Skip to main content
GET
Error

Authorizations

​
Authorization
string
header
required

API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.

Query Parameters

​
page
integer
default:1

Page number of the result set. The first page is 1.

Required range: x >= 1
​
limit
integer
default:20

Maximum number of items per page. The default is 20 and the maximum is 100.

Required range: 1 <= x <= 100
​
scan_id
string<uuid>

Filter by scan ID.

​
severity
enum<string>

Return only findings with this severity.

Available options:
critical,
high,
medium,
low
​
status
enum<string>

Return only findings in this status.

Available options:
open,
in_progress,
snoozed,
fixed,
ignored,
not_affected
​
search
string

Full-text search across titles, targets, and STRIX display numbers.

​
from
string<date-time>

Filter by scan created_at >= this date.

​
to
string<date-time>

Filter by scan created_at <= this date.

​
domain_id
string<uuid>

Return only the findings of this domain. The response also includes historical findings that have no domain attribution.

​
repository_id
string<uuid>

Return only the findings of this repository. The response also includes historical findings that have no repository attribution.

​
finding_type
enum<string>

Filter by issue type: dynamic findings from live pentests, code review findings, or dependency CVE findings. Omit for all dynamic findings (dependency findings are only returned when explicitly selected). dependency additionally requires the dependencies:read scope.

Available options:
live_pentest,
code,
dependency
​
dependency_relation
enum<string>

Filter dependency findings by how the vulnerable package enters the project. direct returns packages that a manifest declares. transitive returns packages that another package pulls in. Only applies when finding_type is dependency.

Available options:
direct,
transitive
​
reachability
string

Filter dependency findings by the usage levels that the scan proved for the vulnerable code. Supply one level, or a comma-separated list of levels. The level unknown also returns the findings without a recorded usage level. This filter applies only when finding_type is dependency. The allowed levels are reachable_call_path, vulnerable_symbol_used, imported, not_imported, and unknown.

Examples:

"reachable_call_path"

"reachable_call_path,vulnerable_symbol_used,imported,unknown"

​
sort_by
enum<string>

The sort key. The key package applies only when finding_type is dependency. For a dependency finding, cvss is the score that the scan gave the risk in this codebase. The key severity sorts by the CVSS score, and sort_order=desc puts the most severe findings first. A finding without a score, or with a severity override, sorts by its severity level.

Available options:
cvss,
created_at,
severity,
package
​
sort_order
enum<string>
default:desc

Sort direction. Use asc for oldest first or desc for newest first.

Available options:
asc,
desc

Response

Paginated list of vulnerabilities.

​
items
object[]
required
​
meta
object
required