Lomo CodeSecurity

The API reference is in English.

Immutable source snapshot

GET /v1/scans/{scan_id}/findings

List findings. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Current reference · Download OpenAPI specification

This address preserves one reviewed source snapshot. Use the current entry point for the selected documentation version.

Read pinned handler: apps/api/kodesec_api/main.py:5418

List findings

List findings through GET /v1/scans/{scan_id}/findings. The parameters and declared response shapes below come from this exact source snapshot.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session or exact IDE capability with finding:read. Route-specific ownership and generation checks also apply.

Inspect the authority source · Authentication guide

Parameters and headers

NameLocationContract
scan_idpath
Required

integer

Schema
{
  "title": "Scan Id",
  "type": "integer"
}
limitquery
Conditional / optional

integer

Schema
{
  "default": 100,
  "maximum": 200,
  "minimum": 1,
  "title": "Limit",
  "type": "integer"
}
cursorquery
Conditional / optional

string | null

Schema
{
  "anyOf": [
    {
      "maxLength": 512,
      "type": "string"
    },
    {
      "type": "null"
    }
  ],
  "title": "Cursor"
}
anchor_scan_finding_numberquery
Conditional / optional

integer | null

Schema
{
  "anyOf": [
    {
      "maximum": 50000,
      "minimum": 1,
      "type": "integer"
    },
    {
      "type": "null"
    }
  ],
  "title": "Anchor Scan Finding Number"
}
file_pathquery
Conditional / optional

string | null

Schema
{
  "anyOf": [
    {
      "maxLength": 4096,
      "type": "string"
    },
    {
      "type": "null"
    }
  ],
  "title": "File Path"
}
severityquery
Conditional / optional

string | null

Schema
{
  "anyOf": [
    {
      "maxLength": 30,
      "type": "string"
    },
    {
      "type": "null"
    }
  ],
  "title": "Severity"
}
scannerquery
Conditional / optional

string | null

Schema
{
  "anyOf": [
    {
      "maxLength": 80,
      "type": "string"
    },
    {
      "type": "null"
    }
  ],
  "title": "Scanner"
}
lifecycle_statusquery
Conditional / optional

string | null

Schema
{
  "anyOf": [
    {
      "maxLength": 40,
      "type": "string"
    },
    {
      "type": "null"
    }
  ],
  "title": "Lifecycle Status"
}
expected_revisionquery
Conditional / optional

integer | null

Schema
{
  "anyOf": [
    {
      "maximum": 2147483647,
      "minimum": 1,
      "type": "integer"
    },
    {
      "type": "null"
    }
  ],
  "title": "Expected Revision"
}

Request body

No typed JSON body is declared by this handler. That does not rule out source-level request parsing; inspect the pinned implementation, especially for internal connector protocols.

Responses

StatusMeaning and declared shape
200

Successful Response

application/json · FindingPageOut
{
  "properties": {
    "items": {
      "items": {
        "$ref": "#/components/schemas/FindingListItemOut"
      },
      "title": "Items",
      "type": "array"
    },
    "next_cursor": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Next Cursor"
    },
    "revision": {
      "minimum": 1,
      "title": "Revision",
      "type": "integer"
    },
    "total": {
      "minimum": 0,
      "title": "Total",
      "type": "integer"
    },
    "truncated": {
      "title": "Truncated",
      "type": "boolean"
    }
  },
  "required": [
    "items",
    "total",
    "truncated",
    "next_cursor",
    "revision"
  ],
  "title": "FindingPageOut",
  "type": "object"
}
400

Exact host, malformed request or URL credential refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
401

Missing or invalid membership

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
403

Exact origin, CSRF or route authority refusal

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}
404

Refresh the collection and verify the resource identity before retrying. See source-linked error catalog.

409

Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.

422

Validation Error

application/json · HTTPValidationError
{
  "properties": {
    "detail": {
      "items": {
        "$ref": "#/components/schemas/ValidationError"
      },
      "title": "Detail",
      "type": "array"
    }
  },
  "title": "HTTPValidationError",
  "type": "object"
}
429

Authentication rate or connection limit

application/json · object
{
  "properties": {
    "detail": {
      "type": "string"
    }
  },
  "required": [
    "detail"
  ],
  "type": "object"
}

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

10 source error observations
StatusSource detailRecovery
404 ↗scan not foundRefresh the collection and verify the resource identity before retrying.
422 ↗cursor and anchor_scan_finding_number are mutually exclusiveCorrect the field or semantic validation error. Input values are omitted from control validation errors.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
404 ↗anchor finding is not present under the active filtersRefresh the collection and verify the resource identity before retrying.
400 ↗Dynamic detail; inspect sourceReview the request shape, exact Host and cursor format. Never put credentials in a URL.
409 ↗Dynamic detail; inspect sourceRefresh current revision and identity. A conflicting command must not be blindly repeated.
422 ↗file_path must be an exact canonical project-relative POSIX pathCorrect the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗severity filter is invalidCorrect the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗scanner filter is invalidCorrect the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗lifecycle_status filter is invalidCorrect the field or semantic validation error. Input values are omitted from control validation errors.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Response 200 JSON
{
  "items": [],
  "next_cursor": "synthetic",
  "revision": 1,
  "total": 1,
  "truncated": false
}
Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.