Skip to main content
GET
/
findings
List findings
curl --request GET \
  --url https://api.example.com/findings
Returns findings across every scan in the organization, with filtering and sorting. Only findings that have passed automated verification (verification_status = approved) are returned.
Scope required: read

​
Request

curl "https://api.hacktron.ai/v1/findings?severity=critical&state=open&sort_by=found_at&sort_order=DESC&page=1&limit=50" \
  -H "X-Api-Key: $HACKTRON_API_KEY"

​
Query parameters

ParameterTypeDefaultDescription
pageinteger11‑based page number.
limitinteger15Items per page. Max 100.
severityenum—Filter by severity: critical, high, medium, low, info.
stateenum—Filter by state: open, true_positive, false_positive, accepted_risk, resolved.
scan_idUUID—Only return findings produced by this scan. The scan must exist in the organization.
sort_byenumfound_atOne of found_at, updated_at, severity.
sort_orderenumDESCASC or DESC.

​
Response

200 OK 
{
  "data": [
    {
      "id": "d1e2f3a4-b5c6-7890-1234-567890abcdef",
      "title": "SQL injection in /api/v1/checkout",
      "category": "injection",
      "severity": "critical",
      "state": "open",
      "description": "User-supplied cart ID is concatenated into a SQL query...",
      "affected_file": "apps/api/src/checkout/checkout.service.ts",
      "affected_code": "const rows = await conn.query(`SELECT * FROM carts WHERE id = '${cartId}'`);",
      "proof_of_concept": "POST /api/v1/checkout with cart_id=1' OR '1'='1",
      "impact": "Full read access to the carts table, including other customers' items.",
      "root_cause": "String interpolation instead of parameterised query.",
      "remediation": "Use parameterised queries via the driver's placeholder API.",
      "tags": ["injection", "sql"],
      "scan_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "found_at": "2026-04-13T12:15:00.000Z",
      "updated_at": "2026-04-13T12:20:00.000Z"
    }
  ],
  "total": 284,
  "page": 1,
  "limit": 50
}

​
Finding fields

FieldTypeDescription
idUUIDFinding identifier.
titlestringShort summary.
categorystringVulnerability category (for example injection, auth, xss).
severityenumcritical, high, medium, low, info.
stateenumopen, true_positive, false_positive, accepted_risk, resolved.
descriptionstringLong‑form description of the issue.
affected_filestringPath relative to the repository root.
affected_codestringCode snippet of the affected location.
proof_of_conceptstring|nullReproduction steps or payload. null if none was captured.
impactstring|nullImpact narrative.
root_causestring|nullRoot-cause narrative.
remediationstring|nullSuggested fix.
tagsstring[]Free‑form tags.
scan_idUUID|nullScan that produced this finding.
found_atstringISO 8601 timestamp when the finding was first discovered.
updated_atstringISO 8601 timestamp of the most recent state or severity change.

​
Errors

  • 404 — scan_id was provided but the scan does not exist or is not visible.