---
title: "List security findings"
method: GET
path: "/api/projects/{projectId}/security/findings"
tags: ["Security"]
---

# List security findings

`GET /api/projects/{projectId}/security/findings`

## Request

- Base URL: `https://api.routebase.dev`
- URL: `https://api.routebase.dev/api/projects/{projectId}/security/findings`
- Auth: API key in header `X-API-Key`

Returns the findings of a project across all scans, filtered as you need them.
A pipeline that only wants to know whether anything new broke should filter on
`status=open` and on the severities it cares about.

## Path parameters

- `ProjectId` string, uuid, required

## Query parameters

- `assignedToMe` boolean
- `scannerId` string
- `search` string
- `severity` 'info' | 'low' | 'medium' | 'high' | 'critical': How serious a security finding is.
- `Skip` integer
- `sortBy` string
- `status` 'open' | 'inProgress' | 'fixed' | 'falsePositive' | 'acceptedRisk' | 'duplicate': Where a finding stands in triage.
- `take` integer

## Headers

- `X-RB-Region` string

## Response `200`

A page of findings.

- SecurityFindingList: A page of security findings.
  - `items` SecurityFinding[], required: The findings on this page.
    - `id` string, uuid, required: Public id of the finding.
    - `scanRunPublicId` string, uuid, required: Run that reported it most recently.
    - `firstSeenScanRunPublicId` string, uuid, required: Run that reported it first. When this differs from `scanRunPublicId`, the finding has survived at least one further scan.
    - `scannerId` string, required: Scanner that produced the finding.
    - `owaspCategory` string, required: OWASP API Security category, for example `API1`.
    - `severity` 'info' | 'low' | 'medium' | 'high' | 'critical', required: How serious a security finding is.
    - `confidence` 'low' | 'medium' | 'high', required: How certain the scanner is that a finding is real.
    - `status` 'open' | 'inProgress' | 'fixed' | 'falsePositive' | 'acceptedRisk' | 'duplicate', required: Where a finding stands in triage.
    - `title` string, required: One-line summary of the problem.
    - `description` string, required: What the scanner found and why it matters.
    - `path` string, nullable: Path of the affected endpoint.
    - `method` string, nullable: HTTP method of the affected endpoint.
    - `reproductionCurl` string, nullable: A curl command that reproduces the finding.
    - `guidanceId` string, required: Id of the remediation guidance for this finding.
    - `assignedToUserId` string, uuid, nullable: Public id of the user who owns the finding. Null when nobody was assigned.
    - `assignedToUserName` string, nullable: Display name of that user.
    - `resolutionNotes` string, nullable: What was done about the finding, written when it was closed.
    - `resolvedAt` string, date-time, nullable: When the finding was closed, in UTC. Null while it is open.
    - `resolvedByUserId` string, uuid, nullable: Public id of the user who closed the finding.
    - `createdAt` string, date-time, required: When the finding was first reported, in UTC.
    - `modifiedAt` string, date-time, nullable: When the finding was last touched, in UTC.
  - `total` integer, required: Total number of matching findings, ignoring paging.
  - `skip` integer, required: How many findings were skipped to reach this page.
  - `take` integer, required: Page size that was applied.

## Other responses

- `401`: The API key is missing, invalid, expired or revoked. A US organization calling without `X-RB-Region: us` also lands here, because the request reached the wrong region.
- `403`: The key is valid but lacks the permission or the project scope for this call. A scoped key is also refused on organization level operations by design.
- `404`: The resource does not exist, or it belongs to another organization or project. Both cases answer the same way on purpose, so the API cannot be used to probe for foreign identifiers.
- `429`: The rate limit was exceeded. The `Retry-After` header gives the seconds to wait.

---

[API](https://skmtc.dev/routebase/apis/routebase-public-api.md) · [All operations](https://skmtc.dev/routebase/apis/routebase-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/routebase/apis/routebase-public-api/revisions/7187df489f27?raw)