---
title: "Retrieve findings for a completed run"
method: GET
path: "/api/v1/run/{run_id}/findings"
tags: ["findings"]
---

# Retrieve findings for a completed run

`GET /api/v1/run/{run_id}/findings`

## Request

- Base URL: `https://api.enokilabs.ai`
- URL: `https://api.enokilabs.ai/api/v1/run/{run_id}/findings`
- Auth: none declared

Returns structured findings for a completed assessment run. Returns 409 while the run is still running — partial findings are not exposed. A finding whose proof the workspace's plan withholds is still returned, carrying its id and severity, no attacks, and '[redacted]' in place of its text — so 'count' and the run's pass/fail verdict are the same either way.

## Path parameters

- `run_id` string, required

## Query parameters

- `min_severity` string, nullable: Filter to findings at or above this severity.
- `status` string, nullable: Filter by finding status: open, fixed, dismissed.

## Headers

- `Authorization` string, nullable: Bearer token with API key

## Response `200`

Successful Response

- ApiRunFindingsResponse: Response for GET /api/v1/run/{run_id}/findings.
  - `findings` ApiFindingItem[], required
    - `finding_id` string, required
    - `lens` 'security' | 'safety' | 'quality' | 'policy', required: The kind of testing a finding came from.
    - `category` string, required
    - `severity` 'critical' | 'high' | 'medium' | 'low', required: Business-impact severity levels, ordered from most to least severe.
    - `description` string, required
    - `expected_behavior` string, required
    - `status` string, required
    - `created_at` string, required
    - `attacks` ApiAttackItem[], required
      - `attack_id` string, required
      - `score` integer, required
      - `source` ApiAttackSource, required: Provenance block of one attack in the external API response.
        - `source_type` 'manual' | 'adaptive_attacker' | 'compliance' | 'test_suite' | 'drill_down', required: What produced a finding's attack. An assessment, a compliance workflow, a test suite, a manual entry, or a follow-up on an existing finding.
        - `assessment_id` string, required
        - `attack_index` integer, required
        - `date` string, nullable, required
      - `replay_script` ReplayStepResponse[], required
        - `step` 'chat' | 'http' | 'assert', required
        - `message` string, nullable
        - `response` string, nullable
        - `session_id` string, nullable
        - `method` string, nullable
        - `url` string, nullable
        - `headers` object, nullable
        - `body` string, nullable
        - `response_status` integer, nullable
        - `response_body` string, nullable
        - `target` string, nullable
        - `assertion` string, nullable
        - `expected_behavior` string, nullable
        - `capture_as` string, nullable
      - `last_replay_status` 'pending' | 'succeeded' | 'failed' | 'inconclusive' | 'stale', required
      - `last_replayed_at` string, nullable
      - `created_at` string, required
  - `count` integer, required: Number of findings returned

## Other responses

- `400`: Invalid min_severity or status filter
- `404`: Run not found
- `409`: Run still in progress
- `422`: Validation Error

---

[API](https://skmtc.dev/enokilabs/apis/enoki-external-api.md) · [All operations](https://skmtc.dev/enokilabs/apis/enoki-external-api/llms.txt) · [OpenAPI document](https://skmtc.dev/enokilabs/apis/enoki-external-api/revisions/9b13fb6ab124?raw)