List repository supply-chain findings
Open findings for the resolved scope. Pull-request and merge-request scans keep no SBOM snapshot, so scoping to one of those jobs with job_id serves the findings from the job’s stored scan result: snapshot is null, and on each finding id, source, first_seen_at, and last_seen_at are null because no stored finding row exists to carry them. For those scopes component_id matches nothing (there are no stored component rows to filter on), and the list is capped at the first 100 findings while finding_count on the summary endpoint still covers the whole set. A change-scan job that ran before scan results were stored returns an empty list.
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Path Parameters
UUID of the repository. Use the id field of a repository from listRepositories.
Query Parameters
Scope the view to a specific supply-chain job.
Scope the view to a specific SBOM snapshot.
Return findings for the given component only.
Response
Snapshot metadata and supply-chain findings for the resolved scope.
The response is of type object.