find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/hacktron:hacktron-rest-api-findings-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Hacktron REST API - Findings API
  version: '1.0'
  contact: {}
  description: 'Operations tagged REST API - Findings across 2 of this provider''s published API definitions: hacktron-openapi.json, openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.hacktron.ai/v1
security:
- api-key: []
tags:
- name: REST API - Findings
paths:
  /findings:
    get:
      operationId: RestFindingController_list
      parameters:
      - name: page
        required: false
        in: query
        description: The page number to retrieve.
        schema:
          default: 1
          type: number
      - name: limit
        required: false
        in: query
        description: The number of items to retrieve per page.
        schema:
          default: 100
          type: number
      - name: severity
        required: false
        in: query
        schema:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
      - name: state
        required: false
        in: query
        schema:
          type: string
          enum:
          - open
          - true_positive
          - false_positive
          - accepted_risk
          - resolved
          - closed
      - name: scan_id
        required: false
        in: query
        schema:
          type: string
      - name: scan_type
        required: false
        in: query
        description: Filter by scan type across all scans associated with the finding.
        schema:
          type: string
          enum:
          - pr
          - full
      - name: repo_url
        required: false
        in: query
        description: Filter by repository URL. Case-insensitive; a trailing slash or .git suffix is ignored.
        schema:
          type: string
      - name: found_since
        required: false
        in: query
        description: Only include findings discovered on/after this ISO 8601 timestamp.
        schema:
          type: string
      - name: found_until
        required: false
        in: query
        description: Only include findings discovered before this ISO 8601 timestamp.
        schema:
          type: string
      - name: sort_by
        required: false
        in: query
        schema:
          type: string
          enum:
          - found_at
          - updated_at
          - severity
      - name: sort_order
        required: false
        in: query
        schema:
          default: DESC
          type: string
          enum:
          - ASC
          - DESC
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestFindingListResponseDto'
      summary: List findings with pagination and filters
      tags:
      - REST API - Findings
    servers:
    - url: https://api.hacktron.ai/v1
  /findings/export:
    get:
      operationId: RestFindingController_exportFindings
      parameters:
      - name: page
        required: false
        in: query
        description: The page number to retrieve.
        schema:
          default: 1
          type: number
      - name: limit
        required: false
        in: query
        description: The number of items to retrieve per page.
        schema:
          default: 100
          type: number
      - name: severity
        required: false
        in: query
        schema:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
      - name: state
        required: false
        in: query
        schema:
          type: string
          enum:
          - open
          - true_positive
          - false_positive
          - accepted_risk
          - resolved
          - closed
      - name: scan_id
        required: false
        in: query
        schema:
          type: string
      - name: scan_type
        required: false
        in: query
        description: Filter by scan type across all scans associated with the finding.
        schema:
          type: string
          enum:
          - pr
          - full
      - name: repo_url
        required: false
        in: query
        description: Filter by repository URL. Case-insensitive; a trailing slash or .git suffix is ignored.
        schema:
          type: string
      - name: found_since
        required: false
        in: query
        description: Only include findings discovered on/after this ISO 8601 timestamp.
        schema:
          type: string
      - name: found_until
        required: false
        in: query
        description: Only include findings discovered before this ISO 8601 timestamp.
        schema:
          type: string
      - name: sort_by
        required: false
        in: query
        schema:
          type: string
          enum:
          - found_at
          - updated_at
          - severity
      - name: sort_order
        required: false
        in: query
        schema:
          default: DESC
          type: string
          enum:
          - ASC
          - DESC
      - name: format
        required: true
        in: query
        description: Export format
        schema:
          type: string
          enum:
          - json
          - csv
          - sarif
      responses:
        '200':
          description: ''
      summary: Export findings as JSON, CSV, or SARIF, optionally filtered by repository
      tags:
      - REST API - Findings
    servers:
    - url: https://api.hacktron.ai/v1
  /findings/{id}:
    patch:
      operationId: RestFindingController_update
      parameters:
      - name: id
        required: true
        in: path
        description: Finding UUID or display id (KEY-FD-NUMBER, e.g. HAC-FD-1104)
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestUpdateFindingDto'
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestUpdateFindingResponseDto'
      summary: Update finding state, severity, and/or duplicate link
      tags:
      - REST API - Findings
    get:
      operationId: RestFindingController_getById
      parameters:
      - name: id
        required: true
        in: path
        description: Finding UUID or display id (KEY-FD-NUMBER, e.g. HAC-FD-1104)
        schema:
          type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestFindingDetailResponseDto'
      summary: Get finding details
      tags:
      - REST API - Findings
    servers:
    - url: https://api.hacktron.ai/v1
  /findings/{id}/comments:
    post:
      operationId: RestFindingController_addComment
      parameters:
      - name: id
        required: true
        in: path
        description: Finding UUID or display id (KEY-FD-NUMBER, e.g. HAC-FD-1104)
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RestAddCommentDto'
      responses:
        '201':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestAddCommentResponseDto'
      summary: Add a comment to a finding
      tags:
      - REST API - Findings
    servers:
    - url: https://api.hacktron.ai/v1
components:
  schemas:
    RestFindingListResponseDto:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/RestFindingResponseDto'
        total:
          type: number
        page:
          type: number
        limit:
          type: number
      required:
      - data
      - total
      - page
      - limit
    RestAddCommentDto:
      type: object
      properties:
        comment:
          type: string
          description: Comment text
          maxLength: 4000
      required:
      - comment
    RestFindingDetailResponseDto:
      type: object
      properties:
        id:
          type: string
          description: Finding UUID
        display_id:
          type: string
          description: Human-readable id (KEY-FD-NUMBER).
          example: HAC-FD-1104
        number:
          type: integer
          description: Per-organization sequence number behind display_id.
          example: 1104
        title:
          type: string
        category:
          type: string
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
        state:
          type: string
          enum:
          - open
          - true_positive
          - false_positive
          - accepted_risk
          - resolved
          - closed
        description:
          type: string
        affected_file:
          type: string
        affected_code:
          type: string
        proof_of_concept:
          type:
          - string
          - 'null'
        tags:
          type: array
          items:
            type: string
        scan_id:
          type:
          - string
          - 'null'
        found_at:
          type: string
        updated_at:
          type: string
        resolved_at:
          type:
          - string
          - 'null'
          description: Timestamp of the most recent transition to resolved (ISO 8601). Null if never resolved.
        triage_thread:
          type: array
          items:
            $ref: '#/components/schemas/RestTriageThreadEntryDto'
        taint_path:
          type: array
          items:
            $ref: '#/components/schemas/TaintStepDto'
        occurrence_count:
          type: number
        repo_url:
          type:
          - string
          - 'null'
        scan_type:
          type:
          - string
          - 'null'
      required:
      - id
      - display_id
      - number
      - title
      - category
      - severity
      - state
      - description
      - affected_file
      - affected_code
      - proof_of_concept
      - tags
      - scan_id
      - found_at
      - updated_at
      - resolved_at
      - triage_thread
      - taint_path
      - occurrence_count
      - repo_url
      - scan_type
    RestUpdateFindingResponseDto:
      type: object
      properties:
        id:
          type: string
        state:
          type: string
          enum:
          - open
          - true_positive
          - false_positive
          - accepted_risk
          - resolved
          - closed
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
        duplicate_of:
          type:
          - string
          - 'null'
          description: UUID of the canonical finding this duplicates, if any.
      required:
      - id
      - state
      - severity
      - duplicate_of
    RestTriageThreadEntryDto:
      type: object
      properties:
        id:
          type: string
        reaction:
          type:
          - string
          - 'null'
        comment:
          type:
          - string
          - 'null'
        user_id:
          type: string
        username:
          type: string
        source:
          type: string
        timestamp:
          type: string
      required:
      - id
      - reaction
      - comment
      - user_id
      - source
      - timestamp
    RestUpdateFindingDto:
      type: object
      properties:
        state:
          type: string
          enum:
          - open
          - true_positive
          - false_positive
          - accepted_risk
          - resolved
          - closed
          description: New finding state
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
          description: New severity level
        state_reason:
          type: string
          description: Reason for the state change (defaults to reason if omitted)
        severity_reason:
          type: string
          description: Reason for the severity change (defaults to reason if omitted)
        reason:
          type: string
          description: Shorthand reason applied to both state and severity changes when their specific reason is not provided
        duplicate_of:
          type:
          - string
          - 'null'
          description: UUID of the canonical finding to mark this finding as a duplicate of, or null to unmark. The target must be in the same repository.
    RestFindingResponseDto:
      type: object
      properties:
        id:
          type: string
          description: Finding UUID
        display_id:
          type: string
          description: Human-readable id (KEY-FD-NUMBER).
          example: HAC-FD-1104
        number:
          type: integer
          description: Per-organization sequence number behind display_id.
          example: 1104
        title:
          type: string
        category:
          type: string
        severity:
          type: string
          enum:
          - critical
          - high
          - medium
          - low
          - info
        state:
          type: string
          enum:
          - open
          - true_positive
          - false_positive
          - accepted_risk
          - resolved
          - closed
        description:
          type: string
        affected_file:
          type: string
        affected_code:
          type: string
        proof_of_concept:
          type:
          - string
          - 'null'
        tags:
          type: array
          items:
            type: string
        scan_id:
          type:
          - string
          - 'null'
        found_at:
          type: string
        updated_at:
          type: string
        resolved_at:
          type:
          - string
          - 'null'
          description: Timestamp of the most recent transition to resolved (ISO 8601). Null if never resolved.
      required:
      - id
      - display_id
      - number
      - title
      - category
      - severity
      - state
      - description
      - affected_file
      - affected_code
      - proof_of_concept
      - tags
      - scan_id
      - found_at
      - updated_at
      - resolved_at
    TaintStepDto:
      type: object
      properties:
        type:
          type: string
          enum:
          - source
          - propagation
          - sink
        file:
          type: string
        line:
          type: number
        end_line:
          type: number
        symbol:
          type: string
        description:
          type: string
        detail:
          type: string
          description: Raw symbol docstring; supplemental context for the stepped taint flow.
        taint_sources:
          type: array
          items:
            type: string
        code:
          type: string
          description: Source code lines for this step's symbol, pre-sliced by the worker.
        code_start_line:
          type: number
          description: 1-based start line number of the `code` slice in the source file. Used by the frontend as the anchor for chevron-expand requests to GET /findings/:uuid/source.
        code_end_line:
          type: number
          description: 1-based end line number of the `code` slice in the source file. Used by the frontend as the anchor for chevron-expand requests to GET /findings/:uuid/source.
      required:
      - type
      - file
      - line
      - end_line
      - symbol
      - description
      - taint_sources
    RestAddCommentResponseDto:
      type: object
      properties:
        comment_id:
          type: string
      required:
      - comment_id
  securitySchemes:
    api-key:
      type: apiKey
      in: header
      name: X-Api-Key
x-refined-from:
- hacktron-openapi.json
- openapi.json