---
title: "Get Detection Route"
method: GET
path: "/api/v1/detections/{detection_id}"
---

# Get Detection Route

`GET /api/v1/detections/{detection_id}`

## Request

- Base URL: `https://api.stacktrace.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stacktrace.ai/api/v1/detections/{detection_id}`
- Auth: none declared

## Path parameters

- `detection_id` string, required

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- DetectionDetail
  - `finding_targets` FindingTargetView[]
  - `id` string, required
  - `rule_id` string, required
  - `title` string, nullable
  - `family` string, nullable
  - `stage` string, nullable
  - `remediation_key` string, nullable
  - `severity` string, required
  - `confidence` string, required
  - `scope` string, required
  - `status` string, required
  - `session_id` string, required
  - `session_started_at` string, nullable
  - `occurred_start` string, nullable
  - `occurred_end` string, nullable
  - `session_turn_count` integer, required
  - `session_surface` 'chatgpt-work', nullable
  - `session_title` string, nullable
  - `session_opening_words` string, nullable
  - `advisories` object
  - `session_person` string, nullable
  - `action` string, nullable
  - `decided_by` DecidedByRow: The client release and the policy revision behind a gateway finding.
    - `rules` string, required
    - `policy_revision` integer, nullable
  - `where` string, nullable
  - `first_seen_at` string, required
  - `last_seen_at` string, required
  - `agent_id` string, required
  - `agent_kind` string, required
  - `asset_id` string, required
  - `asset_display_name` string, required
  - `components` DetectionComponentAttribution[]
    - `identity` string, nullable
    - `name` string, required
    - `version` string, nullable
    - `component_type` string, nullable
    - `kind` 'component' | 'ambiguous' | 'builtin' | 'unplaced', required
    - `role` 'subject' | 'source' | 'context', required
  - `component_group` DetectionComponentGroup: Finding membership metadata, independent of the expanded attribution list.
    - `component` string, required
    - `component_label` string, nullable
    - `subject_kind` string, nullable
    - `component_type` string, nullable
  - `subject` DetectionParticipantRef: One named party to a finding, as stored. `kind` is the field a client must read before it renders `name`. Only `component` is verified inventory with an identity behind it; `builtin` is the agent's own tool, and `unplaced` was called and matched nothing on the machine. A client **must** mark the latter two and **must not** link them or resolve a lookup by them -- two machines can call unrelated servers `support`, so a name is not an identity. `identity` is null for every kind but `component`, enforced by a check constraint rather than convention.
    - `kind` string, required
    - `role` string, required
    - `name` string, required
    - `component_type` string, nullable
    - `identity` string, nullable
  - `involved` DetectionParticipantRef[]: Deprecated: read source-role entries in components.
    - `kind` string, required
    - `role` string, required
    - `name` string, required
    - `component_type` string, nullable
    - `identity` string, nullable
  - `policy_targets` ComponentPolicyTarget[]
    - `identity` string, nullable
    - `name` string, required
    - `target` PolicyMcpTarget: One OpenACA `admission.mcps` target: exactly one of the two is set. Derived from the agent's current BOM the way OpenACA's matcher reads it, so a policy that lists it under `blocked` blocks that component in a dry run.
      - `command` string[], nullable
      - `url` string, nullable
    - `unavailable` 'not_an_mcp_server' | 'no_identity' | 'not_in_current_bom' | 'controlled_by_plugin' | 'no_exact_target' | 'ambiguous' | 'may_carry_credential' | 'unidentified_service', nullable
    - `provider_plugin` ProviderPlugin: A current BOM plugin and its exact admission target.
      - `identity` string, required
      - `name` string, required
      - `policy_target` string, required
  - `remediation` string, nullable
  - `anchor_span` string, nullable
  - `observed_capabilities` string[]
  - `evidence` DetectionEvidenceRow[]
    - `position` integer, required
    - `span` string, required
    - `kind` string, required
    - `detail` string, required
    - `turn_occurred_at` string, nullable
  - `run_history` RunHistoryRow[]
    - `detect_run_id` string, required
    - `observed_through` string, required
    - `recorded_at` string, required
  - `run_history_total` integer

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api.md) - [All operations](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api/revisions/0ee5484d1d0b?raw)