---
title: "This resource returns a list of finding details from an action plan of a TOE."
method: GET
path: "/v1/action_plan/findings/{toe_id}"
tags: ["Action Plans"]
---

# This resource returns a list of finding details from an action plan of a TOE.

`GET /v1/action_plan/findings/{toe_id}`

This API returns a list of findings for a given action plan of a TOE. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.

## Path parameters

- `toe_id` string, required

## Query parameters

- `page` integer
- `per_page` integer
- `sort_attribute` 'days_open' | 'security_criteria' | 'asset_value' | 'severity' | 'priority'
- `sort_method` 'ASC' | 'DESC'
- `severity` 'critical' | 'high' | 'medium' | 'low'
- `asset_value` 'high' | 'medium' | 'low' | 'idle' | 'key'
- `security_domain` string
- `security_criteria` string
- `cve_ids[]` string[]

## Response `200`

OK

- PaginatedFindings
  - `meta` PaginationMeta
    - `current_page` integer — The current page of paginated responses.
    - `next_page` integer, nullable — The next page of paginated responses if applicable.
    - `prev_page` integer, nullable — The previous page of paginated responses if applicable.
    - `total_count` integer — The total count of items.
    - `total_pages` integer — The total number of pages for paginated responses.
  - `data` object[] — Data associated with response object.
    - `attributes` PaginatedFinding — finding details
      - `analysis_id` string, required — The unique identifier for an Analysis.
      - `asset_value` string, required — The numeric asset_value associated with a findings host.
      - `cve_ids` string[], nullable — The CVE ids associated with the finding.
      - `domain_name` string, nullable, required — The domain name associated with a finding.
      - `finding_data_description` string, required — The description of the finding data.
      - `finding_data_value` string, nullable, required — The type of finding data.
      - `finding_detail` string, nullable, required — Details about the finding.
      - `finding_extra_data_value` string, nullable, required — Any additional data associated with finding.
      - `finding_id` string, required — Unique identifier for the finding.
      - `finding_short_description` string, nullable, required — The finding data description.
      - `first_seen` string, required — The date the finding was first seen.
      - `host_name` string, nullable, required — The name of the host.
      - `hosting_provider` string, nullable, required — The hosting provider if available.
      - `how_to_fix_it` string, required — How to fix the finding.
      - `ip_address` string, nullable, required — The ip address for the finding if available.
      - `last_seen` string, required — The date the finding was last seen.
      - `privacy_criteria` string, nullable — If the finding matches one of our categories in the privacy risk dimension, this field will contain the key of that security_criteria category.
      - `security_criteria` string, required — The security_criteria category associated with the finding.
      - `security_domain` string, required — The security_domain category associated with the finding.
      - `severity` string, required — The severity for a finding.
      - `priority` integer, required — The finding priority based on asset_value and severity.
      - `support_site` string, required — The support site for the finding.
      - `who_should_fix_it` string, required — Who should fix the finding.
    - `id` string — The identifier associated with response object.
    - `type` string — The type of object returned.

## Other responses

- `400` — Something was wrong with the request
- `401` — Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.
- `403` — FORBIDDEN
- `404` — The URI didn't match an existing resource.

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)