---
title: "List changes"
method: GET
path: "/v1/changes"
tags: ["Changes"]
---

# List changes

`GET /v1/changes`

## Request

- Base URL: `https://api.ironfang.com/security`
- URL: `https://api.ironfang.com/security/v1/changes`
- Auth: HTTP bearer

Changes across the organisation's domains, newest first.

## Query parameters

- `domain_id` string, uuid
- `scan_id` string, uuid
- `group` 'new' | 'resolved' | 'exposure' | 'certificates' | 'dns' | 'monitoring': The Changes feed's filters.
- `cursor` string
- `limit` integer

## Response `200`

Changes.

- object
  - `items` ChangeEvent[], required
    - `acknowledged` object: Someone has reviewed it. The finding is unchanged.
      - `at` string, date-time, required
      - `by` string, required
    - `details` object, required: Before and after where a change has them: a replaced certificate's issuer, names and expiry; a record's values. Expiry warnings carry `milestone`, `not_after`, `seen_at` and, when Ironfang could not look again before warning, `confirmed: false`.
    - `domain` string, required
    - `domain_id` string, uuid, required
    - `finding_id` string, uuid
    - `group` 'new' | 'resolved' | 'exposure' | 'certificates' | 'dns' | 'monitoring', required: The Changes feed's filters.
    - `host` string
    - `id` string, uuid, required
    - `occurred_at` string, date-time, required
    - `previous_scan_id` string, uuid: The scan it was compared with.
    - `scan_id` string, uuid: The scan that found it. Absent for expiry warnings between scans.
    - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info', required
    - `summary` string, required: Plain English, safe to show as is.
    - `title` string, required
    - `type` 'finding_new' | 'finding_resolved' | 'finding_recurred' | 'finding_severity_increased' | 'finding_severity_decreased' | 'service_exposed' | 'service_removed' | 'certificate_changed' | 'certificate_expiring' | 'certificate_expired' | 'tls_configuration_weakened' | 'tls_configuration_improved' | 'dns_record_changed' | 'dns_security_weakened' | 'dns_security_improved' | 'spf_changed' | 'dmarc_changed' | 'email_security_weakened' | 'email_security_improved' | 'http_security_weakened' | 'http_security_improved' | 'monitoring_scan_failed' | 'monitoring_scan_recovered' | 'monitoring_paused', required
  - `next_cursor` string, required

## Other responses

- `400`: An error.
- `default`: An error.

---

[API](https://skmtc.dev/ironfang/apis/ironfang-security-api.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-security-api/revisions/73bd66283d59?raw)