---
updatedAt: 2026-05-12T10:00:31.000Z
---
# Retrieve findings
This operation returns an object containing information about all findings on assets to which the current user has access.
# OpenAPI definition
```json
{
"components": {
"responses": {
"BadRequestResponse": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/ErrorMessage"
}
}
},
"description": "BadRequestResponse indicates a request with invalid parameters"
},
"FindingsResponse": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/findingsMessage"
}
}
},
"description": "FindingsResponse provides a list of findings"
},
"ForbiddenResponse": {
"description": "ForbiddenResponse signals a request for a resource that does not exist or is not authorized"
},
"GenericError": {
"description": "GenericError generic error"
},
"UnauthorizedResponse": {
"description": "UnauthorizedResponse signals an unauthorized API access"
}
},
"schemas": {
"ErrorMessage": {
"description": "ErrorMessage describes the error",
"properties": {
"code": {
"format": "int64",
"type": "integer"
},
"reason": {
"type": "string"
}
},
"type": "object"
},
"findingSwagger": {
"description": "Finding is the data returned by the findings endpoint",
"properties": {
"asset": {
"properties": {
"clientID": {
"format": "int64",
"type": "integer"
},
"customPolicyID": {
"format": "int64",
"nullable": true,
"type": "integer"
},
"id": {
"format": "int64",
"type": "integer"
},
"name": {
"type": "string"
},
"rating": {
"type": "string"
},
"serviceLevel": {
"format": "int64",
"type": "integer"
},
"status": {
"type": "boolean"
},
"subID": {
"format": "int64",
"type": "integer"
},
"type": {
"type": "string"
},
"location": {
"type": "string",
"enum": [
"Internal",
"External"
]
},
"phase": {
"type": "string",
"enum": [
"pre-production",
"production",
"discontinued",
""
]
}
},
"type": "object"
},
"attackVectors": {
"items": {
"format": "int64",
"type": "integer"
},
"nullable": true,
"type": "array"
},
"attackVectorsCount": {
"format": "int64",
"nullable": true,
"type": "integer"
},
"class": {
"properties": {
"defaultRisk": {
"format": "int64",
"type": "integer"
},
"hasApplications": {
"type": "boolean"
},
"hasSites": {
"type": "boolean"
},
"id": {
"format": "int64",
"type": "integer"
},
"name": {
"type": "string"
},
"retired": {
"type": "boolean"
},
"shortName": {
"type": "string"
}
},
"type": "object"
},
"closed": {
"format": "date-time",
"nullable": true,
"type": "string"
},
"customAccepted": {
"type": "boolean"
},
"customRisk": {
"format": "int64",
"nullable": true,
"type": "integer"
},
"cveTags": {
"items": {
"type": "string"
},
"nullable": true,
"type": "array"
},
"cweTags": {
"items": {
"type": "string"
},
"nullable": true,
"type": "array"
},
"cvssScore": {
"format": "double",
"type": "number"
},
"cvssV3": {
"properties": {
"environmentalScore": {
"format": "double",
"nullable": true,
"type": "number"
},
"environmentalVector": {
"properties": {
"a": {
"type": "string"
},
"ac": {
"type": "string"
},
"ar": {
"type": "string"
},
"av": {
"type": "string"
},
"c": {
"type": "string"
},
"cr": {
"type": "string"
},
"i": {
"type": "string"
},
"ir": {
"type": "string"
},
"ma": {
"type": "string"
},
"mac": {
"type": "string"
},
"mav": {
"type": "string"
},
"mc": {
"type": "string"
},
"mi": {
"type": "string"
},
"mpr": {
"type": "string"
},
"ms": {
"type": "string"
},
"mui": {
"type": "string"
},
"pr": {
"type": "string"
},
"s": {
"type": "string"
},
"ui": {
"type": "string"
}
},
"type": "object"
},
"score": {
"format": "double",
"type": "number"
},
"vector": {
"properties": {
"a": {
"type": "string"
},
"ac": {
"type": "string"
},
"ar": {
"type": "string"
},
"av": {
"type": "string"
},
"c": {
"type": "string"
},
"cr": {
"type": "string"
},
"i": {
"type": "string"
},
"ir": {
"type": "string"
},
"ma": {
"type": "string"
},
"mac": {
"type": "string"
},
"mav": {
"type": "string"
},
"mc": {
"type": "string"
},
"mi": {
"type": "string"
},
"mpr": {
"type": "string"
},
"ms": {
"type": "string"
},
"mui": {
"type": "string"
},
"pr": {
"type": "string"
},
"s": {
"type": "string"
},
"ui": {
"type": "string"
}
},
"type": "object"
}
},
"type": "object"
},
"directRemediationAvailable": {
"type": "boolean"
},
"firstOpened": {
"format": "date-time",
"type": "string"
},
"foundRevision": {
"nullable": true,
"type": "string"
},
"hasInstanceLevelCVSSCustomization": {
"type": "boolean"
},
"hasInstanceLevelCustomization": {
"type": "boolean"
},
"id": {
"description": "This is a copy because go-swagger does not support overriding type information\nso all SQL null handling shows as objects instead of primitive type",
"format": "int64",
"type": "integer"
},
"impact": {
"format": "int64",
"type": "integer"
},
"impactRating": {
"type": "string"
},
"isAccessible": {
"type": "boolean"
},
"lastModified": {
"format": "date-time",
"type": "string"
},
"lastRetested": {
"format": "date-time",
"nullable": true,
"type": "string"
},
"likelihood": {
"format": "int64",
"type": "integer"
},
"likelihoodRating": {
"type": "string"
},
"location": {
"type": "string"
},
"manual": {
"type": "boolean"
},
"nonAcceptedStatus": {
"nullable": true,
"type": "string"
},
"notesCount": {
"format": "int64",
"nullable": true,
"type": "integer"
},
"opened": {
"format": "date-time",
"type": "string"
},
"outOfScopeReasons": {
"items": {
"type": "string"
},
"type": "array"
},
"reason": {
"nullable": true,
"type": "string"
},
"retestStatus": {
"type": "string"
},
"risk": {
"format": "int64",
"type": "integer"
},
"severity": {
"format": "int64",
"nullable": true,
"type": "integer"
},
"status": {
"type": "string"
},
"subTypeTags": {
"items": {
"type": "string"
},
"nullable": true,
"type": "array"
},
"tags": {
"items": {
"type": "string"
},
"type": "array"
},
"threat": {
"format": "int64",
"nullable": true,
"type": "integer"
},
"unreachable": {
"nullable": true,
"type": "boolean"
},
"verificationStatus": {
"type": "string"
},
"zeroDayTags": {
"items": {
"type": "string"
},
"nullable": true,
"type": "array"
}
},
"type": "object"
},
"findingsMessage": {
"properties": {
"collection": {
"items": {
"$ref": "#/components/schemas/findingSwagger"
},
"type": "array"
},
"page": {
"$ref": "#/components/schemas/findingsPageData"
}
},
"type": "object"
},
"findingsPageData": {
"properties": {
"currentPage": {
"format": "int64",
"type": "integer"
},
"filteredCount": {
"format": "int64",
"type": "integer"
},
"totalCount": {
"format": "int64",
"type": "integer"
},
"totalPages": {
"format": "int64",
"type": "integer"
}
},
"type": "object"
}
}
},
"info": {
"license": {
"name": "(c) Copyright 2022 WhiteHat Security"
},
"title": "Findings API",
"version": "2.0.0"
},
"openapi": "3.0.1",
"paths": {
"/api/findings": {
"get": {
"description": "This operation returns an object containing information about all findings on assets to which the current user has access.",
"operationId": "findingsInputSwagger",
"parameters": [
{
"description": "Offset begin showing results from item number n.",
"in": "query",
"name": "offset",
"schema": {
"format": "int64",
"type": "integer"
},
"x-go-name": "Offset"
},
{
"description": "Limit results to n number of items.",
"in": "query",
"name": "limit",
"schema": {
"format": "int64",
"type": "integer"
},
"x-go-name": "Limit"
},
{
"description": "Sort order results by the given field.\nPrefix the field name with '-' to order in descending order.\nE.g., '-name' sorts results in descending order using the field 'name'",
"in": "query",
"name": "sort",
"schema": {
"type": "string"
},
"x-go-name": "Sort"
},
{
"description": "Fields values allow the user to specify optional fields returned for each finding in the response.\nSupported values:\n_cvssScore_ displays the CVSS (v2) score\n_cvssV3_ displays the CVSS v3 score and vector\n_descAndSolution_ displays the description and solution of each finding class",
"explode": false,
"in": "query",
"name": "fields",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings with the given ID.",
"explode": false,
"in": "query",
"name": "id",
"schema": {
"items": {
"format": "int64",
"type": "integer"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings on assets with the specified asset IDs.",
"explode": false,
"in": "query",
"name": "asset.id",
"schema": {
"items": {
"format": "int64",
"type": "integer"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings on assets that contain the specified name.\nCase insensitive.",
"explode": false,
"in": "query",
"name": "asset.name",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings on assets of type *site*, *application*, *api_site*, or *mobile_application*.\nCase sensitive. Combinations are not allowed.",
"in": "query",
"name": "asset.type",
"schema": {
"type": "string"
},
"x-go-name": "AssetType"
},
{
"description": "Filter results to findings with the given severity rating (limited to site findings).\nNOTE: Severity is a WhiteHat Legacy DAST rating, so results may vary depending on current client rating method (Legacy or Advanced).\nSupported values: 0 through 5 inclusive",
"explode": false,
"in": "query",
"name": "severity",
"schema": {
"items": {
"format": "int64",
"type": "integer"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings with the given risk rating.\nNOTE: Risk is a WhiteHat Advanced rating, so results may vary depending on current client rating method (Legacy or Advanced).\nSupported values: 1 through 5 inclusive",
"explode": false,
"in": "query",
"name": "risk",
"schema": {
"items": {
"format": "int64",
"type": "integer"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that contain the specified vulnerability path (location).\nFor sites, location is usually a URL. For applications, it may be a file location.\nCase insensitive.",
"in": "query",
"name": "location",
"schema": {
"type": "string"
},
"x-go-name": "VulnPath"
},
{
"description": "Filter results to findings that have the specified found revision.",
"in": "query",
"name": "foundRevision",
"schema": {
"type": "string"
},
"x-go-name": "FoundRevision"
},
{
"description": "Filter results to findings opened on or after the specified datetime.\nEXAMPLE: 2017-07-21T17:32:28Z",
"in": "query",
"name": "openedStart",
"schema": {
"format": "date-time",
"type": "string"
},
"x-go-name": "OpenedStart"
},
{
"description": "Filter results to findings opened on or before the specified datetime.\nEXAMPLE: 2017-07-21T17:32:28Z",
"in": "query",
"name": "openedEnd",
"schema": {
"format": "date-time",
"type": "string"
},
"x-go-name": "OpenedEnd"
},
{
"description": "Filter results to findings closed on or after the specified datetime.\nEXAMPLE: 2017-07-21T17:32:28Z",
"in": "query",
"name": "closedStart",
"schema": {
"format": "date-time",
"type": "string"
},
"x-go-name": "ClosedStart"
},
{
"description": "Filter results to findings closed on or before the specified datetime.\nEXAMPLE: 2017-07-21T17:32:28Z",
"in": "query",
"name": "closedEnd",
"schema": {
"format": "date-time",
"type": "string"
},
"x-go-name": "ClosedEnd"
},
{
"description": "Filter results to findings on assets associated with the specified clients.",
"explode": false,
"in": "query",
"name": "asset.clientID",
"schema": {
"items": {
"format": "int64",
"type": "integer"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that have the specified vulnerability statuses.\nCase insensitive.\nSupported values: open, closed, mitigated, accepted, out_of_scope, invalid",
"explode": false,
"in": "query",
"name": "status",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that have a vulnerability class that contains the given string.\nCase insensitive.",
"explode": false,
"in": "query",
"name": "class.name",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter type for vuln tags, to be used in combination with the 'tags' filter.\nCase insensitive. If _notags_ is specified, only untagged findings will be returned.\nSupported values: all, any, notags (defaults to 'any')",
"in": "query",
"name": "vulnTagsFilterType",
"schema": {
"type": "string"
},
"x-go-name": "VulnTagsFilterType"
},
{
"description": "Filter results to findings based on the specified tags and the tags filter type.\nCase sensitive.",
"explode": false,
"in": "query",
"name": "tag",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that contain one or more zero-day tags.\nCase sensitive.",
"explode": false,
"in": "query",
"name": "zeroDayTag",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that contain one or more CVE tags.\nCase sensitive.",
"explode": false,
"in": "query",
"name": "cveTag",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that contain one or more CWE tags.\nCase sensitive.",
"explode": false,
"in": "query",
"name": "cweTag",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that contain one or more subtype tags.\nCase sensitive.",
"explode": false,
"in": "query",
"name": "subTypeTag",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that have the specified retest status.\nCase sensitive.",
"explode": false,
"in": "query",
"name": "retestStatus",
"schema": {
"items": {
"type": "string"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings that have the specified verification status.\nSupported values: verified, unverified",
"in": "query",
"name": "verificationStatus",
"schema": {
"type": "string"
},
"x-go-name": "VerificationStatus"
},
{
"description": "Filter results to findings that were filed as a result of a BLA.",
"in": "query",
"name": "manuallyDiscovered",
"schema": {
"type": "boolean"
},
"x-go-name": "ManuallyDiscovered"
},
{
"description": "Filter results to SAST findings that do or do not have direct remediation available.",
"in": "query",
"name": "directRemediationAvailable",
"schema": {
"type": "boolean"
},
"x-go-name": "DirectRemediationAvailable"
},
{
"description": "Filter results to DAST findings that have or have not been marked as unreachable.",
"in": "query",
"name": "unreachable",
"schema": {
"type": "boolean"
},
"x-go-name": "Unreachable"
},
{
"description": "Filter results to findings on assets that have the specified status.\nSupported values: active, inactive",
"in": "query",
"name": "asset.status",
"schema": {
"type": "string"
},
"x-go-name": "AssetStatus"
},
{
"description": "Filter results to the findings that contain the specified attack vector ID.",
"explode": false,
"in": "query",
"name": "attackVectorID",
"schema": {
"items": {
"format": "int64",
"type": "integer"
},
"type": "array"
},
"style": "form"
},
{
"description": "Filter results to findings associated with the given Business Logic Assessment (BLA) ID.",
"explode": false,
"in": "query",
"name": "businessLogicAssessmentID",
"schema": {
"items": {
"format": "int64",
"type": "integer"
},
"type": "array"
},
"style": "form"
}
],
"responses": {
"200": {
"$ref": "#/components/responses/FindingsResponse"
},
"400": {
"$ref": "#/components/responses/BadRequestResponse"
},
"401": {
"$ref": "#/components/responses/UnauthorizedResponse"
},
"403": {
"$ref": "#/components/responses/ForbiddenResponse"
},
"500": {
"$ref": "#/components/responses/GenericError"
}
},
"summary": "Retrieve findings",
"tags": [
"Findings API v2.0"
]
}
}
},
"servers": [
{
"url": "https://sentinel.whitehatsec.com/"
}
],
"tags": [
{
"name": "Findings API v2.0"
}
],
"x-explorer-enabled": false,
"x-readme": {
"proxy-enabled": true
}
}
```