docs

List findings

GET /sscs/findings

Scope sbom:read Plan Growth+

List vulnerability findings. status defaults to open: pass it explicitly to see anything else. An unrecognised status or severity is rejected with 400, not silently ignored. sbomId narrows the result to one SBOM. Results are not paginated. Requires the sbom:read scope.

Example

curl "https://api.autociso.io/api/v1/sscs/findings" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": [
    {
      "findingId": "vfin_example000001",
      "orgId": "org_example000001",
      "sbomId": "sbom_example000001",
      "componentId": "comp_example000001",
      "cveId": "CVE-2024-00000",
      "cveSource": "nvd",
      "matchMethod": "purl_version_range",
      "confidence": "high",
      "severity": "HIGH",
      "cvssV3Score": 7.5,
      "status": "open",
      "slaBreach": false,
      "fixedVersion": "v1.9.2",
      "firstSeenAt": "2026-09-02T02:10:00Z",
      "updatedAt": "2026-09-02T02:10:00Z"
    }
  ]
}

Query parameters

  • status string
    Finding status. Defaults to open. default open
    "open" | "mitigated" | "accepted_risk" | "false_positive" | "fixed"
  • severity string
    Severity filter (upper case).
    "CRITICAL" | "HIGH" | "MEDIUM" | "LOW"
  • sbomId string
    Only findings raised against this SBOM.

Returns

The data field of the standard { data, error, meta } envelope:

An array of object:

  • findingId string
  • orgId string required
  • sbomId string required
  • componentId string required
  • cveId string required
  • cveSource string required
    "nvd" | "redhat"
  • matchMethod string required
    "cpe_exact" | "cpe_version_range" | "purl_exact" | "purl_version_range" | "rhsa_package" | "manual"
  • confidence string required
    "high" | "medium" | "low"
  • matchedVia string
    Identifier the match was made on.
  • severity string required
    "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "NONE"
  • severityOverride string
    Present only when the severity was overridden.
    "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "NONE"
  • cvssV3Score number
  • status string required
    "open" | "mitigated" | "accepted_risk" | "false_positive" | "fixed"
  • assignedTo string
  • dueAt string (date-time)
  • slaBreach boolean required
  • fixedVersion string
  • remediationNotes string
  • vendorId string
    Linked vendor id, when the vulnerable component comes from a tracked vendor.
  • rhsaIds array of string
    Red Hat advisories that provide the fix.
  • firstSeenAt string (date-time) required
  • updatedAt string (date-time) required
  • resolvedAt string (date-time)

Errors

Status Code Retry Meaning
400 INVALID_STATUS no Unrecognised query value. code INVALID_STATUS or INVALID_SEVERITY.
401 INVALID_TOKEN no Missing (UNAUTHORIZED) or invalid, expired or revoked (INVALID_TOKEN) token.
402 FEATURE_GATED no The tenant plan does not include supply chain security. code FEATURE_GATED; args.feature, args.minTier, args.minTierName.
403 INSUFFICIENT_SCOPE no The token lacks the required scope (INSUFFICIENT_SCOPE) or the request is refused (FORBIDDEN).
429 RATE_LIMITED yes Too many failed authentication attempts from this address. code RATE_LIMITED; wait Retry-After seconds.
500 DB_ERROR no Unexpected server error. code DB_ERROR (or VALIDATION_ERROR when the request could not be validated); quote error.id to support.
503 BILLING_UNAVAILABLE yes Billing is temporarily unavailable, so the plan could not be checked. code BILLING_UNAVAILABLE. Retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc