COconductorone
Findings

Search

Changed on

Search returns audit events filtered by finding, actor, type, or app. Authorized as VIEWER -- the same role required to read the finding itself.

post/api/v1/search/finding_audits

Request

  • Base URL
    https://example.conductor.one
  • URL
    https://example.conductor.one/api/v1/search/finding_audits
  • Auth
    HTTP bearer and OAuth 2
    Client credentials
    Token URL: /auth/v1/token

Request body

actorPrincipalIdstring

The actorPrincipalId field.

actorSubjectstring

Partial match via full-text search over the denormalized actor email / display name column.

appIdstring

Empty skips the filter; non-empty must be a 27-char alphanumeric id.

eventTypesstring[] nullable

Filter by one or more event types. Empty means any.

findingIdstring

Filter to a single finding. The detail-page timeline uses this. Empty skips the filter; non-empty must be a 27-char alphanumeric id.

pageSizeinteger

The pageSize field.

pageTokenstring

The pageToken field.

sincestring date-time nullable
untilstring date-time nullable

Response

Successful response

nextPageTokenstring

The nextPageToken field.

Changes

  • 918a4e749f56Revision changes
    • warning

      added the new FINDING_AUDIT_EVENT_TYPE_ASSIGNEE_CHANGED enum value to the // response property for the response status

    • info

      added the new FINDING_AUDIT_EVENT_TYPE_ASSIGNEE_CHANGED enum value to the request property /

  • f76d07868c0cRevision changes
    • warning

      added the new FINDING_AUDIT_EVENT_TYPE_REPROCESS_COMPLETED enum value to the // response property for the response status

    • warning

      added the new FINDING_AUDIT_EVENT_TYPE_REPROCESS_REQUESTED enum value to the // response property for the response status

    • info

      added the new FINDING_AUDIT_EVENT_TYPE_REPROCESS_COMPLETED enum value to the request property /

    • info

      added the new FINDING_AUDIT_EVENT_TYPE_REPROCESS_REQUESTED enum value to the request property /