---
title: "GET /api/v1/organizations/{organization_id}/verify/findings"
method: GET
path: "/api/v1/organizations/{organization_id}/verify/findings"
tags: ["organizations"]
---

# GET /api/v1/organizations/{organization_id}/verify/findings

`GET /api/v1/organizations/{organization_id}/verify/findings`

## Request

- Base URL: `https://composal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://composal.com/api/v1/organizations/{organization_id}/verify/findings`
- Auth: HTTP bearer

## Path parameters

- `organization_id` string, required

## Query parameters

- `status` string

## Response `200`

Findings observed in the organization, newest first

- VerifyFindingRecord[]
  - `deferred_until` string, date-time, nullable
  - `verification` VerifyFindingVerification, nullable, required: Whether a model that did not report the finding, and for a P0 or P1 Deep Scan finding an independent rerun, confirmed it. Null for findings recorded before findings were checked.
    - `state` 'pending' | 'reproducing' | 'confirmed' | 'unverified' | 'dismissed', required: pending while the model checks it, reproducing while its rerun runs, then confirmed, unverified or dismissed. Unverified means the check did not confirm it, could not decide or run, or a rerun did not see it again; dismissed means the screenshots show the expected result. Unverified and dismissed findings stay listed below confirmed ones.
    - `reason` string, nullable, required: What the check saw, in plain words.
    - `verified_at` string, date-time, nullable, required
  - `id` string, required
  - `organization_id` string, required
  - `repository_id` string, nullable, required
  - `fingerprint` string, required
  - `status` 'open' | 'resolved' | 'ignored' | 'deferred', required
  - `severity` string, required
  - `confidence` string, required
  - `title` string, required
  - `safe_summary` string, required
  - `occurrence_count` integer, required
  - `first_seen_at` string, date-time, required
  - `last_seen_at` string, date-time, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `422`: Unprocessable entity
- `502`: Bad gateway

---

[API](https://skmtc.dev/composal/apis/vex-api.md) - [All operations](https://skmtc.dev/composal/apis/vex-api/llms.txt) - [OpenAPI document](https://skmtc.dev/composal/apis/vex-api/revisions/74298a24e040?raw)