GET
/
findings
List findings
curl --request GET \
  --url https://api.tigergate.dev/api/v1/compliance/findings \
  --header 'Authorization: Bearer <token>'
{
  "items": [
    {
      "id": "<string>",
      "finding_type": "<string>",
      "status_detail": "<string>",
      "ocsf_status_id": 123,
      "severity_score": 123,
      "title": "<string>",
      "description": "<string>",
      "rule_id": "<string>",
      "cve_ids": [
        "<string>"
      ],
      "cwe_ids": [
        "<string>"
      ],
      "package": {
        "name": "<string>",
        "version": "<string>",
        "fixed_version": "<string>",
        "ecosystem": "<string>",
        "purl": "<string>"
      },
      "is_fixable": true,
      "exploitability": {
        "kev": true,
        "epss": 123
      },
      "asset": {
        "id": "<string>",
        "type": "<string>",
        "name": "<string>"
      },
      "location": {},
      "first_detected_at": "2023-11-07T05:31:56Z",
      "last_detected_at": "2023-11-07T05:31:56Z",
      "resolved_at": "2023-11-07T05:31:56Z",
      "updated_at": "2023-11-07T05:31:56Z",
      "sla": {
        "days": 123,
        "due_at": "2023-11-07T05:31:56Z",
        "breached": true,
        "remediated_within_sla": true
      },
      "workflow": {
        "status": "<string>",
        "due_at": "2023-11-07T05:31:56Z",
        "ticket_url": "<string>",
        "assignee": {
          "id": "<string>",
          "name": "<string>"
        },
        "assigned_at": "2023-11-07T05:31:56Z",
        "notes": "<string>",
        "updated_at": "2023-11-07T05:31:56Z",
        "ticket": {
          "provider": "<string>",
          "key": "<string>",
          "id": "<string>",
          "url": "<string>",
          "status": "<string>",
          "status_synced_at": "2023-11-07T05:31:56Z"
        }
      },
      "compliance": {
        "frameworks": [
          {
            "id": "<string>",
            "source_key": "<string>",
            "controls": [
              "<string>"
            ]
          }
        ]
      },
      "links": {
        "ui": "<string>"
      }
    }
  ],
  "page": {
    "size": 123,
    "next_cursor": "<string>",
    "has_more": true
  },
  "meta": {
    "snapshot_at": "2023-11-07T05:31:56Z",
    "next_updated_since": "2023-11-07T05:31:56Z",
    "tombstone_horizon_days": 123,
    "scope": {
      "finding_types": [
        "<string>"
      ],
      "excluded_finding_types": [
        "<string>"
      ],
      "ignored_filters": [
        "<string>"
      ]
    }
  }
}

Authorizations

​
Authorization
string
header
required

A Compliance API key: Authorization: Bearer tgcmp_....

Query Parameters

​
product
enum<string>
required

The product to read.

Available options:
code_security,
container_security,
cloud_security,
kspm,
dspm,
pentest,
endpoint,
infra,
runtime,
issues
​
finding_type
string

Comma-separated finding types from the product's vocabulary (see whoami). Types outside the key's scope return no rows and are listed in meta.scope.excluded_finding_types.

​
severity
string

Comma-separated severities.

​
status
string

Comma-separated statuses. Defaults to open,suppressed for a snapshot and to all three for an incremental pull.

​
asset_id
string

Comma-separated asset ids (the asset.id of a finding, or the id from /assets), up to 1000. Ignored for the issues product, which reports this in meta.scope.ignored_filters.

​
updated_since
string<date-time>

ISO 8601 timestamp. Switches to incremental mode. Pass the previous response's meta.next_updated_since. Must be within the product's history window (tombstone_horizon_days).

​
first_detected_after
string<date-time>

Only findings first detected after this time.

​
resolved_after
string<date-time>

Only findings resolved after this time. Combine with status=resolved, or use an incremental pull, since a snapshot returns open and suppressed findings by default.

​
sla_due_before
string<date-time>

Only findings whose SLA due date is before this time.

​
sla_breached
enum<string>

true for open findings past their SLA due date; false for everything else.

Available options:
true,
false
​
framework
string

Only findings mapped to this framework: a normalized id such as soc2, pci-dss or cis, or the product's own framework key from compliance.frameworks[].source_key. For cloud_security, kspm and dspm only; other products return 400.

Maximum string length: 200
​
control
string

Only findings mapped to this control id, under framework when both are given. For cloud_security, kspm and dspm only.

Maximum string length: 200
​
limit
integer
default:200

Page size. Default 200, maximum 1000; larger values are capped.

Required range: 1 <= x <= 1000
​
cursor
string

page.next_cursor from the previous page. Send the same other parameters with it.

Maximum string length: 4096

Response

A page of findings.

​
items
object[]
​
page
object
​
meta
object