---
title: "List Detections Route"
method: GET
path: "/api/v1/detections"
---

# List Detections Route

`GET /api/v1/detections`

## Request

- Base URL: `https://api.stacktrace.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stacktrace.ai/api/v1/detections`
- Auth: none declared

## Query parameters

- `cursor` string, nullable
- `limit` integer
- `severity` string, nullable
- `family` string, nullable
- `rule_id` string, nullable
- `agent_kind` string, nullable
- `agent_id` string, nullable
- `asset_id` string, nullable
- `status` string, nullable
- `component` string, nullable
- `window` '1d' | '3d' | '7d' | '30d' | 'all', nullable

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- DetectionsResponse
  - `items` DetectionRow[], required
    - `finding_targets` FindingTargetView[]
    - `id` string, required
    - `rule_id` string, required
    - `title` string, nullable
    - `family` string, nullable
    - `stage` string, nullable
    - `remediation_key` string, nullable
    - `severity` string, required
    - `confidence` string, required
    - `scope` string, required
    - `status` string, required
    - `session_id` string, required
    - `session_started_at` string, nullable
    - `occurred_start` string, nullable
    - `occurred_end` string, nullable
    - `session_turn_count` integer, required
    - `session_surface` 'chatgpt-work', nullable
    - `session_title` string, nullable
    - `session_opening_words` string, nullable
    - `advisories` object
    - `session_person` string, nullable
    - `action` string, nullable
    - `decided_by` DecidedByRow: The client release and the policy revision behind a gateway finding.
      - `rules` string, required
      - `policy_revision` integer, nullable
    - `where` string, nullable
    - `first_seen_at` string, required
    - `last_seen_at` string, required
    - `agent_id` string, required
    - `agent_kind` string, required
    - `asset_id` string, required
    - `asset_display_name` string, required
    - `components` DetectionComponentAttribution[]
      - `identity` string, nullable
      - `name` string, required
      - `version` string, nullable
      - `component_type` string, nullable
      - `kind` 'component' | 'ambiguous' | 'builtin' | 'unplaced', required
      - `role` 'subject' | 'source' | 'context', required
    - `component_group` DetectionComponentGroup: Finding membership metadata, independent of the expanded attribution list.
      - `component` string, required
      - `component_label` string, nullable
      - `subject_kind` string, nullable
      - `component_type` string, nullable
    - `subject` DetectionParticipantRef: One named party to a finding, as stored. `kind` is the field a client must read before it renders `name`. Only `component` is verified inventory with an identity behind it; `builtin` is the agent's own tool, and `unplaced` was called and matched nothing on the machine. A client **must** mark the latter two and **must not** link them or resolve a lookup by them -- two machines can call unrelated servers `support`, so a name is not an identity. `identity` is null for every kind but `component`, enforced by a check constraint rather than convention.
      - `kind` string, required
      - `role` string, required
      - `name` string, required
      - `component_type` string, nullable
      - `identity` string, nullable
    - `involved` DetectionParticipantRef[]: Deprecated: read source-role entries in components.
      - `kind` string, required
      - `role` string, required
      - `name` string, required
      - `component_type` string, nullable
      - `identity` string, nullable
  - `next_cursor` string, nullable
  - `total` integer, required
  - `summary` DetectionsSummary: Computed over the whole filtered result, never over the page. Every number here answers for the rows the caller's filters selected, so none of them is named for a grade: under `status=resolved` a field called `open_*` would carry a resolved count. The row total the console captions lives on the response as `total`.
    - `by_severity` DetectionSeverityCounts: Three grades, not four. Detect emits no `critical` (its ADR-0010).
      - `high` integer
      - `medium` integer
      - `low` integer
    - `by_family` object
    - `uncatalogued_family_detections` integer
    - `by_rule` RuleCount[]
      - `rule_id` string, required
      - `title` string, nullable
      - `detections` integer, required
    - `agents_affected` integer
    - `sessions_affected` integer
    - `coverage` RuntimeCoverage: Derived by summing activity, never transmitted (ADR-0027). `resolved` counts calls the correlator could place. A low rate means the detector could not *read* those sessions — not that they were clean.
      - `total` integer
      - `resolved` integer
    - `denied_attempts` integer
    - `has_detect_run` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api.md) - [All operations](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api/revisions/0ee5484d1d0b?raw)