> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-leet-slack-mcp-docs.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Create Finding > Create a user-authored custom finding. ## OpenAPI ````yaml https://spec.speakeasy.com/conductor-one/conductorone/my-source-with-code-samples post /api/v1/findings openapi: 3.1.0 info: description: The C1 API is a HTTP API for managing C1 resources. title: C1 API version: 0.1.0-alpha servers: - description: The C1 API server for the current tenant. url: https://{tenantDomain}.conductor.one variables: tenantDomain: default: example description: The domain of the tenant to use for this request. security: - bearerAuth: [] oauth: [] paths: /api/v1/findings: post: tags: - Findings summary: Create Finding description: Create a user-authored custom finding. operationId: c1.api.finding.v1.FindingService.CreateFinding requestBody: content: application/json: schema: $ref: '#/components/schemas/c1.api.finding.v1.CreateFindingRequest' responses: '200': content: application/json: schema: $ref: '#/components/schemas/c1.api.finding.v1.CreateFindingResponse' description: Successful response x-codeSamples: - lang: go label: CreateFinding source: "package main\n\nimport(\n\t\"context\"\n\t\"github.com/conductorone/conductorone-sdk-go/pkg/models/shared\"\n\tconductoronesdkgo \"github.com/conductorone/conductorone-sdk-go\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := conductoronesdkgo.New(\n conductoronesdkgo.WithSecurity(shared.Security{\n BearerAuth: \"\",\n Oauth: \"\",\n }),\n )\n\n res, err := s.Finding.CreateFinding(ctx, nil)\n if err != nil {\n log.Fatal(err)\n }\n if res.CreateFindingResponse != nil {\n // handle response\n }\n}" components: schemas: c1.api.finding.v1.CreateFindingRequest: description: > The CreateFindingRequest message. This message contains a oneof named target. Only a single field of the following list may be set at a time: - identityUserTarget - appUserTarget - decoyTarget - appResourceTarget - connectorTarget - tenantTarget properties: annotations: additionalProperties: type: string description: >- Arbitrary metadata attached to the finding; filterable by routing rules. type: object appResourceTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.AppResourceTarget' - type: 'null' appUserTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.AppUserTarget' - type: 'null' connectorTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.ConnectorTarget' - type: 'null' customSubType: description: >- User-supplied sub-classification (e.g. "shadow_it"). Part of the dedup identity and filterable via FindingSearch. type: string decoyTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.DecoyTarget' - type: 'null' dedupKeyParts: description: >- Caller-supplied dedup identity. The fingerprint is a domain-separated SHA-256 over ("custom", custom_sub_type, dedup_key_parts...) — see pkg/uhash; parts cannot collide regardless of their byte content. Two creates with the same parts collapse onto one finding. Must be non-empty and every part must be non-empty. items: type: string type: - array - 'null' description: description: Optional finding body (markdown by convention). type: string identityUserTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.IdentityUserTarget' - type: 'null' remediationDescription: description: >- Optional remediation guidance, used as the body of any task created from this finding. type: string severity: description: Severity of the finding. Must be a defined, non-unspecified value. enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: string x-speakeasy-unknown-values: allow tenantTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.TenantTarget' - type: 'null' title: Create Finding Request type: object x-speakeasy-name-override: CreateFindingRequest c1.api.finding.v1.CreateFindingResponse: description: The CreateFindingResponse message. properties: finding: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.Finding' - type: 'null' title: Create Finding Response type: object x-speakeasy-name-override: CreateFindingResponse c1.api.finding.v1.AppResourceTarget: description: AppResourceTarget points at the app resource the finding is about. properties: appId: description: The appId field. type: string appResourceId: description: The appResourceId field. type: string appResourceTypeId: description: The appResourceTypeId field. type: string title: App Resource Target type: object x-speakeasy-name-override: AppResourceTarget c1.api.finding.v1.AppUserTarget: description: The AppUserTarget message. properties: appId: description: The appId field. type: string appUserId: description: The appUserId field. type: string title: App User Target type: object x-speakeasy-name-override: AppUserTarget c1.api.finding.v1.ConnectorTarget: description: ConnectorTarget points at the connector that produced this finding. properties: appId: description: The appId field. type: string connectorId: description: The connectorId field. type: string title: Connector Target type: object x-speakeasy-name-override: ConnectorTarget c1.api.finding.v1.DecoyTarget: description: |- DecoyTarget points at the planted decoy that produced this finding. Populated for findings whose subject is the decoy artifact itself (e.g. decoy_credential_used), giving the UI and routing rules a uniform handle to the decoy alongside the finding_type payload. properties: decoyId: description: The decoyId field. type: string title: Decoy Target type: object x-speakeasy-name-override: DecoyTarget c1.api.finding.v1.IdentityUserTarget: description: The IdentityUserTarget message. properties: identityUserId: description: The identityUserId field. type: string title: Identity User Target type: object x-speakeasy-name-override: IdentityUserTarget c1.api.finding.v1.TenantTarget: description: >- TenantTarget scopes a finding to the whole tenant. It carries no subject id; the finding's tenant is the scope. title: Tenant Target type: object x-speakeasy-name-override: TenantTarget c1.api.finding.v1.Finding: description: > The Finding message. This message contains a oneof named finding_type. Only a single field of the following list may be set at a time: - similarUsernameMatch - serviceAccountMisclassification - nhiUnowned - serviceAccountUnowned - decoyCredentialUsed - custom - connectorAnomalyDetectionDisabled This message contains a oneof named target. Only a single field of the following list may be set at a time: - identityUserTarget - appUserTarget - decoyTarget - appResourceTarget - tenantTarget - connectorTarget This message contains a oneof named evidence. Only a single field of the following list may be set at a time: - similarUsernameMatchEvidence - serviceAccountMisclassificationEvidence properties: appId: description: The appId field. type: string appResourceTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.AppResourceTarget' - type: 'null' appUserTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.AppUserTarget' - type: 'null' assignedOwner: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingOwnerRef' - type: 'null' computedOwner: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingOwnerRef' - type: 'null' connectorAnomalyDetectionDisabled: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.ConnectorAnomalyDetectionDisabledType - type: 'null' connectorTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.ConnectorTarget' - type: 'null' createdAt: format: date-time type: - string - 'null' custom: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.CustomFindingType' - type: 'null' customSubType: description: >- User-supplied sub-classification for custom findings (e.g. "shadow_it"). type: string customTags: additionalProperties: type: string description: The customTags field. type: object decoyCredentialUsed: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.DecoyCredentialUsedType' - type: 'null' decoyTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.DecoyTarget' - type: 'null' dedupKeyParts: description: >- Caller-supplied dedup identity for custom findings; echoed back so IaC clients can roundtrip it. Empty for detector findings. items: type: string type: - array - 'null' description: description: >- User-authored finding body (markdown by convention). Set for custom findings. type: string fingerprint: description: The fingerprint field. type: string firstObservedAt: format: date-time type: - string - 'null' id: description: The id field. type: string identityUserTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.IdentityUserTarget' - type: 'null' lastAppearedAt: format: date-time type: - string - 'null' lastObservedAt: format: date-time type: - string - 'null' nhiUnowned: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.NhiUnownedType' - type: 'null' recurrenceCount: description: The recurrenceCount field. format: uint32 type: integer remediationDescription: description: The remediationDescription field. type: string resolvedAt: format: date-time type: - string - 'null' riskAcceptanceExpiresAt: format: date-time type: - string - 'null' riskAcceptanceJustification: description: The riskAcceptanceJustification field. type: string riskScore: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.FindingRiskScore' - type: 'null' serviceAccountMisclassification: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.ServiceAccountMisclassificationType - type: 'null' serviceAccountMisclassificationEvidence: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.ServiceAccountMisclassificationEvidence - type: 'null' serviceAccountUnowned: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.ServiceAccountUnownedType' - type: 'null' severity: description: The severity field. enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: string x-speakeasy-unknown-values: allow similarUsernameMatch: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.SimilarUsernameMatchType' - type: 'null' similarUsernameMatchEvidence: oneOf: - $ref: >- #/components/schemas/c1.api.finding.v1.SimilarUsernameMatchEvidence - type: 'null' snoozeReason: description: The snoozeReason field. type: string snoozeUntil: format: date-time type: - string - 'null' sourceDetectorId: description: The sourceDetectorId field. type: string sourceKind: description: Who authored the finding (detector, user, external). enum: - FINDING_SOURCE_KIND_UNSPECIFIED - FINDING_SOURCE_KIND_DETECTOR - FINDING_SOURCE_KIND_EXTERNAL type: string x-speakeasy-unknown-values: allow state: description: The state field. enum: - FINDING_STATE_UNSPECIFIED - FINDING_STATE_OPEN - FINDING_STATE_IN_PROGRESS - FINDING_STATE_RESOLVED - FINDING_STATE_SNOOZED - FINDING_STATE_RISK_ACCEPTED - FINDING_STATE_SUPPRESSED type: string x-speakeasy-unknown-values: allow stateUpdatedById: description: The stateUpdatedById field. type: string suppressReason: description: The suppressReason field. type: string taskId: description: The taskId field. type: string tenantTarget: oneOf: - $ref: '#/components/schemas/c1.api.finding.v1.TenantTarget' - type: 'null' updatedAt: format: date-time type: - string - 'null' title: Finding type: object x-speakeasy-name-override: Finding c1.api.finding.v1.FindingOwnerRef: description: > The FindingOwnerRef message. This message contains a oneof named owner. Only a single field of the following list may be set at a time: - identityUserId - appOwnerAppId - managerOfUserId - userSetId properties: appOwnerAppId: description: >- The appOwnerAppId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' identityUserId: description: >- The identityUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' managerOfUserId: description: >- The managerOfUserId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' userSetId: description: >- The userSetId field. This field is part of the `owner` oneof. See the documentation for `c1.api.finding.v1.FindingOwnerRef` for more details. type: - string - 'null' title: Finding Owner Ref type: object x-speakeasy-name-override: FindingOwnerRef c1.api.finding.v1.ConnectorAnomalyDetectionDisabledType: description: |- ConnectorAnomalyDetectionDisabledType: a connector has sync anomaly detection turned off, so a sudden drop in synced data will not trip the circuit breaker. Target: ConnectorTarget. title: Connector Anomaly Detection Disabled Type type: object x-speakeasy-name-override: ConnectorAnomalyDetectionDisabledType c1.api.finding.v1.CustomFindingType: description: >- CustomFindingType: a user- or integration-authored finding. The discriminator carries no payload; the finding's content lives in description / remediation_description / custom_tags. title: Custom Finding Type type: object x-speakeasy-name-override: CustomFindingType c1.api.finding.v1.DecoyCredentialUsedType: description: |- DecoyCredentialUsedType: a planted decoy credential authenticated successfully. properties: decoyId: description: The decoyId field. type: string kind: description: The kind field. enum: - DECOY_CREDENTIAL_KIND_UNSPECIFIED - DECOY_CREDENTIAL_KIND_USER_CLIENT_CREDENTIAL - DECOY_CREDENTIAL_KIND_CONNECTOR_CLIENT - DECOY_CREDENTIAL_KIND_WORKLOAD_FEDERATION - DECOY_CREDENTIAL_KIND_ACCESS_TOKEN type: string x-speakeasy-unknown-values: allow title: Decoy Credential Used Type type: object x-speakeasy-name-override: DecoyCredentialUsedType c1.api.finding.v1.NhiUnownedType: description: |- NhiUnownedType: an AppResource with a non-human-identity type has no primary owner. Target: AppResourceTarget (the unowned NHI resource). title: Nhi Unowned Type type: object x-speakeasy-name-override: NhiUnownedType c1.api.finding.v1.FindingRiskScore: description: The FindingRiskScore message. properties: originalScore: description: The originalScore field. format: uint32 type: integer overrideByUserId: description: The overrideByUserId field. type: string overrideScore: description: The overrideScore field. format: uint32 type: integer riskFactors: description: The riskFactors field. items: $ref: '#/components/schemas/c1.api.finding.v1.FindingRiskFactor' type: - array - 'null' score: description: The score field. format: uint32 type: integer systemScore: description: The systemScore field. format: uint32 type: integer title: Finding Risk Score type: object x-speakeasy-name-override: FindingRiskScore c1.api.finding.v1.ServiceAccountMisclassificationType: description: The ServiceAccountMisclassificationType message. properties: currentAccountType: description: The currentAccountType field. enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: string x-speakeasy-unknown-values: allow detectedAccountType: description: The detectedAccountType field. enum: - APP_USER_TYPE_UNSPECIFIED - APP_USER_TYPE_USER - APP_USER_TYPE_SERVICE_ACCOUNT - APP_USER_TYPE_SYSTEM_ACCOUNT type: string x-speakeasy-unknown-values: allow title: Service Account Misclassification Type type: object x-speakeasy-name-override: ServiceAccountMisclassificationType c1.api.finding.v1.ServiceAccountMisclassificationEvidence: description: The ServiceAccountMisclassificationEvidence message. properties: detectionReason: description: The detectionReason field. type: string title: Service Account Misclassification Evidence type: object x-speakeasy-name-override: ServiceAccountMisclassificationEvidence c1.api.finding.v1.ServiceAccountUnownedType: description: |- ServiceAccountUnownedType: a service-account-classified AppUser has no primary owner. Target: AppUserTarget (the unowned service account). title: Service Account Unowned Type type: object x-speakeasy-name-override: ServiceAccountUnownedType c1.api.finding.v1.SimilarUsernameMatchType: description: The SimilarUsernameMatchType message. properties: proposedIdentityUserId: description: The proposedIdentityUserId field. type: string title: Similar Username Match Type type: object x-speakeasy-name-override: SimilarUsernameMatchType c1.api.finding.v1.SimilarUsernameMatchEvidence: description: The SimilarUsernameMatchEvidence message. properties: appUsername: description: The appUsername field. type: string identityUsername: description: The identityUsername field. type: string similarityScore: description: The similarityScore field. type: number title: Similar Username Match Evidence type: object x-speakeasy-name-override: SimilarUsernameMatchEvidence c1.api.finding.v1.FindingRiskFactor: description: The FindingRiskFactor message. properties: description: description: The description field. type: string name: description: The name field. type: string severity: description: The severity field. enum: - FINDING_SEVERITY_UNSPECIFIED - FINDING_SEVERITY_INFO - FINDING_SEVERITY_LOW - FINDING_SEVERITY_MEDIUM - FINDING_SEVERITY_HIGH - FINDING_SEVERITY_CRITICAL type: string x-speakeasy-unknown-values: allow weight: description: The weight field. format: uint32 type: integer title: Finding Risk Factor type: object x-speakeasy-name-override: FindingRiskFactor securitySchemes: bearerAuth: scheme: bearer type: http oauth: description: >- This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the [c1TokenSource.Token()](https://github.com/ConductorOne/conductorone-sdk-go/blob/3375fe7c0126d17e7ec4e711693dee7b791023aa/token_source.go#L101-L187) function. flows: clientCredentials: scopes: {} tokenUrl: /auth/v1/token type: oauth2 ````