---
title: "Get Finding Handoff"
method: GET
path: "/v1/findings/{finding_id}/handoff"
tags: ["findings"]
---

# Get Finding Handoff

`GET /v1/findings/{finding_id}/handoff`

## Request

- Base URL: `https://api.cybret.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.cybret.ai/v1/findings/{finding_id}/handoff`
- Auth: HTTP bearer

## Path parameters

- `finding_id` string, required

## Response `200`

Successful Response

- FindingHandoffResponse: HTTP/MCP envelope: structured pack plus copy-ready markdown.
  - `handoff` AgentHandoff, required: Customer-facing evidence pack. extra=forbid; no LLM fields.
    - `schema_id` 'cybret.handoff.v1'
    - `finding_id` string, required
    - `stable_id` string, required
    - `run_id` string, required
    - `scan_box` 'black' | 'grey' | 'white', required
    - `title` string, required
    - `severity` string, required
    - `confidence_tier` string, nullable
    - `status` string, required
    - `status_note` UntrustedValue: Wrapper for bytes that originated on the target HTTP surface.
      - `untrusted` string, required
    - `linked_pr` UntrustedValue: Wrapper for bytes that originated on the target HTTP surface.
      - `untrusted` string, required
    - `verify_outcome` string, nullable
    - `confirmation` string, nullable
    - `cwe_ids` string[]
    - `owasp_categories` string[]
    - `locator` HandoffLocator, required
      - `http_method` string, nullable
      - `http_path` string, nullable
      - `repo` string, nullable
      - `path` string, nullable
      - `line` integer, nullable
      - `symbol` string, nullable
      - `code` HandoffLocatorCode
      - `observed_at_scan` string, nullable
    - `identities` HandoffIdentities, required: Labels only. Never credentials.
      - `bound_id` string, nullable
      - `labels` string[]
    - `evidence_summaries` string[]
    - `reproduction` UntrustedValue: Wrapper for bytes that originated on the target HTTP surface.
      - `untrusted` string, required
    - `remediation` string, nullable
    - `proof_digest` string, nullable
    - `replay_actions` HandoffReplayAction[]
      - `method` string, required
      - `url` UntrustedValue, required: Wrapper for bytes that originated on the target HTTP surface.
        - `untrusted` string, required
      - `identity_label` string, nullable
      - `assertion` string, nullable
    - `negative_controls` HandoffNegativeControl[]
      - `kind` string, required
      - `distinguishing` boolean, required
      - `identity_label` string, nullable
      - `description` UntrustedValue, required: Wrapper for bytes that originated on the target HTTP surface.
        - `untrusted` string, required
    - `mode_payload` union, required
      - BlackModePayload
        - `auth` 'unauthenticated'
        - `do_not_add_authorization` true
      - GreyModePayload
        - `bound_id` string, nullable
        - `owner_label` string, nullable
        - `peer_label` string, nullable
        - `bola_proven` boolean
      - WhiteModePayload
        - `repo` string, nullable
        - `path` string, nullable
        - `line` integer, nullable
        - `symbol` string, nullable
        - `live_http_proof` boolean
        - `confirmation` string, nullable
    - `honesty` HandoffHonesty: Locator freshness. Never implies the finding is confirmed or fixed.
      - `locator_may_rot` boolean
      - `live_url_checked` boolean
      - `guidance` string, nullable
    - `instructions` string
  - `markdown` string, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/cybret/apis/api-scanner-control-plane.md) · [All operations](https://skmtc.dev/cybret/apis/api-scanner-control-plane/llms.txt) · [OpenAPI document](https://skmtc.dev/cybret/apis/api-scanner-control-plane/revisions/4c9b522246af?raw)