---
title: "Search"
method: POST
path: "/api/v2/issues/search"
tags: ["Issues"]
---

# Search

`POST /api/v2/issues/search`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/issues/search`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

List security issues with filtering by status, severity, detection type, repository, and more. To find a specific issue by id, pass the id (full UUID or the short 8-character form, with or without dashes) as `searchQuery`; it also matches title, vulnerability class, and affected file substrings. Supports sorting and cursor-based pagination via `limit` and `cursor`. Each result can include `vulnerabilityPatch` summary metadata (`validated`, `pullRequestStatus`, `prLink`, `error`), `patchGenerationRequestView` state when patch generation is queued/running/failed/completed, and the latest `runtimeValidation` verdict summary when dynamic validation has tested the issue. Use `issues.get` for the full remediation and Runtime Validation payload, including patch diff, PR metadata, Runtime Validation evidence, and runnable Runtime Validation POC code when available. Important: the `statuses` filter defaults to `["PENDING_REVIEW"]` — to see all issues, pass all statuses explicitly.

## Request body

- IssuesListInput
  - `repositoryScope` object
    - `tagNames` string[]: Match any of up to 100 exact tag names, case-insensitively. Percent signs and underscores are literal.
    - `branchName` string: Select this exact branch for every matched repository unless repositoryBranches specifies a branch.
  - `searchQuery` string: Free-text filter matched against issue title, vulnerability class, and affected file path. A query that looks like an issue id — hex digits and dashes only, at least 4 hex digits — also matches the issue id as a prefix, so the full UUID, the short 8-character issue id, and any longer prefix all find the issue. Dashes and surrounding whitespace are ignored for id matching.
  - `scoreRange` object
    - `min` number, required
    - `max` number, required
    - `minExclusive` boolean
    - `maxExclusive` boolean
  - `scoreLevels` string[]
  - `severityLevels` string[]
  - `languages` string[]
  - `vulnerabilityClasses` string[]
  - `vulnerabilityClassFilters` object[]
    - `operator` 'equals' | 'contains' | 'startsWith', required
    - `value` string, required
  - `applicationFilters` object[]
    - `repositoryId` string, required
    - `relativePath` string, required
  - `scanId` string
  - `codeScanTypes` string[]
  - `statuses` string[]
  - `detectionTypes` string[]
  - `showOnlyNewIssues` boolean
  - `hasWizExposure` boolean
  - `secretVerified` boolean: Limit to findings whose detected secret was verified live against its provider. Applies to every category.
  - `lane` 'fix_now' | 'next' | 'later' | 'reviewing' | 'patching' | 'resolved' | 'non_exploitable' | 'false_positive' | 'accepted_risk' | 'informational'
  - `boardValidation` 'validated' | 'unvalidated' | 'not_examined'
  - `knownExploited` boolean
  - `kevRansomware` boolean
  - `epssMin` number
  - `dependencyReachability` string[]
  - `hasFix` boolean
  - `dependencyQuery` string
  - `validationStates` string[]
  - `runtimeValidationVerdicts` string[]
  - `reachability` string[]
  - `cvssAttackVectors` string[]: Filter by the canonical CVSS 4.0 attack-vector metric.
  - `cvssAttackComplexities` string[]: Filter by the canonical CVSS 4.0 attack-complexity metric.
  - `cvssPrivilegesRequired` string[]: Filter by the canonical CVSS 4.0 privileges-required metric.
  - `cvssUserInteractions` string[]: Filter by the canonical CVSS 4.0 user-interaction metric.
  - `runtimeValidationSetupRequirements` string[]: Filter by the runtime validation setup classification.
  - `createdAfter` string
  - `createdBefore` string
  - `createdInLastNDays` integer
  - `resolvedAfter` string
  - `resolvedBefore` string
  - `resolvedInLastNDays` integer
  - `sortBy` 'priority' | 'createdAt' | 'score' | 'title' | 'repository' | 'class' | 'file' | 'patch'
  - `sortOrder` 'asc' | 'desc'
  - `issueIds` string[]
  - `excludeScore` number
  - `organizationId` string
  - `presentation` boolean
  - `page` integer
  - `cursor` string
  - `limit` integer
  - `repositoryBranches` object[]: A nonempty list limits results to these repository IDs. repositoryScope and excludedRepositoryBranches also apply; a repository in both lists is excluded. Each branchName overrides repositoryScope.branchName for that repository.
    - `repositoryId` string, required
    - `branchName` string
  - `excludedRepositoryBranches` object[]: Exclude these repository IDs, including any also present in repositoryBranches. Exclusion applies to the whole repository; branchName is ignored.
    - `repositoryId` string, required
    - `branchName` string
  - `projectId` string

## Response `200`

List of matching issues

- IssuesListResponse
  - `items` object[], required
    - `id` string, required
    - `issueStatus` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
    - `severity` number, nullable, required
    - `confidence` number, required
    - `score` number, nullable, required
    - `createdAt` string, required
    - `url` string, required
    - `presentation` object
      - `lane` 'fix_now' | 'next' | 'later' | 'reviewing' | 'patching' | 'resolved' | 'non_exploitable' | 'false_positive' | 'accepted_risk' | 'informational', required
      - `category` 'traditional' | 'businessLogic' | 'customRule' | 'SCA' | 'IAC' | 'SECRETS' | 'CICD' | 'EOL' | 'CONTAINER' | 'uncategorized', required
      - `startLine` number, nullable, required
      - `updatedAt` string, date-time, required
      - `validationMethod` 'SCANNER_POLICY' | 'AGENT_TRIAGE' | 'DEEP_CONFIRMATION' | 'RESCAN_AGENT' | 'INVESTIGATION' | 'RUNTIME_VALIDATION' | 'HUMAN_REVIEW', nullable, required
      - `evidence` union, required
        - object
          - `runtimeConfirmed` boolean, required
          - `knownExploited` boolean, nullable, required
          - `reachability` 'reachable' | 'needs_review' | 'unreachable' | 'not_tested', nullable, required
          - `knownVulnerableVersion` boolean, nullable, required: A dependency finding CONFIRMED by policy (a version match, e.g. Trivy) rather than by an agent verdict; such a finding is not `reachable` on that account alone. Null, like the other dependency facts, when the finding carries no dependency occurrence.
          - `hasWizExposure` boolean, required
          - `secretVerified` boolean, required
          - `validated` true, required
          - `validationProvenance` 'recorded' | 'legacy', required: `recorded` = a validation method is stored on the finding; `legacy` = confirmed before validation methods were tracked.
        - object
          - `runtimeConfirmed` boolean, required
          - `knownExploited` boolean, nullable, required
          - `reachability` 'reachable' | 'needs_review' | 'unreachable' | 'not_tested', nullable, required
          - `knownVulnerableVersion` boolean, nullable, required: A dependency finding CONFIRMED by policy (a version match, e.g. Trivy) rather than by an agent verdict; such a finding is not `reachable` on that account alone. Null, like the other dependency facts, when the finding carries no dependency occurrence.
          - `hasWizExposure` boolean, required
          - `secretVerified` boolean, required
          - `validated` false, required
          - `validationProvenance` unknown, required
      - `assignee` object, nullable, required: The organization member currently assigned to review this finding, or null when it has no assignee. Set when an interactive (board or drawer) move to REVIEWING finds the finding unassigned; cleared by v2.issues.unassign, by undoing that move, or when the membership is removed. updateStatus never changes it.
        - `membershipId` string, required
        - `displayName` string, required
      - `acceptedRiskExpiresAt` string, date-time, nullable, required
      - `slaDueAt` string, date-time, nullable, required: When the finding falls overdue under its SLA policies (the earliest due instant, UTC); null when no enabled policy tracks it, e.g. once it is closed.
      - `allowedTransitions` string[], required: Statuses this actor may move this finding to via an interactive (board) move: source and target FGA permissions, the Patching-needs-a-patch rule, and the REVIEWING membership rule all apply. This does not describe what the public updateStatus endpoint accepts, which has no patch requirement and no REVIEWING membership rule.
      - `transitionAvailability` union[], required: Every status this actor could move this finding to via an interactive (board) move, each with why it is unavailable when it is. Same interactive-move rules as allowedTransitions (patch requirement, source/target permissions, REVIEWING membership) — not the rules of the public updateStatus endpoint.
        - union
          - object
            - `status` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
            - `allowed` true, required
          - object
            - `status` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
            - `allowed` false, required
            - `reason` 'permission' | 'needs_patch' | 'current', required
      - `hasClosePermission` boolean, required: Whether this actor holds the close permission (ISSUE_EDIT_CLOSE) on the repository of this finding. Requesting a re-investigation (issues.requestInvestigation) needs it, because a definitive verdict closes the finding and its ticket.
    - `generatedTitle` string, required
    - `generatedDescription` string, required
    - `vulnClass` string, required
    - `affectedFile` string, required
    - `scanTargetBranch` string, nullable, required
    - `archivedAt` string, nullable, required
    - `silencedAt` string, nullable, required
    - `falsePositiveAt` string, nullable, required
    - `noLongerDetectedAt` string, nullable, required
    - `resolvedAt` string, nullable, required
    - `unpatchable` boolean, nullable, required
    - `validated` 'CONFIRMED' | 'DISCONFIRMED' | 'UNKNOWN', nullable, required
    - `error` string, nullable, required
    - `repository` object, required
      - `id` string, required
      - `name` string, required
      - `monorepoName` string, nullable, required
      - `directoryPartitions` string[], required
      - `monorepoPartitionRole` 'none' | 'scoped' | 'fallback', required
    - `scan` object, required
      - `id` string, required
      - `repository` object, required
        - `id` string, required
      - `commitSha` string, nullable, required
    - `vulnerabilityPatch` object, nullable, required
      - `validated` 'CONFIRMED' | 'DISCONFIRMED' | 'UNKNOWN', required
      - `pullRequestStatus` 'PENDING' | 'ACCEPTED' | 'DENIED', required
      - `prLink` string, nullable, required
      - `error` string, nullable, required
    - `patchGenerationRequestView` union, required
      - object
        - `state` 'QUEUED', required
        - `request` object, required
          - `id` string, required
          - `requestedAt` string, required
          - `dependencyUpgrade` union
            - object
              - …
            - object
              - …
        - `workerAssignment` unknown, required
        - `finalResult` unknown, required
      - object
        - `state` 'IN_PROGRESS', required
        - `request` object, required
          - `id` string, required
          - `requestedAt` string, required
          - `dependencyUpgrade` union
            - object
              - …
            - object
              - …
        - `workerAssignment` object, required
          - `workerId` string, required
          - `assignedAt` string, required
          - `stage` 'ASSIGNED' | 'PREPARING_REPOSITORY' | 'GENERATING_FIX' | 'FINALIZING', required
        - `finalResult` unknown, required
      - object
        - `state` 'SUCCEEDED', required
        - `request` object, required
          - `id` string, required
          - `requestedAt` string, required
          - `dependencyUpgrade` union
            - object
              - …
            - object
              - …
        - `workerAssignment` object, nullable, required
          - `workerId` string, required
          - `assignedAt` string, required
          - `stage` 'ASSIGNED' | 'PREPARING_REPOSITORY' | 'GENERATING_FIX' | 'FINALIZING', required
        - `finalResult` object, required
          - `completedAt` string, required
          - `error` unknown, required
      - object
        - `state` 'FAILED', required
        - `request` object, required
          - `id` string, required
          - `requestedAt` string, required
          - `dependencyUpgrade` union
            - object
              - …
            - object
              - …
        - `workerAssignment` object, nullable, required
          - `workerId` string, required
          - `assignedAt` string, required
          - `stage` 'ASSIGNED' | 'PREPARING_REPOSITORY' | 'GENERATING_FIX' | 'FINALIZING', required
        - `finalResult` object, required
          - `completedAt` string, required
          - `error` string, required
    - `runtimeValidation` object, nullable, required
      - `id` string, required
      - `run` object, required
        - `id` string, required
        - `status` 'PENDING' | 'PROCESSING' | 'COMPLETED' | 'FAILED' | 'CANCELLED', required
        - `triggerReason` 'USER_REQUESTED' | 'AUTO_AFTER_SCAN', required
        - `scope` 'FULL_APPLICATION' | 'SELECTED_ISSUES'
        - `targetIssueCount` integer
        - `createdAt` string, required
        - `completedAt` string, nullable, required
      - `verdict` 'CONFIRMED' | 'DISCONFIRMED' | 'UNTESTABLE' | 'AGENT_ERROR', required
      - `isDynamicallyTestable` boolean, required
      - `testabilityReasoning` string, required
      - `validationReasoning` string, nullable, required
      - `evidenceSummary` string, nullable, required
      - `validationSteps` object[], required
        - `target` string, nullable, required
        - `action` string, required
        - `expectedResult` string, nullable, required
        - `observedResult` string, required
        - `conclusion` string, required
      - `attackReproductionSteps` string[], required
      - `error` string, nullable, required
      - `createdAt` string, required
    - `falsePositiveReason` string, nullable, required
    - `validationSecurityAssessment` string, nullable, required
    - `nonExploitableReason` string, nullable, required
    - `tickets` object[], required: The Jira and Linear tickets this finding is linked to, Jira first and at most one per provider; empty when it has none. `key` is the Jira issue key or the Linear issue identifier (Linear's internal id when no canonical browse URL was stored); `url` is the browse URL, or null when none was stored. Carries no ticket status.
      - `provider` 'jira' | 'linear', required
      - `key` string, required
      - `url` string, nullable, required
  - `totalCount` integer, required
  - `hasMore` boolean, required
  - `nextCursor` string, nullable, required
  - `effectiveFilters` object, required
    - `repositoryScope` object
      - `tagNames` string[]: Match any of up to 100 exact tag names, case-insensitively. Percent signs and underscores are literal.
      - `branchName` string: Select this exact branch for every matched repository unless repositoryBranches specifies a branch.
    - `scanId` string, required
    - `searchQuery` string, required
    - `languages` string[], required
    - `vulnerabilityClasses` string[], required
    - `vulnerabilityClassFilters` object[], required
      - `operator` 'equals' | 'contains' | 'startsWith', required
      - `value` string, required
    - `codeScanTypes` string[], required
    - `statuses` string[], required
    - `detectionTypes` string[], required
    - `showOnlyNewIssues` boolean, required
    - `lane` 'fix_now' | 'next' | 'later' | 'reviewing' | 'patching' | 'resolved' | 'non_exploitable' | 'false_positive' | 'accepted_risk' | 'informational', nullable, required
    - `boardValidation` 'validated' | 'unvalidated' | 'not_examined', nullable, required
    - `knownExploited` boolean, nullable, required
    - `kevRansomware` boolean, nullable, required
    - `epssMin` number, nullable, required
    - `dependencyReachability` string[], required
    - `hasFix` boolean, nullable, required
    - `dependencyQuery` string, required
    - `hasWizExposure` boolean, required
    - `secretVerified` boolean, required
    - `sortBy` 'priority' | 'createdAt' | 'score' | 'title' | 'repository' | 'class' | 'file' | 'patch', required
    - `sortOrder` 'asc' | 'desc', required
    - `scoreLevels` string[], required
    - `severityLevels` string[], required
    - `validationStates` string[], required
    - `runtimeValidationVerdicts` string[], required
    - `reachability` string[], required
    - `cvssAttackVectors` string[], required
    - `cvssAttackComplexities` string[], required
    - `cvssPrivilegesRequired` string[], required
    - `cvssUserInteractions` string[], required
    - `runtimeValidationSetupRequirements` string[], required
    - `scoreRangeMin` number, required
    - `scoreRangeMax` number, required
    - `excludeScore` number, nullable, required
    - `issueIds` string[], required
    - `createdAfter` string, required
    - `createdBefore` string, required
    - `resolvedAfter` string, required
    - `resolvedBefore` string, required
    - `repositoryBranches` object[]: A nonempty list limits results to these repository IDs. repositoryScope and excludedRepositoryBranches also apply; a repository in both lists is excluded. Each branchName overrides repositoryScope.branchName for that repository.
      - `repositoryId` string, required
      - `branchName` string
    - `excludedRepositoryBranches` object[]: Exclude these repository IDs, including any also present in repositoryBranches. Exclusion applies to the whole repository; branchName is ignored.
      - `repositoryId` string, required
      - `branchName` string
    - `applicationFilters` object[], required
      - `repositoryId` string, required
      - `relativePath` string, required

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)