---
title: "This resource returns a list of finding details from an action plan of a TOE."
method: GET
path: "/v1/action_plan/findings/{toe_id}"
tags: ["Action Plans"]
---

# This resource returns a list of finding details from an action plan of a TOE.

`GET /v1/action_plan/findings/{toe_id}`

## Request

- Base URL: `https://api.sandbox.riskrecon.com`
- URL: `https://api.sandbox.riskrecon.com/v1/action_plan/findings/{toe_id}`
- Auth: HTTP bearer

This API returns a list of findings for a given action plan of a TOE. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.

## Path parameters

- `toe_id` string, required

## Query parameters

- `page` integer
- `per_page` integer
- `sort_attribute` 'days_open' | 'security_criteria' | 'asset_value' | 'severity' | 'priority'
- `sort_method` 'ASC' | 'DESC'
- `severity` 'critical' | 'high' | 'medium' | 'low'
- `asset_value` 'high' | 'medium' | 'low' | 'idle' | 'key'
- `security_domain` string
- `security_criteria` string
- `cve_ids[]` string[]

## Response `200`

OK

- PaginatedFindings
  - `meta` PaginationMeta
    - `current_page` integer: The current page of paginated responses.
    - `next_page` integer, nullable: The next page of paginated responses if applicable.
    - `prev_page` integer, nullable: The previous page of paginated responses if applicable.
    - `total_count` integer: The total count of items.
    - `total_pages` integer: The total number of pages for paginated responses.
  - `data` object[]: Data associated with response object.
    - `attributes` PaginatedFinding: finding details
      - `analysis_id` string, required: The unique identifier for an Analysis.
      - `asset_value` string, required: The numeric asset_value associated with a findings host.
      - `cve_ids` string[], nullable: The CVE ids associated with the finding.
      - `domain_name` string, nullable, required: The domain name associated with a finding.
      - `finding_data_description` string, required: The description of the finding data.
      - `finding_data_value` string, nullable, required: The type of finding data.
      - `finding_detail` string, nullable, required: Details about the finding.
      - `finding_extra_data_value` string, nullable, required: Any additional data associated with finding.
      - `finding_id` string, required: Unique identifier for the finding.
      - `finding_short_description` string, nullable, required: The finding data description.
      - `first_seen` string, required: The date the finding was first seen.
      - `host_name` string, nullable, required: The name of the host.
      - `hosting_provider` string, nullable, required: The hosting provider if available.
      - `how_to_fix_it` string, required: How to fix the finding.
      - `ip_address` string, nullable, required: The ip address for the finding if available.
      - `last_seen` string, required: The date the finding was last seen.
      - `privacy_criteria` string, nullable: If the finding matches one of our categories in the privacy risk dimension, this field will contain the key of that security_criteria category.
      - `security_criteria` string, required: The security_criteria category associated with the finding.
      - `security_domain` string, required: The security_domain category associated with the finding.
      - `severity` string, required: The severity for a finding.
      - `priority` integer, required: The finding priority based on asset_value and severity.
      - `support_site` string, required: The support site for the finding.
      - `who_should_fix_it` string, required: Who should fix the finding.
    - `id` string: The identifier associated with response object.
    - `type` string: The type of object returned.

## Other responses

- `400`: Something was wrong with the request
- `401`: Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.
- `403`: FORBIDDEN
- `404`: The URI didn't match an existing resource.

---

[API](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/revisions/212ef0eeee9b?raw)