---
title: "Findings, filtered and paged."
method: GET
path: "/surveillance/findings"
tags: ["surveillance"]
---

# Findings, filtered and paged.

`GET /surveillance/findings`

## Request

- Base URL: `https://api.ismalicious.com`
- URL: `https://api.ismalicious.com/surveillance/findings`
- Auth: one of:
  - API key in header `X-API-KEY`
  - HTTP bearer
  - HTTP basic

## Query parameters

- `status` 'Open' | 'Acknowledged' | 'Snoozed' | 'Patched' | 'Fixed' | 'NotAffected' | 'AcceptedRisk': `ExposureFinding.status`. `Fixed` is written by a read, never by hand.
- `tab` string
- `priority` 'P1' | 'P2' | 'P3': `ExposureFinding.priority`: P1 immediate, P2 daily digest, P3 weekly (default cadences; the organisation's policy can change them).
- `proof` 'Exploited' | 'Kev' | 'Likely' | 'Unverified' | 'Low': `ExposureFinding.proof` — the Exposure group, in display order.
- `sourceId` string
- `cve` string
- `page` integer
- `pageSize` integer

## Response `200`

OK

- FindingsPage
  - `findings` FindingDto[], required
    - `caseId` string, nullable
    - `closedAt` string, date-time, nullable
    - `closedReason` 'FixedVersionRead' | 'ComponentRemoved' | 'User': `ExposureFinding.closedReason`.
    - `commonName` string, nullable
    - `components` FindingComponentDto[], required
      - `affectedRange` string, nullable
      - `componentId` string, required
      - `distroBackport` boolean, required: A distro banner: verify the package before acting.
      - `fixedVersion` string, nullable
      - `matchSources` MatchSource[], required
      - `name` string, required
      - `observedVersion` string, nullable
      - `readAt` string, date-time, nullable: When the version was last read (age of the reading).
      - `sourceId` string, required
      - `sourceKind` 'Domain' | 'Lockfile' | 'Manual', required: `WatchSource.kind` — the unit of sale.
      - `sourceName` string, required
      - `versionEvidence` string, nullable
      - `versionSource` 'Header' | 'MetaTag' | 'ScriptPath' | 'PortBanner' | 'Lockfile' | 'Sbom' | 'Manual' | 'LegacyCpe' | 'None', required: `WatchComponent.versionSource` — where the version was read.
      - `versionState` 'Affected' | 'Unverified' | 'NotAffected' | 'Fixed', required: `ExposureFinding.versionState` / `ExposureFindingComponent.versionState`.
      - `versionVerified` boolean, required
    - `cveId` string, required
    - `cvssScore` number, double, nullable
    - `cvssVersion` string, nullable
    - `detectedAt` string, date-time, required
    - `epssScore` number, double, nullable
    - `exploitationFirstSeenAt` string, date-time, nullable
    - `exploitationStatus` string, nullable
    - `fixGroupKey` string, nullable
    - `fixedVersion` string, nullable
    - `id` string, required
    - `isKev` boolean, required
    - `kevDateAdded` string, date-time, nullable
    - `note` string, nullable
    - `notices` SourceNotice[], required: Notices the terms of a source behind its components' matches require to be shown with it, verbatim: VulnCheck's (§12) when a component carries `VULNCHECK`. Empty otherwise.
      - `matchSource` 'NvdCpe' | 'Osv' | 'Csaf' | 'VulnCheck' | 'OpenCve' | 'Legacy' | 'Cna', required: `ExposureFindingComponent.matchSources` entries.
      - `name` string, required: `VulnCheck`.
      - `source` string, required: The source's id in the attribution manifest (`GET /cve/attribution`): `vulncheck`.
      - `termsUrl` string, nullable: The terms that require the notice.
      - `text` string, required: Shown as is: « This product uses data from VulnCheck (https://vulncheck.com). »
      - `url` string, required: The publisher's site.
    - `notifiedAt` string, date-time, nullable
    - `patchAvailable` boolean, nullable
    - `priority` 'P1' | 'P2' | 'P3', required: `ExposureFinding.priority`: P1 immediate, P2 daily digest, P3 weekly (default cadences; the organisation's policy can change them).
    - `proof` 'Exploited' | 'Kev' | 'Likely' | 'Unverified' | 'Low', required: `ExposureFinding.proof` — the Exposure group, in display order.
    - `relatedCveIds` string[], required: Other open findings fixed by the same upgrade.
    - `severity` string, nullable
    - `signalState` SignalState, required: `ExposureFinding.signalState` / `notifiedState`. A push-worthy change is a false→true of `kev`, `exploited`, `poc` or `patch`; `epss_high` false→true reopens and goes to the digest, never to an immediate alert; numeric EPSS moves are not state (build spec §2.3.6).
      - `epssHigh` boolean
      - `exploited` boolean
      - `kev` boolean
      - `patch` boolean
      - `poc` boolean
    - `snoozedUntil` string, date-time, nullable
    - `status` 'Open' | 'Acknowledged' | 'Snoozed' | 'Patched' | 'Fixed' | 'NotAffected' | 'AcceptedRisk', required: `ExposureFinding.status`. `Fixed` is written by a read, never by hand.
    - `statusUpdatedAt` string, date-time, required
    - `title` string, nullable
    - `versionState` 'Affected' | 'Unverified' | 'NotAffected' | 'Fixed', required: `ExposureFinding.versionState` / `ExposureFindingComponent.versionState`.
  - `page` integer, required
  - `pageSize` integer, required
  - `total` integer, required

## Other responses

- `400`: Invalid request
- `401`: Unauthorized

## Changes

- **2026-11-01** `e802f56e895a`: 1 warning, 1 info
  - added the new `Cna` enum value to the `findings/items/components/items/matchSources/items/` response property for the response status `200`
  - added the required property `findings/items/notices` to the response with the `200` status
- **2026-10-31** `a59f0651364e`: 1 warning
  - added the new `VulnCheck` enum value to the `findings/items/components/items/matchSources/items/` response property for the response status `200`
- **2026-10-23** `7c8ce9039cf7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/surveillance/findings/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) - [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/b6f45e6169a7?raw)