Search

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.FindingSearch.Search(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.FindingSearchResponse != nil {
        // handle response
    }
}

import { ConductoroneSDKTypescript } from "conductorone-sdk-typescript";

const conductoroneSDKTypescript = new ConductoroneSDKTypescript({
  security: {
    bearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
    oauth: "<YOUR_OAUTH_HERE>",
  },
});

async function run() {
  const result = await conductoroneSDKTypescript.findingSearch.search();

  console.log(result);
}

run();

curl --request POST \
  --url https://{tenantDomain}.conductor.one/api/v1/findings/search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "appIds": [
    "<string>"
  ],
  "appResourceIds": [
    "<string>"
  ],
  "appResourceTraitIds": [
    "<string>"
  ],
  "appResourceTypeIds": [
    "<string>"
  ],
  "appUserIds": [
    "<string>"
  ],
  "appUserTypes": [],
  "connectorIds": [
    "<string>"
  ],
  "customSubTypes": [
    "<string>"
  ],
  "decoyIds": [
    "<string>"
  ],
  "findingTypes": [],
  "includeUnassigned": true,
  "nhiTypes": [],
  "ownerIdentityUserIds": [
    "<string>"
  ],
  "pageSize": 123,
  "pageToken": "<string>",
  "query": "<string>",
  "refs": [
    {
      "id": "<string>"
    }
  ],
  "scopeToAppOwner": true,
  "severities": [],
  "sourceKinds": [],
  "states": []
}
'

import requests

url = "https://{tenantDomain}.conductor.one/api/v1/findings/search"

payload = {
    "appIds": ["<string>"],
    "appResourceIds": ["<string>"],
    "appResourceTraitIds": ["<string>"],
    "appResourceTypeIds": ["<string>"],
    "appUserIds": ["<string>"],
    "appUserTypes": [],
    "connectorIds": ["<string>"],
    "customSubTypes": ["<string>"],
    "decoyIds": ["<string>"],
    "findingTypes": [],
    "includeUnassigned": True,
    "nhiTypes": [],
    "ownerIdentityUserIds": ["<string>"],
    "pageSize": 123,
    "pageToken": "<string>",
    "query": "<string>",
    "refs": [{ "id": "<string>" }],
    "scopeToAppOwner": True,
    "severities": [],
    "sourceKinds": [],
    "states": []
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    appIds: ['<string>'],
    appResourceIds: ['<string>'],
    appResourceTraitIds: ['<string>'],
    appResourceTypeIds: ['<string>'],
    appUserIds: ['<string>'],
    appUserTypes: [],
    connectorIds: ['<string>'],
    customSubTypes: ['<string>'],
    decoyIds: ['<string>'],
    findingTypes: [],
    includeUnassigned: true,
    nhiTypes: [],
    ownerIdentityUserIds: ['<string>'],
    pageSize: 123,
    pageToken: '<string>',
    query: '<string>',
    refs: [{id: '<string>'}],
    scopeToAppOwner: true,
    severities: [],
    sourceKinds: [],
    states: []
  })
};

fetch('https://{tenantDomain}.conductor.one/api/v1/findings/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/findings/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'appIds' => [
        '<string>'
    ],
    'appResourceIds' => [
        '<string>'
    ],
    'appResourceTraitIds' => [
        '<string>'
    ],
    'appResourceTypeIds' => [
        '<string>'
    ],
    'appUserIds' => [
        '<string>'
    ],
    'appUserTypes' => [
        
    ],
    'connectorIds' => [
        '<string>'
    ],
    'customSubTypes' => [
        '<string>'
    ],
    'decoyIds' => [
        '<string>'
    ],
    'findingTypes' => [
        
    ],
    'includeUnassigned' => true,
    'nhiTypes' => [
        
    ],
    'ownerIdentityUserIds' => [
        '<string>'
    ],
    'pageSize' => 123,
    'pageToken' => '<string>',
    'query' => '<string>',
    'refs' => [
        [
                'id' => '<string>'
        ]
    ],
    'scopeToAppOwner' => true,
    'severities' => [
        
    ],
    'sourceKinds' => [
        
    ],
    'states' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/findings/search")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"appIds\": [\n    \"<string>\"\n  ],\n  \"appResourceIds\": [\n    \"<string>\"\n  ],\n  \"appResourceTraitIds\": [\n    \"<string>\"\n  ],\n  \"appResourceTypeIds\": [\n    \"<string>\"\n  ],\n  \"appUserIds\": [\n    \"<string>\"\n  ],\n  \"appUserTypes\": [],\n  \"connectorIds\": [\n    \"<string>\"\n  ],\n  \"customSubTypes\": [\n    \"<string>\"\n  ],\n  \"decoyIds\": [\n    \"<string>\"\n  ],\n  \"findingTypes\": [],\n  \"includeUnassigned\": true,\n  \"nhiTypes\": [],\n  \"ownerIdentityUserIds\": [\n    \"<string>\"\n  ],\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"query\": \"<string>\",\n  \"refs\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"scopeToAppOwner\": true,\n  \"severities\": [],\n  \"sourceKinds\": [],\n  \"states\": []\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}.conductor.one/api/v1/findings/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"appIds\": [\n    \"<string>\"\n  ],\n  \"appResourceIds\": [\n    \"<string>\"\n  ],\n  \"appResourceTraitIds\": [\n    \"<string>\"\n  ],\n  \"appResourceTypeIds\": [\n    \"<string>\"\n  ],\n  \"appUserIds\": [\n    \"<string>\"\n  ],\n  \"appUserTypes\": [],\n  \"connectorIds\": [\n    \"<string>\"\n  ],\n  \"customSubTypes\": [\n    \"<string>\"\n  ],\n  \"decoyIds\": [\n    \"<string>\"\n  ],\n  \"findingTypes\": [],\n  \"includeUnassigned\": true,\n  \"nhiTypes\": [],\n  \"ownerIdentityUserIds\": [\n    \"<string>\"\n  ],\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"query\": \"<string>\",\n  \"refs\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"scopeToAppOwner\": true,\n  \"severities\": [],\n  \"sourceKinds\": [],\n  \"states\": []\n}"

response = http.request(request)
puts response.read_body

{
  "list": [
    {
      "appId": "<string>",
      "appResourceTarget": {
        "appId": "<string>",
        "appResourceId": "<string>",
        "appResourceTypeId": "<string>"
      },
      "appUserTarget": {
        "appId": "<string>",
        "appUserId": "<string>"
      },
      "assignedOwner": {
        "appOwnerAppId": "<string>",
        "identityUserId": "<string>",
        "managerOfUserId": "<string>",
        "userSetId": "<string>"
      },
      "computedOwner": {
        "appOwnerAppId": "<string>",
        "identityUserId": "<string>",
        "managerOfUserId": "<string>",
        "userSetId": "<string>"
      },
      "connectorAnomalyDetectionDisabled": {},
      "connectorTarget": {
        "appId": "<string>",
        "connectorId": "<string>"
      },
      "createdAt": "2023-11-07T05:31:56Z",
      "custom": {},
      "customSubType": "<string>",
      "customTags": {},
      "decoyCredentialUsed": {
        "decoyId": "<string>"
      },
      "decoyTarget": {
        "decoyId": "<string>"
      },
      "dedupKeyParts": [
        "<string>"
      ],
      "description": "<string>",
      "fingerprint": "<string>",
      "firstObservedAt": "2023-11-07T05:31:56Z",
      "id": "<string>",
      "identityUserTarget": {
        "identityUserId": "<string>"
      },
      "lastAppearedAt": "2023-11-07T05:31:56Z",
      "lastObservedAt": "2023-11-07T05:31:56Z",
      "nhiUnowned": {},
      "recurrenceCount": 123,
      "remediationDescription": "<string>",
      "resolvedAt": "2023-11-07T05:31:56Z",
      "riskAcceptanceExpiresAt": "2023-11-07T05:31:56Z",
      "riskAcceptanceJustification": "<string>",
      "riskScore": {
        "originalScore": 123,
        "overrideByUserId": "<string>",
        "overrideScore": 123,
        "riskFactors": [
          {
            "description": "<string>",
            "name": "<string>",
            "weight": 123
          }
        ],
        "score": 123,
        "systemScore": 123
      },
      "serviceAccountMisclassification": {},
      "serviceAccountMisclassificationEvidence": {
        "detectionReason": "<string>"
      },
      "serviceAccountUnowned": {},
      "similarUsernameMatch": {
        "proposedIdentityUserId": "<string>"
      },
      "similarUsernameMatchEvidence": {
        "appUsername": "<string>",
        "identityUsername": "<string>",
        "similarityScore": 123
      },
      "snoozeReason": "<string>",
      "snoozeUntil": "2023-11-07T05:31:56Z",
      "sourceDetectorId": "<string>",
      "stateUpdatedById": "<string>",
      "suppressReason": "<string>",
      "taskId": "<string>",
      "tenantTarget": {},
      "updatedAt": "2023-11-07T05:31:56Z"
    }
  ],
  "nextPageToken": "<string>"
}

POST

api

findings

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.FindingSearch.Search(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.FindingSearchResponse != nil {
        // handle response
    }
}

import { ConductoroneSDKTypescript } from "conductorone-sdk-typescript";

const conductoroneSDKTypescript = new ConductoroneSDKTypescript({
  security: {
    bearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
    oauth: "<YOUR_OAUTH_HERE>",
  },
});

async function run() {
  const result = await conductoroneSDKTypescript.findingSearch.search();

  console.log(result);
}

run();

curl --request POST \
  --url https://{tenantDomain}.conductor.one/api/v1/findings/search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "appIds": [
    "<string>"
  ],
  "appResourceIds": [
    "<string>"
  ],
  "appResourceTraitIds": [
    "<string>"
  ],
  "appResourceTypeIds": [
    "<string>"
  ],
  "appUserIds": [
    "<string>"
  ],
  "appUserTypes": [],
  "connectorIds": [
    "<string>"
  ],
  "customSubTypes": [
    "<string>"
  ],
  "decoyIds": [
    "<string>"
  ],
  "findingTypes": [],
  "includeUnassigned": true,
  "nhiTypes": [],
  "ownerIdentityUserIds": [
    "<string>"
  ],
  "pageSize": 123,
  "pageToken": "<string>",
  "query": "<string>",
  "refs": [
    {
      "id": "<string>"
    }
  ],
  "scopeToAppOwner": true,
  "severities": [],
  "sourceKinds": [],
  "states": []
}
'

import requests

url = "https://{tenantDomain}.conductor.one/api/v1/findings/search"

payload = {
    "appIds": ["<string>"],
    "appResourceIds": ["<string>"],
    "appResourceTraitIds": ["<string>"],
    "appResourceTypeIds": ["<string>"],
    "appUserIds": ["<string>"],
    "appUserTypes": [],
    "connectorIds": ["<string>"],
    "customSubTypes": ["<string>"],
    "decoyIds": ["<string>"],
    "findingTypes": [],
    "includeUnassigned": True,
    "nhiTypes": [],
    "ownerIdentityUserIds": ["<string>"],
    "pageSize": 123,
    "pageToken": "<string>",
    "query": "<string>",
    "refs": [{ "id": "<string>" }],
    "scopeToAppOwner": True,
    "severities": [],
    "sourceKinds": [],
    "states": []
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    appIds: ['<string>'],
    appResourceIds: ['<string>'],
    appResourceTraitIds: ['<string>'],
    appResourceTypeIds: ['<string>'],
    appUserIds: ['<string>'],
    appUserTypes: [],
    connectorIds: ['<string>'],
    customSubTypes: ['<string>'],
    decoyIds: ['<string>'],
    findingTypes: [],
    includeUnassigned: true,
    nhiTypes: [],
    ownerIdentityUserIds: ['<string>'],
    pageSize: 123,
    pageToken: '<string>',
    query: '<string>',
    refs: [{id: '<string>'}],
    scopeToAppOwner: true,
    severities: [],
    sourceKinds: [],
    states: []
  })
};

fetch('https://{tenantDomain}.conductor.one/api/v1/findings/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/findings/search",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'appIds' => [
        '<string>'
    ],
    'appResourceIds' => [
        '<string>'
    ],
    'appResourceTraitIds' => [
        '<string>'
    ],
    'appResourceTypeIds' => [
        '<string>'
    ],
    'appUserIds' => [
        '<string>'
    ],
    'appUserTypes' => [
        
    ],
    'connectorIds' => [
        '<string>'
    ],
    'customSubTypes' => [
        '<string>'
    ],
    'decoyIds' => [
        '<string>'
    ],
    'findingTypes' => [
        
    ],
    'includeUnassigned' => true,
    'nhiTypes' => [
        
    ],
    'ownerIdentityUserIds' => [
        '<string>'
    ],
    'pageSize' => 123,
    'pageToken' => '<string>',
    'query' => '<string>',
    'refs' => [
        [
                'id' => '<string>'
        ]
    ],
    'scopeToAppOwner' => true,
    'severities' => [
        
    ],
    'sourceKinds' => [
        
    ],
    'states' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/findings/search")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"appIds\": [\n    \"<string>\"\n  ],\n  \"appResourceIds\": [\n    \"<string>\"\n  ],\n  \"appResourceTraitIds\": [\n    \"<string>\"\n  ],\n  \"appResourceTypeIds\": [\n    \"<string>\"\n  ],\n  \"appUserIds\": [\n    \"<string>\"\n  ],\n  \"appUserTypes\": [],\n  \"connectorIds\": [\n    \"<string>\"\n  ],\n  \"customSubTypes\": [\n    \"<string>\"\n  ],\n  \"decoyIds\": [\n    \"<string>\"\n  ],\n  \"findingTypes\": [],\n  \"includeUnassigned\": true,\n  \"nhiTypes\": [],\n  \"ownerIdentityUserIds\": [\n    \"<string>\"\n  ],\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"query\": \"<string>\",\n  \"refs\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"scopeToAppOwner\": true,\n  \"severities\": [],\n  \"sourceKinds\": [],\n  \"states\": []\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}.conductor.one/api/v1/findings/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"appIds\": [\n    \"<string>\"\n  ],\n  \"appResourceIds\": [\n    \"<string>\"\n  ],\n  \"appResourceTraitIds\": [\n    \"<string>\"\n  ],\n  \"appResourceTypeIds\": [\n    \"<string>\"\n  ],\n  \"appUserIds\": [\n    \"<string>\"\n  ],\n  \"appUserTypes\": [],\n  \"connectorIds\": [\n    \"<string>\"\n  ],\n  \"customSubTypes\": [\n    \"<string>\"\n  ],\n  \"decoyIds\": [\n    \"<string>\"\n  ],\n  \"findingTypes\": [],\n  \"includeUnassigned\": true,\n  \"nhiTypes\": [],\n  \"ownerIdentityUserIds\": [\n    \"<string>\"\n  ],\n  \"pageSize\": 123,\n  \"pageToken\": \"<string>\",\n  \"query\": \"<string>\",\n  \"refs\": [\n    {\n      \"id\": \"<string>\"\n    }\n  ],\n  \"scopeToAppOwner\": true,\n  \"severities\": [],\n  \"sourceKinds\": [],\n  \"states\": []\n}"

response = http.request(request)
puts response.read_body

{
  "list": [
    {
      "appId": "<string>",
      "appResourceTarget": {
        "appId": "<string>",
        "appResourceId": "<string>",
        "appResourceTypeId": "<string>"
      },
      "appUserTarget": {
        "appId": "<string>",
        "appUserId": "<string>"
      },
      "assignedOwner": {
        "appOwnerAppId": "<string>",
        "identityUserId": "<string>",
        "managerOfUserId": "<string>",
        "userSetId": "<string>"
      },
      "computedOwner": {
        "appOwnerAppId": "<string>",
        "identityUserId": "<string>",
        "managerOfUserId": "<string>",
        "userSetId": "<string>"
      },
      "connectorAnomalyDetectionDisabled": {},
      "connectorTarget": {
        "appId": "<string>",
        "connectorId": "<string>"
      },
      "createdAt": "2023-11-07T05:31:56Z",
      "custom": {},
      "customSubType": "<string>",
      "customTags": {},
      "decoyCredentialUsed": {
        "decoyId": "<string>"
      },
      "decoyTarget": {
        "decoyId": "<string>"
      },
      "dedupKeyParts": [
        "<string>"
      ],
      "description": "<string>",
      "fingerprint": "<string>",
      "firstObservedAt": "2023-11-07T05:31:56Z",
      "id": "<string>",
      "identityUserTarget": {
        "identityUserId": "<string>"
      },
      "lastAppearedAt": "2023-11-07T05:31:56Z",
      "lastObservedAt": "2023-11-07T05:31:56Z",
      "nhiUnowned": {},
      "recurrenceCount": 123,
      "remediationDescription": "<string>",
      "resolvedAt": "2023-11-07T05:31:56Z",
      "riskAcceptanceExpiresAt": "2023-11-07T05:31:56Z",
      "riskAcceptanceJustification": "<string>",
      "riskScore": {
        "originalScore": 123,
        "overrideByUserId": "<string>",
        "overrideScore": 123,
        "riskFactors": [
          {
            "description": "<string>",
            "name": "<string>",
            "weight": 123
          }
        ],
        "score": 123,
        "systemScore": 123
      },
      "serviceAccountMisclassification": {},
      "serviceAccountMisclassificationEvidence": {
        "detectionReason": "<string>"
      },
      "serviceAccountUnowned": {},
      "similarUsernameMatch": {
        "proposedIdentityUserId": "<string>"
      },
      "similarUsernameMatchEvidence": {
        "appUsername": "<string>",
        "identityUsername": "<string>",
        "similarityScore": 123
      },
      "snoozeReason": "<string>",
      "snoozeUntil": "2023-11-07T05:31:56Z",
      "sourceDetectorId": "<string>",
      "stateUpdatedById": "<string>",
      "suppressReason": "<string>",
      "taskId": "<string>",
      "tenantTarget": {},
      "updatedAt": "2023-11-07T05:31:56Z"
    }
  ],
  "nextPageToken": "<string>"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization

string

header

required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The FindingSearchRequest message.

appIds

string[] | null

Filter by app IDs (OR within field).

appResourceIds

string[] | null

Filter by app resource IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_id is in this list. An app resource is app-scoped, so pair with app_ids (and app_resource_type_ids) to hit the composite (tenant_id, app_id, app_resource_type_id, app_resource_id) index.

appResourceTraitIds

string[] | null

Filter to findings whose target resource's type carries any of these traits (e.g. the builtin agent / secret trait ids). OR within field; empty = not applied.

appResourceTypeIds

string[] | null

Filter by app resource type IDs (OR within field). Matches findings whose target.app_resource_target.app_resource_type_id is in this list.

appUserIds

string[] | null

Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list.

appUserTypes

enum<string>[] | null

Filter to findings whose target is an app user of these types (OR within field). Empty = not applied.

Available options:

APP_USER_TYPE_UNSPECIFIED,

APP_USER_TYPE_USER,

APP_USER_TYPE_SERVICE_ACCOUNT,

APP_USER_TYPE_SYSTEM_ACCOUNT

connectorIds

string[] | null

Filter by connector IDs (OR within field). Matches findings whose target.connector_target.connector_id is in this list.

customSubTypes

string[] | null

Filter by custom sub-type (OR within field). Matches custom findings whose custom_sub_type equals any listed value.

decoyIds

string[] | null

Filter by decoy IDs (OR within field). Matches findings whose target.decoy_target.decoy_id is in this list.

findingTypes

enum<string>[] | null

Filter by finding type (OR within field).

Available options:

FINDING_TYPE_UNSPECIFIED,

FINDING_TYPE_SIMILAR_USERNAME_MATCH,

FINDING_TYPE_SERVICE_ACCOUNT_MISCLASSIFICATION,

FINDING_TYPE_NHI_UNOWNED,

FINDING_TYPE_SERVICE_ACCOUNT_UNOWNED,

FINDING_TYPE_DECOY_CREDENTIAL_USED,

FINDING_TYPE_CUSTOM,

FINDING_TYPE_CONNECTOR_ANOMALY_DETECTION_DISABLED

includeUnassigned

boolean

When true, includes findings with no effective identity-user owner. An explicit predicate for direct API callers who prefer a bool over the "unassigned" sentinel in owner_identity_user_ids; both signals are accepted.

nhiTypes

enum<string>[] | null

Filter to findings whose target resource's nhi_type is one of these (OR within field). Empty = not applied; pass all NhiType values to match any nhi resource.

Available options:

NHI_TYPE_UNSPECIFIED,

NHI_TYPE_APP_REGISTRATION,

NHI_TYPE_ASSUMABLE_ROLE,

NHI_TYPE_MANAGED_IDENTITY

ownerIdentityUserIds

string[] | null

Filter by effective owner identity-user IDs (OR within field). Matches findings whose effective owner (assigned_owner if set, else computed_owner) resolves to an identity user in this list. The reserved "unassigned" sentinel token selects findings with no effective identity-user owner; real identity-user IDs are exactly 27 alphanumerics so the token cannot collide.

pageSize

integer<int32>

Maximum number of findings to return per page.

pageToken

string

Pagination token from a previous response.

query

string

Free text search query.

refs

Finding Ref · object[] | null

Restrict results to these finding refs by ID (OR within field). Backs the websocket-notify re-query, which refetches just the changed finding(s) to patch a row in place or detect it dropping out of the filter; empty = not applied. Hits the (tenant_id, id) primary key.

Show child attributes

scopeToAppOwner

boolean

When true, restricts results to findings for apps you own. The caller is resolved from request credentials (no user id is read from the request), so results are always limited to your own apps.

severities

enum<string>[] | null

Filter by severities (OR within field).

Available options:

FINDING_SEVERITY_UNSPECIFIED,

FINDING_SEVERITY_INFO,

FINDING_SEVERITY_LOW,

FINDING_SEVERITY_MEDIUM,

FINDING_SEVERITY_HIGH,

FINDING_SEVERITY_CRITICAL

sourceKinds

enum<string>[] | null

Filter by source kind (OR within field).

Available options:

FINDING_SOURCE_KIND_UNSPECIFIED,

FINDING_SOURCE_KIND_DETECTOR,

FINDING_SOURCE_KIND_EXTERNAL

states

enum<string>[] | null

Filter by states (OR within field).

Available options:

FINDING_STATE_UNSPECIFIED,

FINDING_STATE_OPEN,

FINDING_STATE_IN_PROGRESS,

FINDING_STATE_RESOLVED,

FINDING_STATE_SNOOZED,

FINDING_STATE_RISK_ACCEPTED,

FINDING_STATE_SUPPRESSED

Response

200 - application/json

Successful response

The FindingSearchResponse message.

list

Finding · object[] | null

The list field.

Show child attributes

nextPageToken

string

The nextPageToken field.

Bulk Create Finding Tasks

⌘I

Welcome

Endpoints

Authorizations

Body

Response