---
title: "List container scan findings"
method: POST
path: "/api/v2/containerScans/listFindings"
tags: ["Container Scanning"]
---

# List container scan findings

`POST /api/v2/containerScans/listFindings`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/containerScans/listFindings`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

List the vulnerability findings of a container scan, sorted by severity descending. Provide exactly one of containerScanId (a specific scan) or containerImageId (resolves to that image's latest scan). Each finding includes the CVE id, affected package and installed version, fixed version (or null when no fix exists), the introducing layer digest, which engines detected it (and whether both did), severity, and generated description/remediation. The response's `scan` field reports the resolved scan's status and whether it failed, so a failed scan is distinguishable from a finished scan with zero findings.

## Request body

- ContainerScanListFindingsRequest: Input for listing the findings of a container scan. Provide exactly one of containerScanId (a specific scan) or containerImageId (resolves to that image's latest scan).
  - `organizationId` string: Organization ID (optional).
  - `containerScanId` string: ID of the container scan.
  - `containerImageId` string: ID of the container image; findings are read from its latest scan.

## Response `200`

Findings retrieved

- ContainerScanListFindingsResponse: Findings of a container scan, sorted by severity descending. `scan` is null only when an image was queried and has never been scanned; otherwise it reports the resolved scan's status and whether it failed, so consumers can distinguish a failed scan from a finished scan with zero findings.
  - `scan` object, nullable, required
    - `id` string, required
    - `status` 'IMAGE_PULL' | 'LAYER_ANALYSIS' | 'VULN_DETECTION' | 'SUCCEEDED' | 'FAILED', required
    - `errored` boolean, required: True when the scan failed (status === FAILED, terminal). Findings will be empty.
  - `findings` ContainerFinding[], required
    - `id` string, required
    - `packageName` string, required: Affected OS/library package name.
    - `installedVersion` string, required: Version of the package present in the image.
    - `recommendedFixedVersion` string, nullable, required: The single version to upgrade to that resolves the most of the package CVEs, or null when no fix is available.
    - `introducingLayerDigest` string, nullable, required: Digest of the image layer that introduced the vulnerable package, or null when unattributable.
    - `detectedByEngines` string[], required: Which scan engines reported this package.
    - `confirmedByBothEngines` boolean, required: True when both engines reported the package (higher confidence).
    - `severity` number, required: Package-level 0-10 severity (max across its CVEs).
    - `severityLabel` 'Informational' | 'Low' | 'Medium' | 'High' | 'Critical', required: Qualitative severity label derived from the score.
    - `cvssV3Vector` string, nullable, required: Package-level published CVSS v3 vector (the worst CVE's), or null when no CVE carried a published CVSS v3.
    - `cvssV3Score` number, nullable, required: Package-level published CVSS v3 base score (the worst CVE's), or null.
    - `issueStatus` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required: Live tracked triage status of this finding as a ZeroPath issue (same status model as any other issue).
    - `title` string, required
    - `description` string, required: Generated description and remediation guidance.
    - `cveCount` number, required: Number of CVEs affecting this package.
    - `cves` object[], required: The CVEs affecting this package, severity descending.
      - `cveId` string, required
      - `severity` number, required
      - `severityLabel` 'Informational' | 'Low' | 'Medium' | 'High' | 'Critical', required
      - `cvssV3Vector` string, nullable, required
      - `cvssV3Score` number, nullable, required
      - `fixedVersion` string, nullable, required
      - `fixState` 'fixed' | 'affected' | 'will_not_fix' | 'fix_deferred' | 'end_of_life' | 'unknown', required: Engine fix state. 'fixed' is an actionable upgrade; the rest are real but have no applicable fix.
      - `title` string, required
      - `publishedDate` string, nullable, required: ISO-8601 date the advisory was first published; null when unknown.
      - `confirmedByBothEngines` boolean, required
    - `createdAt` string, date-time, required

## Other responses

- `401`: Error Response
- `404`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)