> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Detections for Scan

> Retrieves a list of detections for a specific scan. By default, results are ordered by creation time, newest first, with detection ID as a tie-breaker for stable pagination.

Also served at `/api/v1/scan/{scan_id}/issues`, this endpoint's earlier name, which stays supported with the same parameters and response.



## OpenAPI

````yaml /api-reference/openapi.json get /scan/{scan_id}/detections
openapi: 3.0.0
info:
  title: Corgea API
  version: 1.0.0
  description: >-
    API for interacting with Corgea's scanning and vulnerability management
    features
servers:
  - url: https://www.corgea.app/api/v1
    description: Production server
  - url: https://eu.corgea.app/api/v1
    description: EU production server
security:
  - CorgeaToken: []
  - BearerAuth: []
paths:
  /scan/{scan_id}/detections:
    get:
      tags:
        - Detections
      summary: Get Detections for Scan
      description: >-
        Retrieves a list of detections for a specific scan. By default, results
        are ordered by creation time, newest first, with detection ID as a
        tie-breaker for stable pagination.


        Also served at `/api/v1/scan/{scan_id}/issues`, this endpoint's earlier
        name, which stays supported with the same parameters and response.
      operationId: getScanIssues
      parameters:
        - name: scan_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: The ID of the scan
        - name: page
          in: query
          required: false
          schema:
            type: integer
            default: 1
          description: The page number for pagination
        - name: page_size
          in: query
          required: false
          schema:
            type: integer
            default: 20
            maximum: 50
          description: The number of results per page
        - name: urgency
          in: query
          required: false
          schema:
            type: string
          description: >-
            Filter by urgency levels (comma-separated). Valid values: CR, HI,
            ME, LO
          example: CR,HI
        - name: status
          in: query
          required: false
          schema:
            type: string
          description: >-
            Filter by status (comma-separated). Valid values: fixed,
            false_positive, accepted_risk, open, fix_in_progress, duplicate
          example: open,fix_in_progress
        - name: show_false_positives
          in: query
          required: false
          schema:
            type: boolean
            default: false
          description: >-
            Include issues marked as false positives (manual or AI). By default
            false positives are excluded.
          example: true
        - name: include_reachability
          in: query
          required: false
          schema:
            type: boolean
            default: false
          description: Include endpoint reachability summary for each issue.
        - name: language
          in: query
          required: false
          schema:
            type: string
          description: Filter by programming language (case-insensitive)
          example: python
        - name: file_path
          in: query
          required: false
          schema:
            type: string
          description: Filter by file path (partial match)
          example: src/auth
        - name: classification
          in: query
          required: false
          schema:
            type: string
          description: >-
            Filter by classification (partial match) or CWE identifier. CWE
            matching ignores leading zeros and matches the complete identifier:
            CWE-79 matches CWE-079, but not CWE-798.
          example: CWE-89
        - name: file_path_exact
          in: query
          required: false
          schema:
            type: string
          description: >-
            Filter by an exact file path. Unlike file_path, this does not match
            paths that merely contain the value, which makes it safe for
            drilling into a file group returned by the groups endpoint.
          example: src/api/auth.py
        - name: search
          in: query
          required: false
          schema:
            type: string
          description: Free-text search across classification and file path
          example: sql injection
        - name: cwe
          in: query
          required: false
          schema:
            type: string
          description: >-
            Filter by one or more CWE identifiers (comma-separated), using the
            same matching as classification. Use this to drill into a CWE group
            returned by the groups endpoint.
          example: CWE-79,CWE-89
        - name: sla_status
          in: query
          required: false
          schema:
            type: string
          description: >-
            Filter by SLA status (comma-separated). Valid values: overdue,
            escalated
          example: overdue
        - name: sort_by
          in: query
          required: false
          schema:
            type: string
            enum:
              - created_at
              - '-created_at'
              - urgency
              - '-urgency'
              - status
              - '-status'
              - classification
              - '-classification'
          description: >-
            Sort results by field (prefix with '-' for descending order). Issue
            ID breaks ties when sorting.
          example: '-created_at'
      responses:
        '200':
          description: Issues retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    example: ok
                  page:
                    type: integer
                  total_pages:
                    type: integer
                  total_issues:
                    type: integer
                  issues:
                    type: array
                    items:
                      $ref: '#/components/schemas/Issue'
        '403':
          description: Permission denied
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Permission denied
        '404':
          description: >-
            Scan not found or, when project access control is enabled, the
            caller is not a company admin and has no access to the scan’s
            project.
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    example: error
                  message:
                    type: string
                    example: Scan not found
components:
  schemas:
    Issue:
      type: object
      properties:
        finding_id:
          type: string
          format: uuid
          nullable: true
          description: >-
            ID of the finding this issue is a detection of: the same across
            rescans. Null for an issue ingested before findings existed.
        id:
          type: string
          format: uuid
        classification:
          type: object
          nullable: true
          description: >-
            When the CWE is unknown or the classification is a free-form label,
            id and name contain the original classification label and
            description is null. An empty classification is returned as null.
          properties:
            id:
              type: string
              example: CWE-123
            name:
              type: string
              example: Vulnerability Name
            description:
              type: string
              nullable: true
        urgency:
          type: string
          enum:
            - CR
            - HI
            - ME
            - LO
          description: 'Urgency code: CR (critical), HI (high), ME (medium), or LO (low).'
        created_at:
          type: string
          format: date-time
        first_detection_date:
          type: string
          format: date-time
          description: >-
            When Corgea first detected this issue, across every scan it appeared
            in. Equals created_at when this is the earliest detection.
        status:
          type: string
          nullable: true
          enum:
            - open
            - fix_in_progress
            - fixed
            - false_positive
            - accepted_risk
            - duplicate
        sla_status:
          type: string
          nullable: true
          enum:
            - overdue
            - escalated
          description: >-
            SLA breach state. null when the issue is neither overdue nor
            escalated.
        location:
          $ref: '#/components/schemas/IssueLocation'
        auto_triage:
          $ref: '#/components/schemas/AutoTriage'
        auto_fix_suggestion:
          $ref: '#/components/schemas/AutoFixSuggestion'
        assigned_to:
          $ref: '#/components/schemas/AssignedTo'
        reachability:
          $ref: '#/components/schemas/IssueReachabilitySummary'
    IssueLocation:
      type: object
      properties:
        file:
          type: object
          properties:
            name:
              type: string
            language:
              type: string
            path:
              type: string
            git_hash:
              type: string
              nullable: true
              description: >-
                Git hash recorded for the scanned file. Returned only by the
                endpoints that list issues.
        project:
          type: object
          properties:
            name:
              type: string
            branch:
              type: string
            git_sha:
              type: string
        line_number:
          type: integer
        sink_line_number:
          type: integer
          nullable: true
          description: >-
            Line of the data-flow sink when the sink is in this file, or null
            otherwise. Returned only when getting a single issue.
    AutoTriage:
      type: object
      properties:
        false_positive_detection:
          type: object
          properties:
            status:
              type: string
              enum:
                - valid
                - false_positive
                - pending
            reasoning:
              description: >-
                False-positive reasoning when available, including when no fix
                was generated.
              type: string
              nullable: true
    AutoFixSuggestion:
      type: object
      properties:
        id:
          type: string
          format: uuid
        status:
          type: string
          enum:
            - fix_available
            - no_fix
            - generating
            - false_positive
            - on_hold
            - unsupported
            - plan
          description: >-
            Current fix availability. Getting an issue starts eligible missing
            fix generation in the background by default. While that generation
            is pending, the status is generating; fetch the issue again until
            generation finishes. If generation is disabled or no fix is
            produced, the status is no_fix.
        patch:
          type: object
          properties:
            diff:
              type: string
              description: >-
                Unified diff format patch. Returns an empty string when the fix
                has no diff.
            explanation:
              type: string
              description: Explanation of how the fix addresses the vulnerability
            full_code:
              type: string
              description: >-
                Full source of the file with the fix applied. Returned only when
                show_full_code is true and a fix exists.
    AssignedTo:
      type: object
      nullable: true
      description: User assigned to the issue, or null when the issue is unassigned.
      properties:
        id:
          type: string
          description: Assigned user's ID.
        email:
          type: string
          format: email
          description: Assigned user's email address.
        name:
          type: string
          nullable: true
          description: Assigned user's display name, or null when unavailable.
    IssueReachabilitySummary:
      type: object
      description: >-
        Endpoint reachability summary returned when include_reachability is
        true.
      properties:
        is_reachable:
          type: boolean
        endpoint_count:
          type: integer
  securitySchemes:
    CorgeaToken:
      type: apiKey
      in: header
      name: CORGEA-TOKEN
      description: >-
        API key for authentication API tokens belonging to inactive users are
        rejected.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth2 access token (JWT) in the Authorization header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.