FIfireblocks
Security Posture Management

Get a FSPM security finding by ID

Returns a single FSPM security finding for the workspace, redacted to the public field set. Endpoint Roles: Security Admin, Security Auditor.

Note: This endpoint is available only for the FSPM Pro package. It is not available for FSPM Basic.

get/security/fspm/findings/{id}

Request

Path parameters

idstring uuid required

Unique identifier of the finding

Response

A single FSPM finding

idstring uuid required

Unique identifier of the finding

status'OPEN' | 'ACCEPTED' | 'RESOLVED' required

Current status of the finding

severity'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' required

Severity level of the finding

category'USER_MANAGEMENT' | 'APPROVAL_GROUP_MANAGEMENT' | 'POLICY_ENGINE_UTILIZATION' | 'WORKSPACE_CONFIGURATION' | 'DEFI_ACCESS' | 'FLEET_MANAGEMENT' required

Category of the finding

createdAtstring date-time required

When the finding was first detected

titlestring required

Human-readable title of the finding

statusUpdatedAtstring date-time

When the finding status was last updated, omitted if the status was never updated

statusUpdatedByUserIdstring uuid

The user who last updated the finding status, omitted if the status was never updated

statusUpdatedReasonstring

The reason provided for the last status update, omitted if none was provided

infoFindingInfo required

Additional structured context about the finding. Shape varies by finding type.

riskExplanationstring required

Explanation of the risk this finding represents

mitigationGuidancestring required

Guidance on how to mitigate this finding

Example response

{
  "id": "2f8a132e-623d-3a97-841f-2c5d9b7a3e60",
  "status": "ACCEPTED",
  "severity": "MEDIUM",
  "category": "USER_MANAGEMENT",
  "createdAt": "2026-07-21T07:49:28.000Z",
  "title": "The API user 'Admin API' is missing an IP allowlist",
  "statusUpdatedAt": "2026-08-16T08:52:57.000Z",
  "statusUpdatedByUserId": "7c2e3a4f-144d-4f23-932c-518b3d7f1a09",
  "statusUpdatedReason": "False positive, the API user only ever connects from a fixed, trusted network",
  "info": {
    "id": "2a6f3c4e-9d33-437e-8f2a-2c9b4d3e1f35",
    "createdAt": "2026-05-12T12:06:26.242Z",
    "email": "",
    "enabled": true,
    "firstName": "Admin API",
    "isWhitelisted": false,
    "lastName": "testd6",
    "role": "ADMIN",
    "status": "READY",
    "tenantId": "6d13843c-4e2b-4a22-2c6f-3b8e3d4a7f52",
    "userType": "API"
  },
  "complianceReqs": [
    {
      "id": "8a1e6f19-1c4b-2d7e-2f1a-2b6c8d2e4f50",
      "standard": "SOC 2",
      "criteria": "CC6.2",
      "description": "Access provisioning and credential lifecycle"
    },
    {
      "id": "5e2b8e47-ea9c-ef36-8e2d-ea4b9c3e6f18",
      "standard": "SOC 2",
      "criteria": "CC6.3",
      "description": "Least privilege and attack surface, roles and SoD"
    }
  ],
  "riskExplanation": "This API user has no IP allowlist, so it can be accessed from anywhere, increasing the risk of unauthorized activity.",
  "mitigationGuidance": "Go to Developer Center > API Users, click the actions button (3 dots) next to the API user, and select 'Allowlist IP address'."
}

Changes

No recorded changes to this operation across all 1 revision of this API.