Skip to main content

Retrieve Account's Finding

GET 
/findings/:id/

Query Findings by their compound Id.

Request​

Path Parameters

    id integerrequired

    A unique integer value identifying this finding.

Query Parameters

    include string

    Possible values: [last_found_scan]

    Extra fields to include in response:

    • last_found_scan - Add last_found_scan to response under last_found_scan key

Responses​

Schema

    id stringrequired

    Global ID in the format: <TARGET_ID>-<FINDING_ID>

    target

    object

    required

    id stringrequired
    name stringdeprecated

    Possible values: <= 255 characters

    Name of the target.
    The maximum length is 255 characters.

    site

    object

    Core settings of the target.
    Includes basic target information (like the name, description, and URL) and scanning information (like the authentication and navigation sequences).

    id stringrequired

    A unique Base58 value identifying this object.

    name string

    Possible values: <= 255 characters

    Name of the target or extra host.
    The maximum length is 255 characters.

    desc stringnullable

    Description of the target.

    url urirequired

    URL of the target.

    host stringrequired

    Hostname of the target.

    has_form_login boolean

    If true, the target authentication is done through a login form.
    Read more about how to set up target authentication (login form).
    Defaults to false.

    form_login_url uri

    URL of the login form of the target.

    form_login_check_pattern string

    Possible values: <= 255 characters

    Pattern to check a successful login.
    The maximum length is 255 characters.

    form_login

    object[]

    Field and value pairs to fill the login form.

  • Array [

    • name stringrequired
    value stringrequired
    value_is_sensitive boolean

    Controls sensitivity and obfuscation of value field.
    If true the field is masked on Interfaces and Audit logs.
    When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

  • ]

    • logout_detection_enabled boolean

    If true, detects any undesired logouts that may occur during scans to log back in.
    Requires check_session_url and logout_detectors to be defined.
    Defaults to false.

    has_sequence_login boolean

    If true, the target authentication is done through a recorded login sequence.
    Read more about how to set up target authentication (login sequence).
    Defaults to false.

    has_basic_auth boolean

    If true, the target authentication is done through username and password credentials.
    Defaults to false.

    basic_auth

    object

    Username and password credentials for the basic auth.

    username stringrequired

    Possible values: <= 255 characters

    password stringrequired

    Possible values: <= 255 characters

    password_is_sensitive boolean

    Controls sensitivity and obfuscation of password field.
    If true the field is masked on Interfaces and Audit logs.
    When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

    headers

    object[]

    Custom headers to send.

  • Array [

    • value_is_sensitive boolean

    Controls sensitivity and obfuscation of value field.
    If true the field is masked on Interfaces and Audit logs.
    When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

    name stringrequired
    value stringrequired
    allow_testing boolean
    authentication boolean
    authentication_secondary boolean

  • ]

    • cookies

    object[]

    Custom cookies to send.

  • Array [

    • value_is_sensitive boolean

    Controls sensitivity and obfuscation of value field.
    If true the field is masked on Interfaces and Audit logs.
    When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

    name stringrequired
    value stringrequired
    allow_testing boolean
    authentication boolean
    authentication_secondary boolean

  • ]

    • whitelist

    Additional paths to crawl and scan. For example, "archive/search?query=snyk". Only relative paths are allowed. The blacklist takes precedence over the whitelist.

    blacklist

    URLs to avoid scanning. For example, "https://example.com/pic-delete.php*" or "*.archive.example.com". URLs need to be absolute and wildcards (*) are allowed. The blacklist takes precedence over the whitelist.

    changed date-timerequired

    Date and time of the last change, in ISO 8601 UTC format.
    For example, "2023-08-09T13:27:43.8208302".

    changed_by

    object

    required

    User who last made changes.

    id stringrequired

    A unique Base58 value identifying this object.

    email email

    Possible values: <= 254 characters

    Email of the user.

    name stringrequired

    Possible values: <= 60 characters

    Name of the user.

    auth_enabled boolean

    If true, the target has authentication.
    Defaults to false.

    logout_condition string

    Possible values: [any, all]

    Type of combination of the logout conditions:

    • any - Is logged out if any condition is verified.
    • all - Is logged out only if all condition are verified.
    check_session_url string

    URL to check session.

    has_otp boolean

    If true, the target has two-factor authentication (2FA).
    Read more about how to set up target two-factor authentication (2FA).
    Defaults to false.

    otp_secret string

    The seed/secret obtained when the QR code is displayed to be scanned by the third-party authenticator (TPA) app installed on the phone (e.g., Google Authenticator, 1Password, Authy, Microsoft Authenticator, etc.).
    Read more about how to set up target two-factor authentication (2FA).

    otp_secret_is_sensitive booleanrequired

    Controls sensitivity and obfuscation of otp_secret field.
    If true the field is masked on Interfaces and Audit logs.
    When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.
    Read-only.

    otp_algorithm string

    Possible values: [SHA1, SHA256, SHA512]

    Default value: SHA1

    Secure hash algorithm (SHA) to generate the one-time password (OTP):
    (Defaults to SHA1)

    • SHA1 - Sha1
    • SHA256 - Sha256
    • SHA512 - Sha512
    otp_digits integer

    Possible values: >= -2147483648 and <= 2147483647, [6, 7, 8]

    Default value: 6

    Number of digits of the one-time password (OTP):
    (Defaults to 6)

    • 6 - Six
    • 7 - Seven
    • 8 - Eight
    otp_field string

    CSS selector of the HTML element in the page to enter the one-time password (OTP).
    For example, a text input field. Read more about how to obtain a CSS selector.
    Defaults to "".

    otp_submit string

    CSS selector of the HTML element in the page to submit the one-time password (OTP). For example, a button.
    Read more about how to obtain a CSS selector.
    Defaults to "".

    otp_login_sequence_totp_value string

    Possible values: >= 6 characters and <= 8 characters

    One-time password (OTP) obtained at the time when the login sequence was recorded, i.e., the time-based one-time password (TOTP).
    Defaults to "".

    otp_type string
    otp_url stringrequired
    is_mtls_active booleanrequired

    If true, mTLS is configured and enabled for the target.

    is_signature_active booleanrequired

    If true, message signature is configured and enabled for the target.

    is_mle_active booleanrequired

    If true, MLE (Message Level Encryption) is configured and enabled for the target.

    postman_authentication_enabled boolean

    If true, use Postman authentication when performing the check session request.

    postman_check_session_folder string

    stack

    object[]

    Technologies identified in the target during scans.
    The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities.

  • Array [

    • id stringrequired

    A unique Base58 value identifying this object.

    name Framework Name (string)required

    Possible values: <= 255 characters

    Name of the technology.
    For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress".
    The maximum lenght is 255 characters.

    desc Framework Description (string)nullablerequired

    Description of the technology.
    Defaults to "".

  • ]

    • verified booleanrequired

    If true, the domain is verified. Read-only.

    verification_token stringrequired

    Token used to verify the domain. Read-only.

    verification_date date-timerequired

    Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only.

    verification_method stringrequired

    Possible values: [file, back_office, existing_domain, dns_txt, dns, dns_cname, meta_tag, whitelist, email, aws_route53, cloudflare, waved, akamai]

    Method used in the domain verification:

    • file - Verifies the domain against a text file in the root directory of the website. Learn more in this article.

    • back_office - Automatically set if manually verified in the back-office. Read-only.

    • existing_domain - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only.

    • dns_txt - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in this article.

    • dns - Same as dns_txt.

    • dns_cname - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in this article.

    • meta_tag - Verifies the domain against a meta tag in the index page of the website. Learn more in this article.

    • whitelist - Automatically verifies if the domain is in the whitelist

    • email - Automatically verifies a domain if the user's email is in the same domain as the target

    • aws_route53 - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone.

    • cloudflare - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone.

    • waved - Automatically verifies a domain if there is a waver agreement.

    • akamai - Automatically verifies a domain if the host name exists as an AkamaiHost.

    verification_last_error stringrequired

    Error of the last verification of the domain. Read-only.

    api_scan_settings

    object

    required

    Scanning settings if the target is an API.

    api_schema_type string

    Possible values: [openapi, postman]

    Type of schema that defines the API:

    • openapi - OpenAPI schema.
    • postman - Postman collection.
    api_schema_url stringnullable
    api_schema_file stringnullable

    custom_api_parameters

    object[]

  • Array [

    • name stringrequired
    value stringrequired
    value_is_sensitive boolean

    Controls sensitivity and obfuscation of value field.
    If true the field is masked on Interfaces and Audit logs.
    When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

  • ]

    • media_type string

    Possible values: [application/json, application/x-www-form-urlencoded]

    Format of the payload:

    • application/json - The payload is in JSON format in the request body.
    • application/x-www-form-urlencoded - The payload is encoded in the request URL.
    api_login_url string

    Possible values: <= 2048 characters

    URL to make the authentication request to the API.
    The maximum length is 2048 characters.

    api_login_payload string

    Possible values: <= 4096 characters

    Payload to send in the authentication request.
    The maximum length is 4096 characters.

    api_login_payload_is_sensitive boolean

    Controls sensitivity and obfuscation of api_login_payload field.
    If true the field is masked on Interfaces and Audit logs.
    When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

    api_login_enabled boolean
    api_login_token_field string

    Possible values: <= 256 characters

    Field containing the authentication token in the response to the authentication request.
    The maximum length is 256 characters.

    token_prefix string

    Possible values: <= 16 characters

    Prefix to add to the authentication token.
    For example, "Bearer" or "JWT".
    The maximum length is 16 characters.

    token_parameter_name string

    Possible values: <= 256 characters

    Parameter name to send the authentication token.
    For example, "Authorization".
    The maximum length is 256 characters.

    token_parameter_location string

    Possible values: [cookie, header]

    Where to send the parameter name with the authentication token and the prefix:

    • cookie - Cookie
    • header - Header
    api_login_method string

    Possible values: [api_login, headers_or_cookies]

    Method used for API Target authentication.

    • api_login - API Login
    • headers_or_cookies - Headers/Cookie
    api_payload_login_enabled_secondary boolean

    Enable secondary payload auth for authorization (BOLA) testing .

    api_headers_cookies_login_enabled_secondary boolean

    Enable secondary static headers/cookies auth for authorization (BOLA) testing.

    api_login_payload_secondary string

    Possible values: <= 4096 characters

    Payload to send in the secondary authentication request, used for BOLA detection.

    api_login_payload_secondary_is_sensitive boolean

    Controls sensitivity and obfuscation of api_login_payload_secondary field.
    If true the field is masked on Interfaces and Audit logs.
    When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

    openapi_check_session_method string
    openapi_check_session_media_type string
    openapi_check_session_expired_payload stringnullable
    type string

    Type of target.
    Possible values are "single" for a web application and "api" for an API.
    Defaults to "single".

    desc stringnullabledeprecated

    Description of the target.
    Defaults to "".

    labels

    object[]

  • Array [

    • id stringrequired

    A unique Base58 value identifying this object.

    name stringrequired

    Possible values: <= 255 characters

    Name of the label.
    The maximum length is 255 characters.

    color string

    Possible values: Value must match regular expression ^[a-zA-Z0-9#_-]*$

    Color of the label, in RGB hexadecimal format prefixed with "#".
    For example, "#00FF00" for green.

    changed_by

    object

    required

    User who last made changes.

    id stringrequired

    A unique Base58 value identifying this object.

    email email

    Possible values: <= 254 characters

    Email of the user.

    name stringrequired

    Possible values: <= 60 characters

    Name of the user.

    changed date-timerequired

    Date and time of the last change, in ISO 8601 UTC format.
    For example, "2023-08-09T13:27:43.8208302".

  • ]

    • has_assets booleanrequired
    report_fileformat string

    Possible values: [pdf, docx]

    Report format for the target:
    (Defaults to pdf)

    • pdf - PDF file format.
    • docx - DOCX file format.

    scanning_agent

    object

    nullable

    Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in to_internal_value.

    This is for the drf-spectacular documentation generation.

    id string
    name stringrequired

    Possible values: <= 255 characters

    installer_generated booleanrequired
    online booleanrequired
    fallback booleanrequired
    rx_bytes integerrequired
    tx_bytes integerrequired
    latest_handshake integerrequired

    teams

    object[]

    required

  • Array [

    • id string

    A unique Base58 value identifying this object.

    name stringrequired

  • ]

    • blackout_period

    object

    required

    Time window during which scans are temporarily interrupted.

    begin timerequired

    Time of when the blackout period starts, in ISO 8601 UTC format.
    For example, "13:27".

    cease timerequired

    Time of when the blackout period ceases, in ISO 8601 UTC format.
    For example, "13:27".

    weekdays integer[]required
    enabled boolean

    If true, the blackout period is enabled.

    timezone string

    Possible values: <= 64 characters

    changed date-timerequired

    Date and time of the last change, in ISO 8601 UTC format.
    For example, "2023-08-09T13:27:43.8208302".

    changed_by

    object

    required

    User who last made changes.

    id stringrequired

    A unique Base58 value identifying this object.

    email email

    Possible values: <= 254 characters

    Email of the user.

    name stringrequired

    Possible values: <= 60 characters

    Name of the user.

    scans stringrequired

    Scans that originated the vulnerability finding.

    labels

    object[]

    required

  • Array [

    • id stringrequired

    A unique Base58 value identifying this object.

    name stringrequired

    Possible values: <= 255 characters

    Name of the label.
    The maximum length is 255 characters.

    color string

    Possible values: Value must match regular expression ^[a-zA-Z0-9#_-]*$

    Color of the label, in RGB hexadecimal format prefixed with "#".
    For example, "#00FF00" for green.

    changed_by

    object

    required

    User who last made changes.

    id stringrequired

    A unique Base58 value identifying this object.

    email email

    Possible values: <= 254 characters

    Email of the user.

    name stringrequired

    Possible values: <= 60 characters

    Name of the user.

    changed date-timerequired

    Date and time of the last change, in ISO 8601 UTC format.
    For example, "2023-08-09T13:27:43.8208302".

  • ]

    • fix stringrequired

    Description of how to fix the vulnerability.

    requests

    object[]

    required

    Pairs of requests and responses of the vulnerability finding.

  • Array [

    • request stringnullable
    response stringnullable

  • ]

    • evidence stringrequired

    Evidence with proof of the vulnerability finding.

    extra stringrequired

    Extra details about the vulnerability finding.

    definition

    object

    required

    id stringrequired
    name string

    Possible values: <= 255 characters

    Name of the vulnerability.
    The maximum length is 255 characters.

    desc stringnullable

    Description of the vulnerability.

    cwe_id stringnullable

    Possible values: <= 16 characters

    CWE id.

    cwe_name stringnullable

    Possible values: <= 255 characters

    CWE name

    url stringrequired

    Possible values: <= 66000 characters

    URL of the vulnerability finding. For example, "http://www.example.com/user/show-details". The maximum length is 66000 characters.

    path stringrequired

    URL path of the vulnerability finding. For example, "user/show-details".

    method stringrequired

    Possible values: [get, post, trace, options, put, delete]

    HTTP method used in the request:

    • get - GET
    • post - POST
    • trace - TRACE
    • options - OPTIONS
    • put - PUT
    • delete - DELETE
    insertion_point stringrequired

    Possible values: [cookie, parameter, arbitrary_url_param, header, url_folder, url_filename, json_parameter, request_body, multipart_parameter, graphql_parameter, non_standard_parameter]

    Insertion point of the parameter:

    • cookie - Cookie
    • parameter - Parameter
    • arbitrary_url_param - Parameter
    • header - Header
    • url_folder - URL Path
    • url_filename - URL Path
    • json_parameter - JSON Parameter
    • request_body - Request Body
    • multipart_parameter - Multipart Parameter
    • graphql_parameter - GraphQL Parameter
    • non_standard_parameter - Non Standard Parameter
    parameter stringrequired

    Name of the inserted parameter.
    The maximum length is 1024 characters.

    value stringnullablerequired

    Value of the inserted parameter.

    params stringrequired

    Query parameters of the vulnerability finding, in JSON format. For example, "{'name': ['Joe Smith'], 'phone': ['+919999999999', '+628888888888']}"

    assignee

    object

    required

    id stringrequired

    A unique Base58 value identifying this object.

    email email

    Possible values: <= 254 characters

    Email of the user.

    name stringrequired

    Possible values: <= 60 characters

    Name of the user.

    state string

    Possible values: [notfixed, invalid, accepted, fixed]

    State of the vulnerability finding:
    (Read more about the meaning of vulnerability findings states)

    • notfixed - Not Fixed
    • invalid - Invalid
    • accepted - Accepted
    • fixed - Fixed
    severity integer

    Possible values: >= -2147483648 and <= 2147483647, [10, 20, 30, 40]

    Severity of the vulnerability finding:

    • 10 - low
    • 20 - medium
    • 30 - high
    • 40 - critical
    cvss_score doublenullablerequired

    Score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).

    cvss_vector stringrequired

    Vector with the metrics of the score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).

    last_found date-time

    Date and time of when the vulnerability was last found, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302"

    retesting booleanrequired

    If true, the vulnerability will be retested.
    If, after the retest, the vulnerability is no longer found, the vulnerability finding is marked as fixed. Otherwise, it is marked as not fixed.

    new booleanrequired

    If true, this is a newly found vulnerability. If false, this vulnerability has been found in previous scans.

    review_status string

    Possible values: [notrequired, pending, rejected, accepted, ``]

    Some findings we're unsure are valid and need a manual validation step.

    • notrequired - not required
    • pending - pending review
    • rejected - rejected after review
    • accepted - accepted after review
    review_reason string

    User's reason for finding's review.

    created_at date-timenullablerequired

    Timestamp of the Finding's creation.

    changed date-timerequired

    Date and time of the last change, in ISO 8601 UTC format.
    For example, "2023-08-09T13:27:43.8208302".

    changed_by

    object

    required

    User who last made changes.

    id stringrequired

    A unique Base58 value identifying this object.

    email email

    Possible values: <= 254 characters

    Email of the user.

    name stringrequired

    Possible values: <= 60 characters

    Name of the user.

    comment stringnullable

    Comment on the object.

    expiration_date datenullable

    Expiration date of the acceptance. Required if the account setting 'Require expiration date on acceptance' is set.

    approver_name string

    Name of the person or entity approving the acceptance. Required if the account setting 'Require approval name on acceptance' is set.

    approval_date datenullable

    Date of the approval of the acceptance. Required if the account setting 'Require approval date on acceptance' is set.

Loading...