---
title: "This resource returns a list of findings for latest analysis for a given TOE."
method: GET
path: "/v1/findings_paginated/{toe_id}"
tags: ["Findings"]
---

# This resource returns a list of findings for latest analysis for a given TOE.

`GET /v1/findings_paginated/{toe_id}`

This use case describes how the Findings API is used to retrieve a list of findings for the latest analysis for a TOE. The toe_id is passed in the API request. In this scenario, all findings for that TOE are returned in the response.
To limit or filter the data returned in the response, you can use various parameters in the API request:
* Filter by an asset value: You can use the asset_value parameter to search for findings with high, medium, or low asset value.
* Filter by severity: You can use the severity parameter to search for findings with high, medium, or low severity.
* Filter by asset value and severity: You can use asset_value and severity parameters to search for findings with high, medium, or low asset value and severity.
* Filter by page: You can use the page parameter to search for findings pages.
* Sort by Findings Attribute: You can use the sort attribute to sort results of alerting issues by available sort attributes.

## Path parameters

- `toe_id` string, required

## Query parameters

- `page` integer
- `per_page` integer
- `sort_attribute` 'days_open' | 'security_criteria' | 'asset_value' | 'severity' | 'priority'
- `sort_method` 'ASC' | 'DESC'
- `severity` 'critical' | 'high' | 'medium' | 'low'
- `asset_value` 'high' | 'medium' | 'low' | 'idle' | 'key'
- `security_domain` string
- `security_criteria` string
- `cve_ids[]` string[]
- `risk_dimension` 'cyber' | 'privacy'

## Response `200`

OK

- PaginatedFindings
  - `meta` PaginationMeta
    - `current_page` integer — The current page of paginated responses.
    - `next_page` integer, nullable — The next page of paginated responses if applicable.
    - `prev_page` integer, nullable — The previous page of paginated responses if applicable.
    - `total_count` integer — The total count of items.
    - `total_pages` integer — The total number of pages for paginated responses.
  - `data` object[] — Data associated with response object.
    - `attributes` PaginatedFinding — finding details
      - `analysis_id` string, required — The unique identifier for an Analysis.
      - `asset_value` string, required — The numeric asset_value associated with a findings host.
      - `cve_ids` string[], nullable — The CVE ids associated with the finding.
      - `domain_name` string, nullable, required — The domain name associated with a finding.
      - `finding_data_description` string, required — The description of the finding data.
      - `finding_data_value` string, nullable, required — The type of finding data.
      - `finding_detail` string, nullable, required — Details about the finding.
      - `finding_extra_data_value` string, nullable, required — Any additional data associated with finding.
      - `finding_id` string, required — Unique identifier for the finding.
      - `finding_short_description` string, nullable, required — The finding data description.
      - `first_seen` string, required — The date the finding was first seen.
      - `host_name` string, nullable, required — The name of the host.
      - `hosting_provider` string, nullable, required — The hosting provider if available.
      - `how_to_fix_it` string, required — How to fix the finding.
      - `ip_address` string, nullable, required — The ip address for the finding if available.
      - `last_seen` string, required — The date the finding was last seen.
      - `privacy_criteria` string, nullable — If the finding matches one of our categories in the privacy risk dimension, this field will contain the key of that security_criteria category.
      - `security_criteria` string, required — The security_criteria category associated with the finding.
      - `security_domain` string, required — The security_domain category associated with the finding.
      - `severity` string, required — The severity for a finding.
      - `priority` integer, required — The finding priority based on asset_value and severity.
      - `support_site` string, required — The support site for the finding.
      - `who_should_fix_it` string, required — Who should fix the finding.
    - `id` string — The identifier associated with response object.
    - `type` string — The type of object returned.

## Other responses

- `400` — Something was wrong with the request
- `401` — Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.
- `403` — FORBIDDEN
- `404` — The URI didn't match an existing resource.

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)