---
title: "List security findings"
method: GET
path: "/api/v2/security/findings"
tags: ["Security Monitoring"]
---

# List security findings

`GET /api/v2/security/findings`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security/findings`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_findings_read`

Get a list of security findings that match a search query. [See the schema for security findings](https://docs.datadoghq.com/security/guide/findings-schema/).

### Query Syntax

This endpoint uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix.

Example: `@severity:(critical OR high) @status:open team:platform`

## Query parameters

- `filter[query]` string
- `page[cursor]` string
- `page[limit]` integer
- `sort` '@detection_changed_at' | '-@detection_changed_at': The sort parameters when querying security findings.

## Response `200`

OK

- ListSecurityFindingsResponse: The expected response schema when listing security findings.
  - `data` SecurityFindingsData[]: Array of security findings matching the search query.
    - `attributes` SecurityFindingsAttributes: The JSON object containing all attributes of the security finding.
      - `attributes` object: The custom attributes of the security finding.
      - `tags` string[]: List of tags associated with the security finding.
      - `timestamp` integer: The Unix timestamp at which the detection changed for the resource. Same value as @detection_changed_at.
    - `id` string: The unique ID of the security finding.
    - `type` 'finding': The type of the security finding resource.
  - `links` SecurityFindingsLinks: Links for pagination.
    - `next` string: Link for the next page of results. Note that paginated requests can also be made using the POST endpoint.
  - `meta` SecurityFindingsMeta: Metadata about the response.
    - `elapsed` integer: The time elapsed in milliseconds.
    - `page` SecurityFindingsPage: Pagination information.
      - `after` string: The cursor used to get the next page of results.
    - `request_id` string: The identifier of the request.
    - `status` 'done' | 'timeout': The status of the response.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)