---
title: "List of container finding details"
method: POST
path: "/v1/appsecops/container/findings/batch"
tags: ["AppSecOps"]
---

# List of container finding details

`POST /v1/appsecops/container/findings/batch`

Details of the given batch of container finding IDs. Supports a maximum of 1000 IDs per request.

## Request body

- ObjectIdBatchRequest
  - `ids` string[]

## Response `200`

Success

- ContainerFindingsResponse[]
  - `finding_id` string — Unique identifier for the security finding record in the system
  - `category` 'Misconfiguration' | 'Vulnerability' | 'Threat', required — High-level classification of the security finding type (Misconfiguration, Vulnerability, or Threat)
  - `source_tool` 'Hadolint' | 'Dockle' | 'AzureDefender' | 'InspectorV2' | 'InspectorClassic' | 'SecurityCommandCenter' | 'CloudGuard' | 'Guardduty', required — Name of the security scanning tool that originally detected and reported this finding
  - `execution_phase` 'Build' | 'Runtime', required — Phase in the software development lifecycle when this security issue was detected (Build or Runtime)
  - `layer` 'Container' | 'Infrastructure' | 'Supplychain' | 'API', required — Architectural layer where the security issue exists (Container, Infrastructure, Supplychain, or API)
  - `severity` 'critical' | 'high' | 'medium' | 'low' | 'informational' | 'none', required — Normalized severity level indicating the criticality and potential impact of the security finding
  - `status` 'open' | 'resolved', required — Current resolution status of the security finding (open for unresolved, resolved for fixed)
  - `title` string, required — Concise, human-readable summary title describing the specific security issue found
  - `description` string — Detailed explanation of the security finding, including what was detected and why it is a concern
  - `recommendation` string — Actionable guidance and best practices for addressing and resolving the security finding
  - `remediation` string — Specific step-by-step instructions for fixing the security issue and preventing recurrence
  - `created_at` string, date-time, required — Timestamp indicating when this security finding was first discovered and recorded in the system
  - `updated_at` string, date-time, required — Timestamp of the most recent modification or status change to this security finding record
  - `sbom_version_id` string — SBOM version ID to which the findings are associated
  - `code` string — Unique code identifying the specific finding
  - `target` string — Identifies the subject of the scan, can be either Image or Dockerfile
  - `tenant_id` string — Tenant ID to which the findings are associated

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `500` — Internal Server Error

---

[API](https://skmtc.dev/corestack/apis/corestack-external-api.md) · [All operations](https://skmtc.dev/corestack/apis/corestack-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/corestack/corestack-external-api/revisions/bf2cdf20826d/schema)