# List findings

`GET /app/findings`

Everything the scanners found across the workspace; info findings are left out unless asked for. Filter by scan, severity, asset, project, scanner or issue status.

Scope: `issues:read`. Paged: `page`, `limit` (100 by default, at most 500); `X-Total-Count`, `X-Page`, `X-Limit` headers.

## Parameters

- `scanId` (query, integer)
- `includeInfo` (query, string)
- `severity` (query, string)
- `assetId` (query, integer)
- `projectId` (query, integer)
- `scanner` (query, string)
- `issueStatus` (query, string)
- `includeInactive` (query, string)
- `page` (query, number)
- `limit` (query, number)

## Example

```bash
curl -X GET "https://api.fortwatch.ai/app/findings?limit=100" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

## Response 200

The request succeeded.

- `id` (number, required)
- `scanId` (number | null, required)
- `investigationId` (number | null, required)
- `scanner` (string, required)
- `severity` (string, required)
- `templateId` (string, required)
- `name` (string, required)
- `description` (string | null, required)
- `matchedAt` (string | null, required)
- `tags` (string | null, required)
- `cveIds` (string | null, required)
- `reference` (string | null, required)
- `remediation` (string | null, required)
- `cvssScore` (number | null, required)
- `cvssMetrics` (string | null, required)
- `rawJson` (object | null, required)
- `issueId` (number | null, required)
- `createdAt` (string (date-time), required)
- `scan` (object, required)
  - `id` (number, required)
  - `assetId` (number, required)
  - `status` (string, required)
  - `triggeredBy` (string, required)
  - `triggeredByUserId` (number | null, required)
  - `failureCode` (string | null, required)
  - `failureDetail` (string | null, required)
  - `scannerIp` (string | null, required)
  - `startedAt` (string (date-time) | null, required)
  - `completedAt` (string (date-time) | null, required)
  - `createdAt` (string (date-time), required)
  - `updatedAt` (string (date-time), required)
  - `asset` (object, required)
    - `id` (number, required)
    - `name` (object | null, required)
    - `value` (string, required)
    - `type` (string, required)
    - `project` (object, required)
- `issue` (object, required)
  - `id` (number, required)
  - `status` (string, required)
  - `title` (string, required)
- `category` (string, required)

```json
[
  {
    "id": 42,
    "scanId": 42,
    "investigationId": 42,
    "scanner": "string",
    "severity": "string",
    "templateId": "string",
    "name": "Production",
    "description": "string",
    "matchedAt": "string",
    "tags": "string",
    "cveIds": "string",
    "reference": "string",
    "remediation": "string",
    "cvssScore": 1,
    "cvssMetrics": "string",
    "rawJson": {},
    "issueId": 42,
    "createdAt": "2026-10-16T12:00:00.000Z",
    "scan": {
      "id": 42,
      "assetId": 42,
      "status": "string",
      "triggeredBy": "string",
      "triggeredByUserId": 42,
      "failureCode": "string",
      "failureDetail": "string",
      "scannerIp": "string",
      "startedAt": "2026-10-16T12:00:00.000Z",
      "completedAt": "2026-10-16T12:00:00.000Z",
      "createdAt": "2026-10-16T12:00:00.000Z",
      "updatedAt": "2026-10-16T12:00:00.000Z",
      "asset": {
        "id": null,
        "name": {},
        "value": null,
        "type": null,
        "project": {}
      }
    },
    "issue": {
      "id": 42,
      "status": "string",
      "title": "string"
    },
    "category": "string"
  }
]
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.