Sign in
Edge

List shadow-agent findings

Changed on

Returns a tenant-scoped cursor-paginated page of ShadowAgentFinding records. Filters narrow the result set; the narrowest filter is selected as the primary index path. Resolved/suppressed records past terminal retention are hidden.

get/api/v1/edge/shadow-agents

Request

  • Base URL: http://localhost:8081
  • URL: http://localhost:8081/api/v1/edge/shadow-agents
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Query parameters

status'detected' | 'resolved' | 'suppressed'

Filter by triage status. Managed-skip rows are not filterable with status=managed_skip; request include_managed_skip=true to include findings whose response status is managed_skip.

risk'low' | 'medium' | 'high' | 'critical'
agentstring

Alias for agent_product. The two parameter names are interchangeable.

agent_productstring
ownerstring

Filter by owner_principal_id.

limitinteger
cursorstring
source_type'local' | 'kubernetes' | 'ci' | 'network'

EDGE-143.5 — restrict to findings emitted by one detector family. local falls back to a broad tenant index + post-filter so legacy EDGE-141 findings without source_type surface (defaults-on-read map to local).

cluster_idstring

EDGE-143.5 — Kubernetes cluster id (Q7 cross-cluster slicing). Shared (cross-tenant) index; tenant isolation enforced at read time.

namespacestring

EDGE-143.5 — Kubernetes namespace.

ci_provider'github_actions' | 'gitlab_ci' | 'jenkins' | 'buildkite' | 'circleci' | 'other'

EDGE-143.5 — CI provider enum; required when repo is set.

repostring

EDGE-143.5 — org/repo for CI findings; ci_provider MUST also be set or the request is rejected with 400.

signalstring[]

EDGE-143.5 — any-of filter on signal_set. Repeatable up to 16 times; each entry must match [a-z0-9_]{1,32}. Multi-signal queries do not support cursor pagination.

confidence_minnumber float

EDGE-143.5 — minimum detector self-confidence in [0, 1].

first_seen_afterstring date-time

EDGE-143.5 — return findings whose first_seen is strictly after this RFC3339 timestamp.

last_seen_beforestring date-time

EDGE-143.5 — return findings whose last_seen is strictly before this RFC3339 timestamp.

exception_idstring

EDGE-143.5 — filter to findings joined to a specific operator exception declaration.

include_managed_skipboolean

EDGE-143.5 — include findings carrying false_positive_reason (§10.3 managed_skip). Defaults to false; default behavior excludes them from operator dashboards. When true, responses may contain status=managed_skip.

Headers

X-Tenant-IDstring required

Tenant isolation header (required on all protected routes).

Response

Shadow finding page

next_cursorstring nullable

Changes