---
title: "Get a single finding"
method: GET
path: "/v1/findings/{finding_id}/"
tags: ["findings"]
---

# Get a single finding

`GET /v1/findings/{finding_id}/`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/findings/{finding_id}/`
- Auth: none declared

Return one finding by id (404 if not found or not authorized).

Args:
    finding_id (int): Primary key of the finding.
    db (AsyncSession): Request-scoped database session.
    context (ActiveContext): Resolved caller identity and scope.

Returns:
    FindingDetailResponse: The requested finding.

## Path parameters

- `finding_id` integer, required

## Response `200`

Successful Response

- FindingDetailResponse: Single-finding view. Wire-identical to :class:`FindingResponse`: ``md`` / ``html`` and ``pentest_slug`` all moved to the base once list items had to carry them too. What remains is ``pentest_id``, read by the route after validation and excluded from the response. Attributes: pentest_id (int | None): The parent pentest's primary key. Never serialized -- the wire names the pentest by ``pentest_slug``.
  - `id` integer, required
  - `title` string, required
  - `md` string, nullable
  - `html` string, nullable
  - `asset_id` integer, nullable
  - `asset_value` string, required
  - `status` 'draft' | 'open' | 'triaged' | 'invalid' | 'fixed' | 'duplicate' | 'accepted', required: Finding lifecycle status. ``DRAFT`` is the author-private pre-submission state: a hacker (or machine) composes the finding as a draft, then ``submit`` advances it to ``OPEN`` / ``TRIAGED``, at which point it becomes visible to the event's other members. Drafts are only ever seen by their author (and privileged actors).
  - `previous_status` 'draft' | 'open' | 'triaged' | 'invalid' | 'fixed' | 'duplicate' | 'accepted': Finding lifecycle status. ``DRAFT`` is the author-private pre-submission state: a hacker (or machine) composes the finding as a draft, then ``submit`` advances it to ``OPEN`` / ``TRIAGED``, at which point it becomes visible to the event's other members. Drafts are only ever seen by their author (and privileged actors).
  - `severity` string, required
  - `score` number, nullable
  - `requested_score` number, nullable
  - `cve` string, nullable
  - `cvss_vector` string, nullable
  - `created` string, date-time, required
  - `pentest_slug` string, nullable
  - `epss` FindingEpssResponse: The latest EPSS sample for a finding's CVE. Attributes: score (float): EPSS score. percentile (float): EPSS percentile. date (datetime.date): Date the sample was published.
    - `score` number, required
    - `percentile` number, required
    - `date` string, date, required
  - `kev` boolean, nullable: Whether the CVE is in the CISA KEV catalog
  - `priority` number: Triage urgency in [0, 3]; lower is more urgent
  - `event_slug` string, nullable, required: Previous name for pentest_slug.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)