# List a scan's findings

`GET /app/scans/{id}/findings`

What the scan found; info findings are left out unless asked for.

Scope: `scans:read`. Paged: `page`, `limit` (100 by default, at most 500); `X-Total-Count`, `X-Page`, `X-Limit` headers.

## Parameters

- `id` (path, integer, required)
- `severity` (query, string)
- `page` (query, integer): The page, from 1.
- `limit` (query, integer): Rows per page: an API key or OAuth token gets 100 when it sends none, at most 500.

## Example

```bash
curl -X GET "https://api.fortwatch.ai/app/scans/42/findings?limit=100" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

## Response 200

The request succeeded.

- `id` (number, required)
- `scanner` (string, required)
- `severity` (string, required)
- `templateId` (object | null, required)
- `name` (string, required)
- `description` (object | null, required)
- `matchedAt` (object | null, required)
- `tags` (object | null, required)
- `cveIds` (object | null, required)
- `cvssScore` (object | null, required)
- `remediation` (object | null, required)
- `reference` (object | null, required)
- `createdAt` (string (date-time), required)
- `issue` (object, required)
  - `id` (number, required)
  - `status` (string, required)
  - `title` (string, required)
- `category` (string, required)

```json
[
  {
    "id": 42,
    "scanner": "string",
    "severity": "string",
    "templateId": {},
    "name": "Production",
    "description": {},
    "matchedAt": {},
    "tags": {},
    "cveIds": {},
    "cvssScore": {},
    "remediation": {},
    "reference": {},
    "createdAt": "2026-10-16T12:00:00.000Z",
    "issue": {
      "id": 42,
      "status": "string",
      "title": "string"
    },
    "category": "string"
  }
]
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 404: Not found in your workspace.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.