GET
/
findings
/
{id}
Get a finding
curl --request GET \
  --url https://api.tigergate.dev/api/v1/compliance/findings/{id} \
  --header 'Authorization: Bearer <token>'
{
  "id": "<string>",
  "finding_type": "<string>",
  "status_detail": "<string>",
  "ocsf_status_id": 123,
  "severity_score": 123,
  "title": "<string>",
  "description": "<string>",
  "rule_id": "<string>",
  "cve_ids": [
    "<string>"
  ],
  "cwe_ids": [
    "<string>"
  ],
  "package": {
    "name": "<string>",
    "version": "<string>",
    "fixed_version": "<string>",
    "ecosystem": "<string>",
    "purl": "<string>"
  },
  "is_fixable": true,
  "exploitability": {
    "kev": true,
    "epss": 123
  },
  "asset": {
    "id": "<string>",
    "type": "<string>",
    "name": "<string>"
  },
  "location": {},
  "first_detected_at": "2023-11-07T05:31:56Z",
  "last_detected_at": "2023-11-07T05:31:56Z",
  "resolved_at": "2023-11-07T05:31:56Z",
  "updated_at": "2023-11-07T05:31:56Z",
  "sla": {
    "days": 123,
    "due_at": "2023-11-07T05:31:56Z",
    "breached": true,
    "remediated_within_sla": true
  },
  "workflow": {
    "status": "<string>",
    "due_at": "2023-11-07T05:31:56Z",
    "ticket_url": "<string>",
    "assignee": {
      "id": "<string>",
      "name": "<string>"
    },
    "assigned_at": "2023-11-07T05:31:56Z",
    "notes": "<string>",
    "updated_at": "2023-11-07T05:31:56Z",
    "ticket": {
      "provider": "<string>",
      "key": "<string>",
      "id": "<string>",
      "url": "<string>",
      "status": "<string>",
      "status_synced_at": "2023-11-07T05:31:56Z"
    }
  },
  "compliance": {
    "frameworks": [
      {
        "id": "<string>",
        "source_key": "<string>",
        "controls": [
          "<string>"
        ]
      }
    ]
  },
  "links": {
    "ui": "<string>"
  }
}

Authorizations

​
Authorization
string
header
required

A Compliance API key: Authorization: Bearer tgcmp_....

Path Parameters

​
id
string
required

The finding's id.

Maximum string length: 2048

Response

The finding.

​
id
string

Opaque and stable across rescans. Upsert on it.

​
product
enum<string>
Available options:
code_security,
container_security,
cloud_security,
kspm,
dspm,
pentest,
endpoint,
infra,
runtime,
issues
​
finding_type
string
​
status
enum<string>
Available options:
open,
suppressed,
resolved
​
status_detail
string | null

Why a finding has its status, e.g. in_progress, accepted_risk, false_positive, fixed, not_detected, passing, resource_removed.

​
ocsf_status_id
integer

OCSF status: 1 new, 2 in progress, 3 suppressed, 4 resolved.

​
severity
enum<string>
Available options:
critical,
high,
medium,
low,
info
​
severity_score
number

CVSS base score when known, else 9.5, 7.5, 5.0, 2.5 or 0 by severity.

​
title
string
​
description
string | null

Truncated at 4096 characters.

​
rule_id
string | null
​
cve_ids
string[]
​
cwe_ids
string[]
​
package
object
​
is_fixable
boolean | null
​
exploitability
object
​
asset
object

The asset the finding belongs to. Product-specific fields may appear alongside these.

​
location
object

Where inside the asset, such as a file path, a Kubernetes namespace and resource, or a host and port. Fields vary by product.

​
first_detected_at
string<date-time> | null
​
first_detected_precision
enum<string>

backfill when the finding predates the first sync and its first-detected time was reconstructed from stored scan data.

Available options:
exact,
backfill
​
last_detected_at
string<date-time> | null
​
resolved_at
string<date-time> | null
​
updated_at
string<date-time> | null
​
sla
object
​
workflow
object

Triage state as recorded in TigerGate: who the finding is assigned to, when, the comment left on it, its due date and the ticket opened for it. Present for code security and endpoint/infrastructure findings that someone has triaged, assigned or ticketed; null otherwise.

​
compliance
object
​
links
object