> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# List findings

> One row per finding: a vulnerability in one project across every scan that detected it, with its triage state and its newest detection. Newest first by when each finding was first detected; ties break on id so pages are stable. Returns 404 until the account's finding index is complete.



## OpenAPI

````yaml /api-reference/openapi.json get /findings
openapi: 3.0.0
info:
  title: Corgea API
  version: 1.0.0
  description: >-
    API for interacting with Corgea's scanning and vulnerability management
    features
servers:
  - url: https://www.corgea.app/api/v1
    description: Production server
  - url: https://eu.corgea.app/api/v1
    description: EU production server
security:
  - CorgeaToken: []
  - BearerAuth: []
paths:
  /findings:
    get:
      tags:
        - Findings
      summary: List findings
      description: >-
        One row per finding: a vulnerability in one project across every scan
        that detected it, with its triage state and its newest detection. Newest
        first by when each finding was first detected; ties break on id so pages
        are stable. Returns 404 until the account's finding index is complete.
      operationId: listFindings
      parameters:
        - name: issue_type
          in: query
          required: false
          schema:
            type: string
            example: sast,dependency
          description: >-
            Comma-separated families. Default: every security family the token
            may view (all but code_quality). Naming a family the token may not
            view returns 403.
        - name: status
          in: query
          required: false
          schema:
            type: string
            example: open,fix_in_progress
          description: Comma-separated statuses.
        - name: urgency
          in: query
          required: false
          schema:
            type: string
            example: CR,HI
          description: Comma-separated urgencies.
        - name: project_id
          in: query
          required: false
          schema:
            type: string
            example: 12,15
          description: Comma-separated project ids.
        - name: project
          in: query
          required: false
          schema:
            type: string
          description: One project name.
        - name: repo
          in: query
          required: false
          schema:
            type: string
          description: Substring of the repository URL.
        - name: cwe
          in: query
          required: false
          schema:
            type: string
            example: CWE-79,CWE-89
          description: Comma-separated CWE ids, as CWE-79 or 79.
        - name: detection_state
          in: query
          required: false
          schema:
            type: string
            enum:
              - active
              - retired
              - all
            default: active
          description: >-
            active: the finding has a detection in its project (default).
            retired: its last detection was deleted with its scan or project.
            all: both.
        - name: status_changed_since
          in: query
          required: false
          schema:
            type: string
            example: '2026-10-01T00:00:00Z'
          description: >-
            ISO 8601 datetime, or a date read as midnight UTC. Findings whose
            triage changed after this instant; use it for incremental sync.
        - name: created_since
          in: query
          required: false
          schema:
            type: string
            example: '2026-10-01T00:00:00Z'
          description: >-
            ISO 8601 datetime, or a date read as midnight UTC. Findings first
            detected after this instant.
        - name: assigned_to
          in: query
          required: false
          schema:
            type: integer
          description: One user id.
        - name: sort_by
          in: query
          required: false
          schema:
            type: string
            enum:
              - '-created_at'
              - created_at
              - urgency
              - '-urgency'
              - status
              - '-status'
              - status_changed_at
              - '-status_changed_at'
            default: '-created_at'
          description: >-
            Sort order. created_at is when the finding was first detected, the
            instant created_since filters on; it is not in the response, and
            equals first_detection_date unless the finding's oldest detections
            were deleted with their scan. Ties break on id.
        - name: page
          in: query
          required: false
          schema:
            type: integer
            default: 1
          description: The page number for pagination
        - name: page_size
          in: query
          required: false
          schema:
            type: integer
            default: 20
            maximum: 100
          description: The number of results per page
      responses:
        '200':
          description: Findings retrieved successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    example: ok
                  page:
                    type: integer
                  total_pages:
                    type: integer
                  total_findings:
                    type: integer
                  findings:
                    type: array
                    items:
                      $ref: '#/components/schemas/Finding'
        '400':
          description: Invalid parameter value
        '403':
          description: The token may not view a requested finding family
        '404':
          description: The account's finding index is not complete yet
components:
  schemas:
    Finding:
      type: object
      description: >-
        A vulnerability in one project across every scan that detected it. Its
        id is stable across rescans, branches and fingerprint migrations; triage
        lives here and is mirrored on each of its detections (issues).
      properties:
        id:
          type: string
          format: uuid
        issue_type:
          type: string
          enum:
            - sast
            - secret
            - logic_auth
            - code_quality
            - dependency
            - container
            - iac
        detection_state:
          type: string
          nullable: true
          enum:
            - active
            - retired
          description: >-
            active while the finding has a detection in its project; retired
            once its last detection was deleted with its scan or project. A
            finding a rescan no longer reports stays active with status fixed.
            Null until the account's finding index is complete.
        status:
          type: string
          enum:
            - open
            - fix_in_progress
            - accepted_risk
            - false_positive
            - fixed
            - duplicate
        status_comment:
          type: string
          nullable: true
        status_changed_at:
          type: string
          format: date-time
          nullable: true
          description: >-
            When the status last changed; filter on it with
            status_changed_since.
        status_changed_by:
          allOf:
            - $ref: '#/components/schemas/AssignedTo'
          nullable: true
          description: User who made the last status change, or null.
        accepted_risk_expiry_date:
          type: string
          format: date-time
          nullable: true
        assigned_to:
          $ref: '#/components/schemas/AssignedTo'
        due_date:
          type: string
          format: date-time
          nullable: true
        sla_status:
          type: string
          nullable: true
        urgency:
          type: string
          enum:
            - CR
            - HI
            - ME
            - LO
        classification:
          type: object
          nullable: true
          properties:
            id:
              type: string
              example: CWE-79
            name:
              type: string
            description:
              type: string
              nullable: true
        project:
          type: object
          properties:
            id:
              type: integer
            name:
              type: string
        first_detection_date:
          type: string
          format: date-time
          nullable: true
          description: created_at of the oldest detection.
        last_detection_date:
          type: string
          format: date-time
          nullable: true
          description: created_at of the newest detection.
        detections_count:
          type: integer
          description: How many detections the finding has across scans.
        latest_detection:
          allOf:
            - $ref: '#/components/schemas/FindingLatestDetection'
          nullable: true
          description: >-
            The finding's newest detection: its id is what the issue endpoints
            take, and it carries the family's own locator.
    AssignedTo:
      type: object
      nullable: true
      description: User assigned to the issue, or null when the issue is unassigned.
      properties:
        id:
          type: string
          description: Assigned user's ID.
        email:
          type: string
          format: email
          description: Assigned user's email address.
        name:
          type: string
          nullable: true
          description: Assigned user's display name, or null when unavailable.
    FindingLatestDetection:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: >-
            Detection (issue) id, for /issue/{issue_id} and
            /issues/sca/{issue_id}.
        scan_id:
          type: string
          format: uuid
          nullable: true
          description: >-
            Scan the detection belongs to; null for a SAST detection ingested
            without one.
        branch:
          type: string
          nullable: true
        sha:
          type: string
          nullable: true
        created_at:
          type: string
          format: date-time
        file_path:
          type: string
          description: SAST, secret, logic and code-quality findings only.
        line_number:
          type: integer
          nullable: true
          description: SAST, secret, logic and code-quality findings only.
        path:
          type: string
          description: Dependency, container and IaC findings only.
        package:
          type: string
          description: Dependency and container findings only.
        version:
          type: string
          description: Dependency and container findings only.
        cve:
          type: string
          nullable: true
          description: Dependency and container findings only.
        rule_id:
          type: string
          description: IaC findings only.
        start_line:
          type: integer
          nullable: true
          description: IaC findings only.
        end_line:
          type: integer
          nullable: true
          description: IaC findings only.
  securitySchemes:
    CorgeaToken:
      type: apiKey
      in: header
      name: CORGEA-TOKEN
      description: >-
        API key for authentication API tokens belonging to inactive users are
        rejected.
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth2 access token (JWT) in the Authorization header

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.