Lomo CodeSecurity

The API reference is in English.

Immutable source snapshot

GET /v1/scans/{scan_id}/finding-files

List finding files. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Current reference · Download OpenAPI specification

This address preserves one reviewed source snapshot. Use the current entry point for the selected documentation version.

Read pinned handler: apps/api/kodesec_api/main.py:5056

List finding files

List finding files through GET /v1/scans/{scan_id}/finding-files. The parameters and declared response shapes below come from this exact source snapshot.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session or exact IDE capability with finding:read. Route-specific ownership and generation checks also apply.

Inspect the authority source · Authentication guide

Parameters and headers

NameLocationContract
scan_idpath
Required

integer

Schema
{
  "title": "Scan Id",
  "type": "integer"
}
limitquery
Conditional / optional

integer

Schema
{
  "default": 100,
  "maximum": 200,
  "minimum": 1,
  "title": "Limit",
  "type": "integer"
}
cursorquery
Conditional / optional

string | null

Schema
{
  "anyOf": [
    {
      "maxLength": 512,
      "type": "string"
    },
    {
      "type": "null"
    }
  ],
  "title": "Cursor"
}

Request body

No typed JSON body is declared by this handler. That does not rule out source-level request parsing; inspect the pinned implementation, especially for internal connector protocols.

Responses

StatusMeaning and declared shape
200

Successful Response

application/json · FindingFileManifestPageOut
{
  "additionalProperties": false,
  "properties": {
    "items": {
      "items": {
        "$ref": "#/components/schemas/FindingFileAggregateOut"
      },
      "maxItems": 200,
      "title": "Items",
      "type": "array"
    },
    "next_cursor": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Next Cursor"
    },
    "scan": {
      "$ref": "#/components/schemas/FindingFileManifestScanOut"
    },
    "total_files": {
      "minimum": 0,
      "title": "Total Files",
      "type": "integer"
    },
    "total_findings": {
      "minimum": 0,
      "title": "Total Findings",
      "type": "integer"
    },
    "truncated": {
      "title": "Truncated",
      "type": "boolean"
    }
  },
  "required": [
    "scan",
    "total_findings",
    "total_files",
    "items",
    "truncated",
    "next_cursor"
  ],
  "title": "FindingFileManifestPageOut",
  "type": "object"
}
400

Exact host, malformed request or URL credential refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
401

Missing or invalid membership

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
403

Exact origin, CSRF or route authority refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
404

Refresh the collection and verify the resource identity before retrying. See source-linked error catalog.

409

Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.

422

Validation Error

application/json · HTTPValidationError
{
  "properties": {
    "detail": {
      "items": {
        "$ref": "#/components/schemas/ValidationError"
      },
      "title": "Detail",
      "type": "array"
    }
  },
  "title": "HTTPValidationError",
  "type": "object"
}
429

Authentication rate or connection limit

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
500

Keep the operation identity and collect bounded, reviewed diagnostics. See source-linked error catalog.

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

4 source error observations
StatusSource detailRecovery
404 ↗scan not foundRefresh the collection and verify the resource identity before retrying.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
500 ↗{"code":"finding_file_manifest_invalid","message":"persisted finding file aggregates are inconsistent"}Keep the operation identity and collect bounded, reviewed diagnostics.
400 ↗Dynamic detail; inspect sourceReview the request shape, exact Host and cursor format. Never put credentials in a URL.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Response 200 JSON
{
  "items": [],
  "next_cursor": "synthetic",
  "scan": {
    "error": "synthetic",
    "findings_revision": 1,
    "gate_reasons": [],
    "id": 1,
    "project_id": 1,
    "revision": 1,
    "status": "synthetic"
  },
  "total_files": 1,
  "total_findings": 1,
  "truncated": false
}
Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.