---
title: "List Code Scan Findings"
method: GET
path: "/v1/projects/{project_id}/code-scan/findings"
tags: ["code-scan"]
---

# List Code Scan Findings

`GET /v1/projects/{project_id}/code-scan/findings`

## Request

- Base URL: `https://api.sonenta.dev`
- URL: `https://api.sonenta.dev/v1/projects/{project_id}/code-scan/findings`
- Auth: none declared

Paginated findings for the dashboard and the CLI.

Filter by `status` and/or `file` (exact repo-relative path). `file` powers
the detail pane of the file-tree view — one file's findings without paging
the whole project. `excluded` applies the persistent exclusion list.

## Path parameters

- `project_id` string, required

## Query parameters

- `status` string, nullable: new = outstanding · treated = turned into a key · gone = no longer in the source
- `file` string, nullable: Exact repo-relative path — the file-tree detail pane. Combine with `status`.
- `excluded` string: Exclusion-rule filter (default `exclude`): `exclude` hides findings matched by a rule · `only` shows ONLY matched findings (the rule-management view) · `include` ignores rules (raw). DEFAULT CHANGES OUTPUT — matched findings vanish; no rules ⇒ unchanged.
- `limit` integer
- `offset` integer

## Response `200`

Successful Response

- CodeScanFindingsPage
  - `items` CodeScanFindingOut[], required
    - `uuid` string, required
    - `fingerprint` string, required
    - `file` string, required
    - `line` integer, required
    - `column` integer, nullable
    - `string` string, required
    - `status` string, required
    - `category` string: Scanner classification: keyless / key_default / unknown. `unknown` for findings recorded before the field existed.
    - `source` string, nullable: Where the text lives: `attribute` | `element` | null. Display only. null for findings recorded before the field existed, or when the scan omitted it.
    - `source_name` string, nullable: Attribute name or tag/component name (e.g. `placeholder`, `button`, `Foo.Bar`); null when unknown. Display only.
    - `suggested_namespace` string, nullable
    - `treated_key` string, nullable
    - `treated_namespace` string, nullable: Namespace of the treated key, when it was validated at treat time.
    - `treated_at` string, date-time, nullable
    - `first_seen_scan_id` string, required
    - `last_seen_scan_id` string, required
    - `first_seen_at` string, date-time, nullable
    - `last_seen_at` string, date-time, nullable
  - `total` integer, required
  - `limit` integer, required
  - `offset` integer, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sonenta/apis/sonenta-api.md) · [All operations](https://skmtc.dev/sonenta/apis/sonenta-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sonenta/apis/sonenta-api/revisions/f853ea49fb05?raw)