---
title: "List Findings Route"
method: GET
path: "/api/v1/findings"
---

# List Findings Route

`GET /api/v1/findings`

## Request

- Base URL: `https://api.stacktrace.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stacktrace.ai/api/v1/findings`
- Auth: none declared

## Query parameters

- `severity` string, nullable
- `status` string, nullable
- `asset_id` string, nullable
- `bom_id` string, nullable
- `component_bom_ref` string, nullable
- `component_identity` string, nullable
- `purl` string, nullable
- `version` string, nullable
- `component_type` string, nullable
- `agent_kind` string, nullable
- `agent_id` string, nullable
- `cursor` string, nullable
- `limit` integer

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- FindingsResponse
  - `items` FindingRow[], required
    - `id` string, required
    - `bom_id` string, required
    - `asset_id` string, required
    - `asset_display_name` string, required
    - `agent_kind` string, required
    - `agent_id` string, nullable, required
    - `bom_component_id` string, nullable, required
    - `component_identity` string, nullable, required
    - `component_bom_ref` string, nullable, required
    - `evidence_record_id` string, required
    - `record_type` string, required
    - `evidence_source` string, required
    - `external_id` string, required
    - `severity` string, required
    - `summary` string, nullable, required
    - `fix` string, nullable, required
    - `fixed_in` string, nullable
    - `update_target` UpdateTarget: One release to update a vulnerable component to, and what it is known to clear. Computed per component identity over every advisory finding the same query matches, not only the rows on this page. `version` is the highest `fixed_in` across those advisories, ordered the ecosystem's way: PEP 440 for PyPI, SemVer for npm. `clears_all` is true only when, for every advisory, `version` is outside every affected range the advisory's OSV record gives this package, the later `introduced` intervals included. It is a claim about `version` exactly: a later release can fall inside a later affected interval, so nothing here covers "or later". The three other cases: - `version` null, `blocking_advisory_ids` non-empty: those advisories have no fixed version, so no release is named. - `version` set, `clears_all` false: `blocking_advisory_ids` are the advisories not known to be fixed at `version`. It still affects them, or their record cannot be read at that version. - `version` null, `blocking_advisory_ids` empty: the fixes cannot be ordered (an unparsable version, or no single npm or PyPI package).
      - `version` string, nullable, required
      - `clears_all` boolean, required
      - `blocking_advisory_ids` string[]
    - `status` string, required
    - `first_seen_at` string, required
    - `last_seen_at` string, required
    - `match_metadata` object, required
    - `component_state` string
    - `component_inactive_via` string, nullable
  - `next_cursor` string, nullable
  - `total` integer, required
  - `summary` FindingSummary
    - `vulnerability_count` integer
    - `posture_count` integer
    - `observation_count` integer
    - `vulnerability_counts` SeverityCounts
      - `critical` integer
      - `high` integer
      - `medium` integer
      - `low` integer
    - `posture_counts` SeverityCounts
      - `critical` integer
      - `high` integer
      - `medium` integer
      - `low` integer
    - `observation_counts` SeverityCounts
      - `critical` integer
      - `high` integer
      - `medium` integer
      - `low` integer
  - `last_reevaluated_at` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api.md) - [All operations](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stacktrace/apis/stacktrace-fleet-api/revisions/0ee5484d1d0b?raw)