---
title: "List findings"
method: GET
path: "/v1/findings"
tags: ["Findings"]
---

# List findings

`GET /v1/findings`

## Request

- Base URL: `https://api.ironfang.com/security`
- URL: `https://api.ironfang.com/security/v1/findings`
- Auth: HTTP bearer

Findings across the organisation from every producer, most severe first. By default only findings that still ask something of you (open, in_progress) are listed; pass `status` to choose.

## Query parameters

- `asset_id` string, uuid
- `domain_id` string, uuid
- `assessment_id` string, uuid
- `scan_id` string, uuid
- `source_type` 'external_scan' | 'wordpress_agent' | 'linux_agent' | 'kubernetes_agent' | 'container_scanner' | 'cloud_integration' | 'dependency_scanner' | 'ai_assessment' | 'nuclei' | 'import' | 'manual': What kind of producer a result came from. external_scan is the External Security Check and cannot be submitted.
- `check_id` string
- `status` string
- `severity` string
- `cursor` string
- `limit` integer

## Response `200`

Findings.

- object
  - `items` FindingSummary[], required
    - `asset` AssetRef, required
      - `id` string, uuid, required
      - `name` string, required
      - `type` 'domain' | 'hostname' | 'ip_address' | 'service' | 'website' | 'host' | 'virtual_machine' | 'container' | 'container_image' | 'kubernetes_cluster' | 'kubernetes_namespace' | 'cloud_account' | 'wordpress_installation' | 'repository' | 'application' | 'api', required
    - `category` 'dns' | 'tls' | 'http' | 'email' | 'exposure' | 'technology' | 'discovery' | 'configuration' | 'vulnerability' | 'access_control' | 'authentication' | 'secrets' | 'network' | 'logging' | 'malware' | 'data_protection' | 'other', required: The area a finding is in; the first seven are the External Security Check's.
    - `check_id` string, required: Canonical, namespaced and permanent, e.g. ironfang.http.hsts_missing.
    - `confidence` 'confirmed' | 'high' | 'medium' | 'low', required: How sure Ironfang is. `low` is presented as "potential".
    - `detail` string: What was observed in this instance.
    - `domain_id` string, uuid, required: asset.id.
    - `first_seen_at` string, date-time, required
    - `host` string, required: resource.identifier.
    - `id` string, uuid, required
    - `key` string, required: The producer's own key (the catalogue key, e.g. http.hsts_missing, for the External Security Check). Use check_id.
    - `kind` 'issue' | 'hardening' | 'informational' | 'potential_vulnerability', required
    - `last_seen_at` string, date-time, required
    - `resolved_at` string, date-time
    - `resource` Resource, required
      - `identifier` string, required
      - `identity` object: What tells two instances of one check on one resource apart (a port, a cookie name).
      - `type` string, required: host, file, wordpress_plugin, kubernetes_container, ... or asset (the asset itself).
    - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info', required
    - `source` Source, required
      - `name` string, required
      - `native_severity` string: The producer's own severity, before normalisation.
      - `type` 'external_scan' | 'wordpress_agent' | 'linux_agent' | 'kubernetes_agent' | 'container_scanner' | 'cloud_integration' | 'dependency_scanner' | 'ai_assessment' | 'nuclei' | 'import' | 'manual', required: What kind of producer a result came from. external_scan is the External Security Check and cannot be submitted.
    - `status` 'open' | 'in_progress' | 'resolved' | 'accepted' | 'suppressed' | 'false_positive', required: open and in_progress still ask something of you. resolved is no longer present. accepted is real with the risk accepted; suppressed is hidden without a judgement; false_positive is not real.
    - `title` string, required
    - `verification` 'unverified' | 'fixed_verified' | 'still_present', required: Whether an assessment has confirmed the current state.
  - `next_cursor` string, required

## Other responses

- `400`: An error.
- `default`: An error.

---

[API](https://skmtc.dev/ironfang/apis/ironfang-security-api.md) · [All operations](https://skmtc.dev/ironfang/apis/ironfang-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ironfang/apis/ironfang-security-api/revisions/73bd66283d59?raw)