---
title: "Get a finding"
method: GET
path: "/v1/findings/{findingId}"
tags: ["Findings"]
---

# Get a finding

`GET /v1/findings/{findingId}`

## Request

- Base URL: `https://api.ironfang.com/security`
- URL: `https://api.ironfang.com/security/v1/findings/{findingId}`
- Auth: HTTP bearer

What was found, why it matters, the evidence, how to fix it and its history.

## Response `200`

The finding.

- Finding
  - `asset` AssetRef, required
    - `id` string, uuid, required
    - `name` string, required
    - `type` 'domain' | 'hostname' | 'ip_address' | 'service' | 'website' | 'host' | 'virtual_machine' | 'container' | 'container_image' | 'kubernetes_cluster' | 'kubernetes_namespace' | 'cloud_account' | 'wordpress_installation' | 'repository' | 'application' | 'api', required
  - `category` 'dns' | 'tls' | 'http' | 'email' | 'exposure' | 'technology' | 'discovery' | 'configuration' | 'vulnerability' | 'access_control' | 'authentication' | 'secrets' | 'network' | 'logging' | 'malware' | 'data_protection' | 'other', required: The area a finding is in; the first seven are the External Security Check's.
  - `check_id` string, required: Canonical, namespaced and permanent, e.g. ironfang.http.hsts_missing.
  - `confidence` 'confirmed' | 'high' | 'medium' | 'low', required: How sure Ironfang is. `low` is presented as "potential".
  - `detail` string: What was observed in this instance.
  - `domain_id` string, uuid, required: asset.id.
  - `first_seen_at` string, date-time, required
  - `host` string, required: resource.identifier.
  - `id` string, uuid, required
  - `key` string, required: The producer's own key (the catalogue key, e.g. http.hsts_missing, for the External Security Check). Use check_id.
  - `kind` 'issue' | 'hardening' | 'informational' | 'potential_vulnerability', required
  - `last_seen_at` string, date-time, required
  - `resolved_at` string, date-time
  - `resource` Resource, required
    - `identifier` string, required
    - `identity` object: What tells two instances of one check on one resource apart (a port, a cookie name).
    - `type` string, required: host, file, wordpress_plugin, kubernetes_container, ... or asset (the asset itself).
  - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info', required
  - `source` Source, required
    - `name` string, required
    - `native_severity` string: The producer's own severity, before normalisation.
    - `type` 'external_scan' | 'wordpress_agent' | 'linux_agent' | 'kubernetes_agent' | 'container_scanner' | 'cloud_integration' | 'dependency_scanner' | 'ai_assessment' | 'nuclei' | 'import' | 'manual', required: What kind of producer a result came from. external_scan is the External Security Check and cannot be submitted.
  - `status` 'open' | 'in_progress' | 'resolved' | 'accepted' | 'suppressed' | 'false_positive', required: open and in_progress still ask something of you. resolved is no longer present. accepted is real with the risk accepted; suppressed is hidden without a judgement; false_positive is not real.
  - `title` string, required
  - `verification` 'unverified' | 'fixed_verified' | 'still_present', required: Whether an assessment has confirmed the current state.
  - `check` object, required
    - `category` 'dns' | 'tls' | 'http' | 'email' | 'exposure' | 'technology' | 'discovery' | 'configuration' | 'vulnerability' | 'access_control' | 'authentication' | 'secrets' | 'network' | 'logging' | 'malware' | 'data_protection' | 'other', required: The area a finding is in; the first seven are the External Security Check's.
    - `group` object: What the producer ran (the External Security Check's catalogue check).
      - `id` string, required
      - `title` string
    - `id` string, required
    - `subcategory` string
    - `title` string, required
    - `version` string, required
  - `classifications` Classification[], required
    - `id` string, required: e.g. CVE-2026-12345, CWE-79, A05:2021, 1.1.1.
    - `scheme` 'cve' | 'cwe' | 'ghsa' | 'osv' | 'owasp_top10' | 'owasp_asvs' | 'capec' | 'mitre_attack' | 'cis' | 'nist_800_53' | 'nist_csf' | 'cyber_essentials' | 'iso27001' | 'pci_dss', required
  - `cvss` Cvss
    - `base_score` number, required
    - `vector` string
    - `version` '2.0' | '3.0' | '3.1' | '4.0', required
  - `cwe` string: The first cwe classification.
  - `description` string
  - `docs_url` string, uri
  - `evidence` Evidence[], required
    - `assessment_id` string, uuid, required
    - `captured_at` string, date-time, required
    - `content_type` string
    - `data` unknown, required
    - `id` string, uuid, required
    - `kind` 'dns_answer' | 'certificate' | 'tls_handshake' | 'http_response' | 'tcp_connect' | 'service_banner' | 'certificate_transparency' | 'note' | 'http_request' | 'http_headers' | 'file' | 'configuration' | 'package' | 'software_version' | 'kubernetes_object' | 'command_output' | 'matcher' | 'native_result' | 'screenshot', required
    - `label` string, required
    - `redactions` string[]: Kinds of secret removed before it was stored.
    - `scan_id` string, uuid
    - `sensitivity` 'public' | 'internal' | 'confidential' | 'restricted', required: public is what the internet sees; restricted is never stored.
    - `sha256` string, required
    - `size_bytes` integer, required
    - `storage` 'inline' | 'local' | 'withheld', required: inline is stored; local is kept by the producer and withheld was too sensitive to keep (data is null, sha256 proves what was seen).
    - `summary` string, required: label.
  - `fingerprint` string, required: SHA-256 of the finding's identity (docs: the Ironfang Finding Format).
  - `fix` string, required: remediation.guidance.
  - `history` FindingEvent[], required
    - `actor` Person
      - `label` string, required
    - `at` string, date-time, required
    - `confidence` 'confirmed' | 'high' | 'medium' | 'low': How sure Ironfang is. `low` is presented as "potential".
    - `from_confidence` 'confirmed' | 'high' | 'medium' | 'low': How sure Ironfang is. `low` is presented as "potential".
    - `from_severity` 'critical' | 'high' | 'medium' | 'low' | 'info'
    - `from_status` 'open' | 'in_progress' | 'resolved' | 'accepted' | 'suppressed' | 'false_positive': open and in_progress still ask something of you. resolved is no longer present. accepted is real with the risk accepted; suppressed is hidden without a judgement; false_positive is not real.
    - `kind` 'detected' | 'seen' | 'status_changed' | 'recheck_requested' | 'recheck_resolved' | 'recheck_still_present' | 'resolved' | 'reopened' | 'severity_changed' | 'confidence_changed' | 'identity_merged', required: reopened is a finding that was resolved and came back (the same issue, recurring). severity_changed and confidence_changed are recorded by the scan that saw the change. identity_merged marks findings for one port on different addresses combined into one.
    - `note` string
    - `scan_id` string, uuid
    - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info'
    - `to_status` 'open' | 'in_progress' | 'resolved' | 'accepted' | 'suppressed' | 'false_positive': open and in_progress still ask something of you. resolved is no longer present. accepted is real with the risk accepted; suppressed is hidden without a judgement; false_positive is not real.
  - `impact` string: Why it matters.
  - `note` string: The latest note recorded with a status change.
  - `observations` Observation[], required: The latest sightings, newest first.
    - `assessment_id` string, uuid, required
    - `detail` string
    - `id` string, uuid, required
    - `native` object
    - `native_check_id` string, required
    - `observed_at` string, date-time, required
    - `result_id` string
  - `recheck` Recheck, required
    - `available` boolean, required
    - `available_at` string, date-time
    - `reason` string: Why a recheck cannot start now.
    - `scan_id` string, uuid: The recheck in progress.
  - `references` string[], required
  - `related` RelatedFinding[], required
    - `check_id` string, required
    - `id` string, uuid, required
    - `kind` 'related_to' | 'duplicate_of' | 'caused_by' | 'parent_of', required
    - `reason` string
    - `source_type` 'external_scan' | 'wordpress_agent' | 'linux_agent' | 'kubernetes_agent' | 'container_scanner' | 'cloud_integration' | 'dependency_scanner' | 'ai_assessment' | 'nuclei' | 'import' | 'manual', required: What kind of producer a result came from. external_scan is the External Security Check and cannot be submitted.
    - `status` 'open' | 'in_progress' | 'resolved' | 'accepted' | 'suppressed' | 'false_positive', required: open and in_progress still ask something of you. resolved is no longer present. accepted is real with the risk accepted; suppressed is hidden without a judgement; false_positive is not real.
    - `title` string, required
  - `remediation` Remediation, required
    - `action` RemediationAction
      - `available` boolean: A producer attached to the finding's asset advertises this action and was seen in the last seven days.
      - `description` string, required
      - `id` string, required: e.g. wordpress.update_plugin.
      - `parameters` union
        - object: On a finding, the values this finding gives the action.
        - string[]: In the registry, the parameter names the action takes.
      - `requires_confirmation` boolean, required
      - `restart` 'none' | 'service' | 'workload' | 'host', required
      - `reversible` boolean, required
      - `risk` 'low' | 'medium' | 'high', required
      - `title` string, required
    - `guidance` string: What a person should do. May contain inline `code`.
  - `summary` string, required: What this kind of issue is.
  - `why` string, required: impact.

## Other responses

- `404`: An error.
- `default`: An error.

---

[API](https://skmtc.dev/ironfang/apis/ironfang-security-api.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-security-api/revisions/73bd66283d59?raw)