Immutable source snapshot

GET /runs/{run_id}/findings

Get run findings. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Current reference · Download OpenAPI specification

Private service protocols are unsupported for external integration. Their schemas describe source declarations; they are not public service endpoints.

Read pinned handler: services/scanner/kodesec_scanner/main.py:1543

Get run findings

Get run findings through GET /runs/{run_id}/findings. The parameters and declared response shapes below come from this exact source snapshot.

Internal protocol; unsupported for external integration. This page makes no request to a local installation.

Authority

Private service protocol. No public or third-party integration authority.

Inspect the authority source · Authentication guide

Parameters and headers

Name	Location	Contract
`run_id`	path Required	string Schema `{ "format": "uuid", "title": "Run Id", "type": "string" }`
`request_digest`	query Required	string Schema `{ "pattern": "^[0-9a-f]{64}$", "title": "Request Digest", "type": "string" }`
`cursor`	query Conditional / optional	string \| null Schema `{ "anyOf": [ { "maxLength": 2048, "minLength": 1, "type": "string" }, { "type": "null" } ], "title": "Cursor" }`
`limit`	query Conditional / optional	integer Schema `{ "default": 128, "maximum": 128, "minimum": 1, "title": "Limit", "type": "integer" }`

Request body

No typed JSON body is declared by this handler. That does not rule out source-level request parsing; inspect the pinned implementation, especially for internal connector protocols.

Responses

Status	Meaning and declared shape
`200`	Successful Response application/json · RunFindingPageResponse { "additionalProperties": false, "properties": { "findings_total": { "maximum": 50000, "minimum": 0, "title": "Findings Total", "type": "integer" }, "items": { "items": { "$ref": "#/components/schemas/Finding" }, "maxItems": 128, "minItems": 1, "title": "Items", "type": "array" }, "items_bytes": { "maximum": 4177920, "minimum": 1, "title": "Items Bytes", "type": "integer" }, "next_cursor": { "anyOf": [ { "maxLength": 2048, "minLength": 1, "type": "string" }, { "type": "null" } ], "title": "Next Cursor" }, "page_digest": { "pattern": "^[0-9a-f]{64}$", "title": "Page Digest", "type": "string" }, "request_digest": { "pattern": "^[0-9a-f]{64}$", "title": "Request Digest", "type": "string" }, "result_digest": { "pattern": "^[0-9a-f]{64}$", "title": "Result Digest", "type": "string" }, "run_id": { "format": "uuid", "title": "Run Id", "type": "string" }, "schema_version": { "const": 1, "default": 1, "title": "Schema Version", "type": "integer" }, "start_ordinal": { "minimum": 1, "title": "Start Ordinal", "type": "integer" }, "truncated": { "title": "Truncated", "type": "boolean" } }, "required": [ "run_id", "request_digest", "result_digest", "findings_total", "start_ordinal", "items", "items_bytes", "page_digest", "truncated" ], "title": "RunFindingPageResponse", "type": "object" }
`404`	Refresh the collection and verify the resource identity before retrying. See source-linked error catalog.
`409`	Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.
`410`	Reconcile current state and review the linked handler before retrying. See source-linked error catalog.
`422`	Validation Error application/json · HTTPValidationError `{ "properties": { "detail": { "items": { "$ref": "#/components/schemas/ValidationError" }, "title": "Detail", "type": "array" } }, "title": "HTTPValidationError", "type": "object" }`
`500`	Keep the operation identity and collect bounded, reviewed diagnostics. See source-linked error catalog.

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

6 source error observations

Status	Source detail	Recovery
422 ↗	`scanner finding-page request is invalid`	Correct the field or semantic validation error. Input values are omitted from control validation errors.
404 ↗	`scanner run was not found or its recovery window expired`	Refresh the collection and verify the resource identity before retrying.
409 ↗	`{"code":"run_id_conflict","message":"run identity or result binding does not match"}`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
422 ↗	`scanner finding cursor is invalid or stale`	Correct the field or semantic validation error. Input values are omitted from control validation errors.
410 ↗	`scanner result was acknowledged or is unavailable`	Reconcile current state and review the linked handler before retrying.
500 ↗	`scanner result failed its sealed integrity check`	Keep the operation identity and collect bounded, reviewed diagnostics.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Response 200 JSON

{
  "findings_total": 1,
  "items": [
    {
      "file_path": "/workspace/synthetic-demo",
      "fingerprint": "synthetic",
      "message": "synthetic",
      "rule_id": "synthetic",
      "severity": "critical"
    }
  ],
  "items_bytes": 1,
  "page_digest": "0000000000000000000000000000000000000000000000000000000000000000",
  "request_digest": "0000000000000000000000000000000000000000000000000000000000000000",
  "result_digest": "0000000000000000000000000000000000000000000000000000000000000000",
  "run_id": "00000000-0000-4000-8000-000000000001",
  "start_ordinal": 1,
  "truncated": false
}

Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.