---
title: "List findings"
method: GET
path: "/v1/findings/"
tags: ["findings"]
---

# List findings

`GET /v1/findings/`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/findings/`
- Auth: none declared

List findings visible to the caller, filtered and paginated.

Scoped to the caller by ``FindingService``; supports filtering by
organization, pentest, asset, and CVE. The route only translates
transport in/out.

Args:
    db (AsyncSession): Request-scoped database session.
    context (ActiveContext): Resolved caller identity and scope.
    query (FindingListQuery): Filters + pagination query params.
    pager (Paginator): Fills the response's navigation metadata.

Returns:
    FindingListResponse: The authorized, filtered finding list.

## Query parameters

- `page` integer
- `per_page` integer: Page size. Values above 500 are clamped to it (or rejected, per REST__PAGINATION__PER_PAGE_OVER_MAX).
- `organization_id` integer, nullable
- `finding_id` integer, nullable
- `pentest_slug` string, nullable
- `asset_id` integer, nullable
- `cve` string, nullable
- `search` string, nullable
- `status` 'draft' | 'open' | 'triaged' | 'invalid' | 'fixed' | 'duplicate' | 'accepted': Finding lifecycle status. ``DRAFT`` is the author-private pre-submission state: a hacker (or machine) composes the finding as a draft, then ``submit`` advances it to ``OPEN`` / ``TRIAGED``, at which point it becomes visible to the event's other members. Drafts are only ever seen by their author (and privileged actors).
- `statuses` FindingStatus[], nullable
- `severity` 0 | 1 | 2 | 3 | 4 | 5: Finding severity level.
- `severities` Severity[], nullable

## Response `200`

Successful Response

- FindingListResponse: Paginated list of findings. Attributes: findings (list[FindingResponse]): Finding objects.
  - `total` integer, nullable
  - `page` integer, nullable
  - `per_page` integer, nullable
  - `_links` object, nullable: RFC 8288 rel to URL. Always first; last unless the route opted out of counting; prev and next when applicable.
  - `findings` FindingResponse[], required
    - `id` integer, required
    - `title` string, required
    - `md` string, nullable
    - `html` string, nullable
    - `asset_id` integer, nullable
    - `asset_value` string, required
    - `status` 'draft' | 'open' | 'triaged' | 'invalid' | 'fixed' | 'duplicate' | 'accepted', required: Finding lifecycle status. ``DRAFT`` is the author-private pre-submission state: a hacker (or machine) composes the finding as a draft, then ``submit`` advances it to ``OPEN`` / ``TRIAGED``, at which point it becomes visible to the event's other members. Drafts are only ever seen by their author (and privileged actors).
    - `previous_status` 'draft' | 'open' | 'triaged' | 'invalid' | 'fixed' | 'duplicate' | 'accepted': Finding lifecycle status. ``DRAFT`` is the author-private pre-submission state: a hacker (or machine) composes the finding as a draft, then ``submit`` advances it to ``OPEN`` / ``TRIAGED``, at which point it becomes visible to the event's other members. Drafts are only ever seen by their author (and privileged actors).
    - `severity` string, required
    - `score` number, nullable
    - `requested_score` number, nullable
    - `cve` string, nullable
    - `cvss_vector` string, nullable
    - `created` string, date-time, required
    - `pentest_slug` string, nullable
    - `epss` FindingEpssResponse: The latest EPSS sample for a finding's CVE. Attributes: score (float): EPSS score. percentile (float): EPSS percentile. date (datetime.date): Date the sample was published.
      - `score` number, required
      - `percentile` number, required
      - `date` string, date, required
    - `kev` boolean, nullable: Whether the CVE is in the CISA KEV catalog
    - `priority` number: Triage urgency in [0, 3]; lower is more urgent
    - `event_slug` string, nullable, required: Previous name for pentest_slug.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)