# List findings

List vulnerability findings.

`GET /sscs/findings`

Scope `sbom:read` | Plan **Growth+**

List vulnerability findings. `status` defaults to `open`: pass it explicitly to see anything else. An unrecognised `status` or `severity` is rejected with 400, not silently ignored. `sbomId` narrows the result to one SBOM. Results are not paginated. Requires the sbom:read scope.

## Query parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `status` | string | no | Finding status. Defaults to open. default open One of `open`, `mitigated`, `accepted_risk`, `false_positive`, `fixed`. |
| `severity` | string | no | Severity filter (upper case). One of `CRITICAL`, `HIGH`, `MEDIUM`, `LOW`. |
| `sbomId` | string | no | Only findings raised against this SBOM. |

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

An array of object:
- `findingId`: optional string
- `orgId`: string
- `sbomId`: string
- `componentId`: string
- `cveId`: string
- `cveSource`: string
  - `nvd`
  - `redhat`
- `matchMethod`: string
  - `cpe_exact`
  - `cpe_version_range`
  - `purl_exact`
  - `purl_version_range`
  - `rhsa_package`
  - `manual`
- `confidence`: string
  - `high`
  - `medium`
  - `low`
- `matchedVia`: optional string Identifier the match was made on.
- `severity`: string
  - `CRITICAL`
  - `HIGH`
  - `MEDIUM`
  - `LOW`
  - `NONE`
- `severityOverride`: optional string Present only when the severity was overridden.
  - `CRITICAL`
  - `HIGH`
  - `MEDIUM`
  - `LOW`
  - `NONE`
- `cvssV3Score`: optional number
- `status`: string
  - `open`
  - `mitigated`
  - `accepted_risk`
  - `false_positive`
  - `fixed`
- `assignedTo`: optional string
- `dueAt`: optional string (date-time)
- `slaBreach`: boolean
- `fixedVersion`: optional string
- `remediationNotes`: optional string
- `vendorId`: optional string Linked vendor id, when the vulnerable component comes from a tracked vendor.
- `rhsaIds`: optional array of string Red Hat advisories that provide the fix.
- `firstSeenAt`: string (date-time)
- `updatedAt`: string (date-time)
- `resolvedAt`: optional string (date-time)

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 400 | `INVALID_STATUS` | no | Unrecognised query value. code INVALID_STATUS or INVALID_SEVERITY. |
| 401 | `INVALID_TOKEN` | no | Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token. |
| 402 | `FEATURE_GATED` | no | The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName. |
| 403 | `INSUFFICIENT_SCOPE` | no | The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN). |
| 429 | `RATE_LIMITED` | yes | Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds. |
| 500 | `DB_ERROR` | no | Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support. |
| 503 | `BILLING_UNAVAILABLE` | yes | Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/sscs/findings" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/sscs/findings",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/sscs/findings", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": [
    {
      "findingId": "vfin_example000001",
      "orgId": "org_example000001",
      "sbomId": "sbom_example000001",
      "componentId": "comp_example000001",
      "cveId": "CVE-2024-00000",
      "cveSource": "nvd",
      "matchMethod": "purl_version_range",
      "confidence": "high",
      "severity": "HIGH",
      "cvssV3Score": 7.5,
      "status": "open",
      "slaBreach": false,
      "fixedVersion": "v1.9.2",
      "firstSeenAt": "2026-09-02T02:10:00Z",
      "updatedAt": "2026-09-02T02:10:00Z"
    }
  ]
}
```