> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a finding

> One finding, of any family, with its triage state, the count and dates of its detections and its newest detection. The token needs the same view permission as the family's issues list.



## OpenAPI

````yaml /api-reference/openapi.json get /findings/{finding_id}
openapi: 3.0.0
info:
  title: Corgea API
  version: 1.0.0
  description: >-
    API for interacting with Corgea's scanning and vulnerability management
    features
servers:
  - url: https://www.corgea.app/api/v1
    description: Production server
  - url: https://eu.corgea.app/api/v1
    description: EU production server
security:
  - CorgeaToken: []
  - BearerAuth: []
paths:
  /findings/{finding_id}:
    get:
      tags:
        - Findings
      summary: Get a finding
      description: >-
        One finding, of any family, with its triage state, the count and dates
        of its detections and its newest detection. The token needs the same
        view permission as the family's issues list.
      operationId: getFinding
      parameters:
        - name: finding_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: The ID of the finding, as finding_id on issue items
      responses:
        '200':
          description: Finding retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    example: ok
                  finding:
                    $ref: '#/components/schemas/Finding'
        '403':
          description: The token may not view a requested finding family
        '404':
          description: No accessible finding with this id
components:
  schemas:
    Finding:
      type: object
      description: >-
        A vulnerability in one project across every scan that detected it. Its
        id is stable across rescans, branches and fingerprint migrations; triage
        lives here and is mirrored on each of its detections (issues).
      properties:
        id:
          type: string
          format: uuid
        issue_type:
          type: string
          enum:
            - sast
            - secret
            - logic_auth
            - code_quality
            - dependency
            - container
            - iac
        detection_state:
          type: string
          nullable: true
          enum:
            - active
            - retired
          description: >-
            active while the finding has a detection in its project; retired
            once its last detection was deleted with its scan or project. A
            finding a rescan no longer reports stays active with status fixed.
            Null until the account's finding index is complete.
        status:
          type: string
          enum:
            - open
            - fix_in_progress
            - accepted_risk
            - false_positive
            - fixed
            - duplicate
        status_comment:
          type: string
          nullable: true
        status_changed_at:
          type: string
          format: date-time
          nullable: true
          description: >-
            When the status last changed; filter on it with
            status_changed_since.
        status_changed_by:
          allOf:
            - $ref: '#/components/schemas/AssignedTo'
          nullable: true
          description: User who made the last status change, or null.
        accepted_risk_expiry_date:
          type: string
          format: date-time
          nullable: true
        assigned_to:
          $ref: '#/components/schemas/AssignedTo'
        due_date:
          type: string
          format: date-time
          nullable: true
        sla_status:
          type: string
          nullable: true
        urgency:
          type: string
          enum:
            - CR
            - HI
            - ME
            - LO
        classification:
          type: object
          nullable: true
          properties:
            id:
              type: string
              example: CWE-79
            name:
              type: string
            description:
              type: string
              nullable: true
        project:
          type: object
          properties:
            id:
              type: integer
            name:
              type: string
        first_detection_date:
          type: string
          format: date-time
          nullable: true
          description: created_at of the oldest detection.
        last_detection_date:
          type: string
          format: date-time
          nullable: true
          description: created_at of the newest detection.
        detections_count:
          type: integer
          description: How many detections the finding has across scans.
        latest_detection:
          allOf:
            - $ref: '#/components/schemas/FindingLatestDetection'
          nullable: true
          description: >-
            The finding's newest detection: its id is what the issue endpoints
            take, and it carries the family's own locator.
    AssignedTo:
      type: object
      nullable: true
      description: User assigned to the issue, or null when the issue is unassigned.
      properties:
        id:
          type: string
          description: Assigned user's ID.
        email:
          type: string
          format: email
          description: Assigned user's email address.
        name:
          type: string
          nullable: true
          description: Assigned user's display name, or null when unavailable.
    FindingLatestDetection:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: >-
            Detection (issue) id, for /issue/{issue_id} and
            /issues/sca/{issue_id}.
        scan_id:
          type: string
          format: uuid
          nullable: true
          description: >-
            Scan the detection belongs to; null for a SAST detection ingested
            without one.
        branch:
          type: string
          nullable: true
        sha:
          type: string
          nullable: true
        created_at:
          type: string
          format: date-time
        file_path:
          type: string
          description: SAST, secret, logic and code-quality findings only.
        line_number:
          type: integer
          nullable: true
          description: SAST, secret, logic and code-quality findings only.
        path:
          type: string
          description: Dependency, container and IaC findings only.
        package:
          type: string
          description: Dependency and container findings only.
        version:
          type: string
          description: Dependency and container findings only.
        cve:
          type: string
          nullable: true
          description: Dependency and container findings only.
        rule_id:
          type: string
          description: IaC findings only.
        start_line:
          type: integer
          nullable: true
          description: IaC findings only.
        end_line:
          type: integer
          nullable: true
          description: IaC findings only.
  securitySchemes:
    CorgeaToken:
      type: apiKey
      in: header
      name: CORGEA-TOKEN
      description: >-
        API key for authentication API tokens belonging to inactive users are
        rejected.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth2 access token (JWT) in the Authorization header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.