: Restrict to findings CodeAnt has actively proven exploitable.
  - `search` string: Case-insensitive substring match over the finding title, identifier, location and file path.
  - `limit` integer: Findings per page.
  - `cursor` string: Opaque `next_cursor` from the previous page. A cursor is bound to the snapshot revision and to the exact `filters` + `search` it was issued for; changing either, or a rebuild of the Hotlist, returns 409 `HOTLIST_CURSOR_STALE` and pagination must restart.

## Response `200`

Ranked findings returned

- object
  - `state` string
  - `snapshot_revision` string: Revision of the snapshot this page was served from.
  - `scoring_version` string
  - `updated_at` string, date-time
  - `source_freshness` object: Last time each scanner's data was folded into the snapshot.
  - `summary` HotlistSummary: Headline counts for exactly the findings the request matched.
    - `total` integer
    - `severity` object: Count per severity.
    - `exploitConfirmed` integer
    - `ticketed` integer
  - `facets` object: Available filter values with their counts, keyed by the dimensions of `HotlistFilters`.
  - `sla_config` object: SLA in days configured per severity; `null` means no SLA for that severity.
  - `total_filtered` integer: Findings matching the request across all pages.
  - `items` HotlistFinding[]: One page of findings, highest priority first.
    - `id` string: Stable 32-character identifier for this finding across snapshots.
    - `type` 'SCA' | 'SAST' | 'Secrets' | 'IaC' | 'Infrastructure' | 'AI Exploitation'
    - `title` string: CVE id, rule message, secret type or cloud check title.
    - `subtitle` string: Supporting identifier, e.g. `package @ version` for SCA.
    - `repo` string: Repository full name; empty for cloud findings.
    - `account` string: Cloud account identifier for Infrastructure findings.
    - `maxSeverity` 'critical' | 'high' | 'medium' | 'low' | 'unknown'
    - `filePath` string
    - `lineNumber` union: Line number, or the region / resource locator for cloud findings.
      - integer
      - string
    - `priorityScore` number: Ranking score. Findings are returned in descending priority order.
    - `priorityBoosts` object[]: Signals that raised the score above the severity baseline.
      - `key` string
      - `label` string
      - `value` number
    - `exploitConfirmed` boolean: CodeAnt proved this finding exploitable — a validated live secret, a confirmed cloud exploit path, or a malware package.
    - `kev` boolean: Listed in the CISA Known Exploited Vulnerabilities catalog.
    - `fixable` boolean: A fixed version or remediation is available.
    - `direct` boolean: SCA only — a direct rather than transitive dependency.
    - `reachabilityStatus` 'reachable' | 'not_reachable' | 'unknown': SCA only — whether the vulnerable code is reachable from your application.
    - `cveId` string
    - `package` string
    - `version` string
    - `complianceFrameworks` string[]: Frameworks this finding maps to.
    - `nonProd` boolean: The repository is marked non-production in its risk settings.
    - `ticketStatus` 'created' | 'not_created'
    - `ticketProvider` string: Tracker holding the ticket.
    - `ticketUrl` string
    - `assignee` object, nullable: Assignee on the linked ticket.
      - `id` string
      - `name` string
      - `email` string
    - `providerStatus` object, nullable: Native workflow state of the linked ticket.
      - `id` string
      - `name` string
      - `type` string
    - `slaDays` integer, nullable: SLA applied to this finding, in days.
    - `slaDueDate` string, date, nullable
    - `slaStatus` 'breached' | 'on_track' | 'met' | 'no_sla'
    - `raw` object: Scanner fields kept for deep-linking and detail rendering. Code blocks, autofix payloads and plaintext secret material are never included.
    - `rank` integer: 1-based position in the ranked list.
    - `source` string: Scanner the finding came from, before IaC/cloud types are merged.
    - `score` number: Severity/CVSS/EPSS base score before the priority boosts are applied.
    - `epss` number: EPSS exploit-probability, 0-1. Always 0 for organization-level SCA rows.
    - `validationStatus` 'live' | 'revoked' | 'pending' | 'unknown': Secrets only — result of validating the credential against its provider.
    - `ticketCreatedAt` string, date-time, nullable
    - `providerIssueKey` string, nullable: Human-readable key of the linked ticket.
    - `providerSyncError` string, nullable: Why the last sync with the ticket provider failed, if it did.
  - `next_cursor` string, nullable: Pass back as `cursor` to fetch the next page; `null` on the last page.
  - `has_more` boolean

## Other responses

- `202`: The Hotlist snapshot is still building; retry shortly
- `400`: Invalid filter, limit or cursor
- `401`: Missing or invalid access token
- `409`: The cursor no longer matches the snapshot or the filters it was issued for; restart pagination

## Changes

- **2026-11-03** `0eb1442ce49d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/codeant/apis/codeant-ai-api/changes/api/security/hotlist/findings/post.md)

---

[API](https://skmtc.dev/codeant/apis/codeant-ai-api.md) - [All operations](https://skmtc.dev/codeant/apis/codeant-ai-api/llms.txt) - [OpenAPI document](https://skmtc.dev/codeant/apis/codeant-ai-api/revisions/0eb1442ce49d?raw)