Snyk Findings API

openapi: 3.2.0
info:
  title: Snyk AccessRequests Findings API
  version: REST
servers:
- description: Snyk REST API
  url: https://api.snyk.io/rest
security:
- APIToken: []
- BearerAuth: []
tags:
- name: Findings
paths:
  /orgs/{org_id}/tests/{test_id}/findings:
    get:
      description: 'List findings for a test.


        Test Findings are scanner-agnostic representations of

        vulnerabilities and organization-level policy breaches.

        When Snyk runs a Test, the results of that Test are

        formatted into Findings.


        This endpoint returns pages of Findings associated with

        a given Test ID. Findings are returned in sorted order by

        ID, with page size equal to the provided Limit query parameter.

        Page size is 10 Findings by default if no parameter is provided.


        Note that the Findings returned from this endpoint are only the

        Findings that are _not_ suppressed by policy and are _not_

        in violation of a set Test threshold (like Severity or Risk Score).


        To retrieve the next (or previous) page of Findings, utilize the

        Next and Prev links returned in the response.


        #### Required permissions


        - `View Organization (org.read)`'
      operationId: listFindings
      parameters:
      - $ref: '#/components/parameters/io.snyk.api.request.SnykApiRequest.request_id'
      - $ref: '#/components/parameters/io.snyk.api.request.SnykApiRequest.interaction_id'
      - $ref: '#/components/parameters/io.snyk.api.request.SnykApiRequest.version'
      - $ref: '#/components/parameters/io.snyk.api.request.PaginatedRequest.starting_after'
      - $ref: '#/components/parameters/io.snyk.api.request.PaginatedRequest.ending_before'
      - $ref: '#/components/parameters/io.snyk.api.request.PaginatedRequest.limit'
      - description: 'Snyk Org ID under which to run or query information

          about a Job or Test.'
        in: path
        name: org_id
        required: true
        schema:
          format: uuid
          type: string
      - $ref: '#/components/parameters/TestIdParam'
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/FindingData'
                    type: array
                  jsonapi:
                    $ref: '#/components/schemas/io.snyk.api.common.JsonApi'
                  links:
                    $ref: '#/components/schemas/io.snyk.api.common.PaginatedLinks'
                  meta:
                    $ref: '#/components/schemas/io.snyk.api.common.Meta'
                required:
                - data
                - jsonapi
                - links
                type: object
          description: Successful API response for a paginated collection.
          headers:
            deprecation:
              schema:
                type: string
            snyk-request-id:
              schema:
                type: string
            snyk-version-lifecycle-stage:
              schema:
                type: string
            snyk-version-requested:
              schema:
                type: string
            snyk-version-served:
              schema:
                type: string
            sunset:
              description: 'A header containing the date of when the underlying endpoint will be removed. This header is only present if the endpoint has been deprecated. For information purposes only. Returned as a date in the format: YYYY-MM-DD'
              example: '2021-08-02'
              schema:
                format: date
                type: string
        '400':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/io.snyk.api.common.ErrorDocument'
          description: Invalid input
          headers:
            deprecation:
              schema:
                type: string
            snyk-request-id:
              schema:
                type: string
            snyk-version-lifecycle-stage:
              schema:
                type: string
            snyk-version-requested:
              schema:
                type: string
            snyk-version-served:
              schema:
                type: string
            sunset:
              description: 'A header containing the date of when the underlying endpoint will be removed. This header is only present if the endpoint has been deprecated. For information purposes only. Returned as a date in the format: YYYY-MM-DD'
              example: '2021-08-02'
              schema:
                format: date
                type: string
      summary: List findings for a test. (Early Access)
      tags:
      - Findings
      x-snyk-api-lifecycle: released
      x-snyk-api-releases:
      - 2024-10-15~beta
      x-snyk-api-resource: tests
      x-snyk-api-stability: beta
      x-snyk-api-version: 2024-10-15~beta
      x-stability-level: beta
components:
  schemas:
    DiffSuggestion:
      description: A suggestion in unified diff format representing the code changes to fix the vulnerability.
      properties:
        diff:
          description: 'Unified diff that contains changes for one or multiple files.

            It already contains file path, but this can be extracted as a separate field if needed.'
          maxLength: 10485760
          type: string
        external_id:
          description: The fix suggestion identifier from an external source.
          format: uuid
          type: string
        rank:
          format: uint8
          type: integer
      required:
      - diff
      type: object
    FindingLocation:
      description: Location within an Subject's contents where the finding was discovered.
      discriminator:
        mapping:
          other: '#/components/schemas/OtherLocation'
          package: '#/components/schemas/PackageLocation'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/PackageLocation'
      - description: 'Source file location.


          Finding types: SCA, SAST'
        example:
          file_path: package.json
          from_column: 12
          from_line: 24
          to_column: 36
          to_line: 24
          type: source
        properties:
          file_path:
            description: File path for the code snippet.
            type: string
          from_column:
            description: Column on which the snippet starts.
            type: integer
          from_line:
            description: Line in the file where the code snippet starts.
            type: integer
          to_column:
            description: Column at which the code snippet ends.
            type: integer
          to_line:
            description: Line on which the code snippet ends.
            type: integer
          type:
            enum:
            - source
            type: string
        required:
        - type
        - file_path
        - from_line
        type: object
      - $ref: '#/components/schemas/OtherLocation'
    SuppressionStatus:
      description: Status of a suppression on a finding.
      enum:
      - ignored
      - pending_ignore_approval
      - other
      type: string
    io.snyk.api.common.RelatedLink:
      properties:
        related:
          $ref: '#/components/schemas/io.snyk.api.common.LinkProperty'
      type: object
    UpgradePath:
      description: Upgrade path model all known dependency paths that will change when applying an upgrade action.
      properties:
        dependency_path:
          items:
            $ref: '#/components/schemas/Package'
          maxItems: 100
          type: array
        is_drop:
          description: 'A drop describes an upgrade path, where the vulnerability gets addressed by removing the vulnerable dependency.

            This typically happens when a package somewhere mid-way drops this library in newer versions.


            Note: For drops, the length of the upgradePath will be smaller than the length of the original dependencyPath.'
          type: boolean
      required:
      - dependency_path
      - is_drop
      type: object
    FindingType:
      description: Type of Finding which was discovered.
      enum:
      - sca
      - sast
      - dast
      - other
      - config
      - secret
      - secrets
      type: string
    io.snyk.api.common.ErrorDocument:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/io.snyk.api.common.Error'
          minItems: 1
          type: array
        jsonapi:
          $ref: '#/components/schemas/io.snyk.api.common.JsonApi'
      required:
      - jsonapi
      - errors
      type: object
    io.snyk.api.common.LinkObject:
      properties:
        href:
          $ref: '#/components/schemas/io.snyk.api.common.LinkString'
        meta:
          $ref: '#/components/schemas/io.snyk.api.common.Meta'
      required:
      - href
      type: object
    ManagedPolicyRef:
      description: Reference to a managed policy.
      properties:
        id:
          $ref: '#/components/schemas/Uuid'
      required:
      - id
      type: object
    FileRegion:
      description: FileRegion models a location where vulnerable code is found.
      properties:
        file_path:
          description: File path for the code snippet.
          type: string
        from_column:
          description: Column on which the snippet starts.
          type: integer
        from_line:
          description: Line in the file where the code snippet starts.
          type: integer
        to_column:
          description: Column at which the code snippet ends.
          type: integer
        to_line:
          description: Line on which the code snippet ends.
          type: integer
      required:
      - file_path
      - from_line
      type: object
    Evidence:
      description: 'Supporting evidence for (rather than representative of) the finding in other

        security domains and systems, lacking a well-known identifier.


        More detailed attributes may also be included inline, especially when this

        information is not yet generally available in a well-known public APIs.


        Examples include:

        - Detailed enumeration of dependency paths

        - Execution flows leading to a code rule violation'
      discriminator:
        mapping:
          dependency_path: '#/components/schemas/DependencyPathEvidence'
          execution_flow: '#/components/schemas/ExecutionFlowEvidence'
          other: '#/components/schemas/OtherEvidence'
          reachability: '#/components/schemas/ReachabilityEvidence'
        propertyName: source
      oneOf:
      - $ref: '#/components/schemas/DependencyPathEvidence'
      - $ref: '#/components/schemas/ExecutionFlowEvidence'
      - $ref: '#/components/schemas/ReachabilityEvidence'
      - $ref: '#/components/schemas/OtherEvidence'
    ReachabilityType:
      description: Reachability enum for reachability signal.
      enum:
      - none
      - function
      - no_info
      - not_applicable
      type: string
    ExecutionFlowEvidence:
      description: Indicate a program flow of execution as additional evidence for the finding.
      properties:
        flow:
          description: 'Sequence of locations within this flow of execution.


            For example, a sequence of locations connecting the "source" location

            where input data is obtained, to a "sink" location where it is used.'
          items:
            $ref: '#/components/schemas/FileRegion'
          minItems: 1
          type: array
        source:
          enum:
          - execution_flow
          type: string
      required:
      - source
      - flow
      type: object
    FindingAttributes:
      description: FindingAttributes represent the attributes of a Finding resource.
      properties:
        cause_of_failure:
          default: false
          description: Did this finding cause the test outcome to fail?
          type: boolean
        component_key:
          allOf:
          - $ref: '#/components/schemas/String256'
          description: 'A test-scoped key referring to the component in which the Finding

            originated.


            Component keys are unique only within a Test.'
        description:
          description: A longer human-readable text description for this finding.
          type: string
        evidence:
          description: 'Supporting evidence for (rather than representative of) the finding in

            other security domains and systems, lacking a well-known identifier.'
          example:
          - path:
            - name: my-app:1.0.0
              version: log4j:2.4.1
            source: dependency_path
          items:
            $ref: '#/components/schemas/Evidence'
          type: array
        finding_type:
          allOf:
          - $ref: '#/components/schemas/FindingType'
          description: Type of finding.
        key:
          description: 'An opaque key used for aggregating the finding across multiple test

            executions operating on the same or originating Asset.


            Findings within a Test execution are aggregated by this key.'
          type: string
        locations:
          description: Locations in the tested component's contents where the finding may be found.
          items:
            $ref: '#/components/schemas/FindingLocation'
          type: array
        policy_modifications:
          description: Attributes which have been modified by policy decisions.
          items:
            $ref: '#/components/schemas/PolicyModification'
          type: array
        problems:
          description: 'Problems are representative of the finding in other security domains and

            systems with a well-known identifier.'
          example:
          - id: CWE-943
            source: cwe
          - default_configuration:
              severity: high
            help:
              markdown: help text goes here
            id: javascript/NoSqli
            name: NoSqli
            properties:
              categories:
              - Security
              cwe:
              - CWE-943
              example_commit_descriptions: []
              example_commit_fixes: []
              precision: very-high
              repo_dataset_size: 30
              tags:
              - javascript
              - NoSqli
            short_description:
              text: NoSQL Injection
            source: snyk_code_rule
          items:
            description: 'Problems are representative of the finding in other security domains and

              systems with a well-known identifier.


              More detailed attributes for the problem may be included, especially when

              this information is not yet readily available in a relatable public API.


              Problems are defined in industry standard taxonomies such as:

              - MITRE''s Common Weakness Enumeration (CWE)

              - Common Vulnerability Exposures (CVE)


              Snyk systems also define problems, such as:

              - Code SAST rules

              - VulnDB vulnerabilities

              - Software licenses

              - Secret leaks'
            discriminator:
              propertyName: source
            oneOf:
            - description: 'CWE classification according to MITRE''s Common Weakness Enumeration (CWE)

                database.'
              properties:
                id:
                  example: CWE-190
                  pattern: ^CWE-[0-9]+$
                  type: string
                source:
                  enum:
                  - cwe
                  type: string
              required:
              - source
              - id
              type: object
            - description: Static code analysis rule, from the standard Snyk Code rule set.
              properties:
                default_configuration:
                  description: Snyk Code rule configuration options.
                  properties:
                    severity:
                      allOf:
                      - description: Indicate the severity of a finding discovered by a Test.
                        enum:
                        - critical
                        - high
                        - medium
                        - low
                        - none
                        - other
                        type: string
                      description: Severity to apply when the rule matches.
                  required:
                  - severity
                  type: object
                help:
                  description: 'Represent a message string in multiple formats: plain text or markdown.'
                  properties:
                    markdown:
                      type: string
                    text:
                      type: string
                  type: object
                id:
                  example: javascript/NoSqli
                  type: string
                name:
                  type: string
                properties:
                  description: 'Additional properties of a Snyk Code rule. Represented in SARIF as free-form

                    metadata, but Snyk Code scanner outputs prescribe a specific structure for

                    this content.'
                  properties:
                    categories:
                      description: Categories applied to the rule.
                      items:
                        type: string
                      type: array
                    cwe:
                      description: List of CWE (Common Weakness Enumeration) identifiers corresponding to this rule.
                      items:
                        type: string
                      type: array
                    example_commit_descriptions:
                      description: Descriptions of the fix examples.
                      items:
                        type: string
                      type: array
                    example_commit_fixes:
                      description: Examples of fixing this rule in public open-source code.
                      items:
                        description: An example of fixing this rule in a public open-source code.
                        properties:
                          commit_url:
                            description: Commit URL identifying a specific commit within a public open-source SCM repo.
                            type: string
                          lines:
                            description: Lines containing an example of the Snyk Code rule with an example fix.
                            items:
                              description: 'Source line content, line number, and unified diff indicating the changes in

                                the fix.'
                              properties:
                                line:
                                  type: string
                                line_change:
                                  type: string
                                line_number:
                                  format: uint32
                                  type: integer
                              required:
                              - line
                              - line_number
                              - line_change
                              type: object
                            type: array
                        required:
                        - commit_url
                        - lines
                        type: object
                      type: array
                    precision:
                      description: A qualitative description of the rule's precision.
                      example: very-high
                      type: string
                    repo_dataset_size:
                      format: uint32
                      type: integer
                    tags:
                      description: Tags applied to the rule.
                      items:
                        type: string
                      type: array
                  required:
                  - tags
                  - categories
                  - example_commit_fixes
                  - example_commit_descriptions
                  - precision
                  - repo_dataset_size
                  - cwe
                  type: object
                short_description:
                  description: 'Represent a message string in multiple formats: plain text or markdown.'
                  properties:
                    markdown:
                      type: string
                    text:
                      type: string
                  type: object
                source:
                  enum:
                  - snyk_code_rule
                  type: string
              required:
              - source
              - id
              - name
              - short_description
              - default_configuration
              - help
              - properties
              type: object
            - description: 'CVE designation according to the public Common Vulnerability Exposure

                database.'
              properties:
                id:
                  example: CVE-2006-7135
                  pattern: ^CVE-[0-9]+-[0-9]+$
                  type: string
                source:
                  enum:
                  - cve
                  type: string
              required:
              - source
              - id
              type: object
            - description: Vulnerability from Snyk's Vulnerability Database.
              properties:
                affected_hash_ranges:
                  description: 'Range of commit hashes known to be affected by this problem.


                    Generally used with package ecosystems which use Git SCM repositories for

                    distribution.'
                  items:
                    type: string
                  type: array
                affected_hashes:
                  description: List of specific commit hashes known to be affected by this problem.
                  items:
                    type: string
                  type: array
                affected_versions:
                  description: 'All the package versions which are affected by this problem. Expect this to

                    be smaller than 0 ([,0] or <0.0.0 ) for vulnerabilities that have been

                    revoked. Per ecosystem, the official package version guidelines are

                    being used.'
                  items:
                    type: string
                  type: array
                alternative_ids:
                  description: 'This is the list of alternative IDs Snyk gives for a certain vulnerability.

                    It''s usually present in older vulnerabilities, in which Snyk used to use a different identifier format.

                    e.g a vuln with the ID "npm:foo:bar", will likely have an alternative ID of "SNYK-JS-FOO-BAR".'
                  items:
                    type: string
                  maxItems: 50
                  type: array
                created_at:
                  description: Timestamp indicating when the problem was orginally created.
                  example: '2022-05-17T14:23:25Z'
                  format: date-time
                  type: string
                credits:
                  description: Discoverer / Reporter of the vulnerability.
                  example:
                  - Snyk Research Team
                  items:
                    type: string
                  type: array
                cvss_base_score:
                  allOf:
                  - maximum: 10
                    minimum: 0
                    type: number
                  description: 'The Snyk curated or recommended CVSS score, in the highest CVSS version

                    supported and available for the issue, computed based on the Base Score

                    of the cvss_vector field.'
                  example: 9.8
                cvss_sources:
                  description: 'All CVSS vector information (Base), with corresponding sources, scores

                    and severities applying to the same vulnerability. The data is sourced

                    from external security vendors (e.g. NVD), as well as assigned by Snyk.


                    The “type” key indicates whether this is the “primary” (recommended) CVSS

                    to use, or “secondary” (provided as additional information).


                    Information might be partial and will be updated upon evaluation by

                    external sources.'
                  items:
                    description: CVSS vector information with provenance indicating the source of the scoring.
                    properties:
                      assigner:
                        description: Entity providing the CVSS information.
                        type: string
                      base_score:
                        allOf:
                        - maximum: 10
                          minimum: 0
                          type: number
                        description: Base CVSS score.
                      cvss_version:
                        description: CVSS version.
                        type: string
                      modified_at:
                        description: When the CVSS scoring was last modified.
                        format: date-time
                        type: string
                      severity:
                        allOf:
                        - description: Indicate the severity of a finding discovered by a Test.
                          enum:
                          - critical
                          - high
                          - medium
                          - low
                          - none
                          - other
                          type: string
                        description: Severity based on the CVSS rating scale (see SnykVulnAttributes.severity).
                      type:
                        allOf:
                        - description: 'Indicate whether the CVSS source is primary (recommended) or secondary

                            (provided as supplemental information).'
                          enum:
                          - primary
                          - secondary
                          - other
                          type: string
                        description: 'Designation of whether the CVSS score is primary (recommended assessment)

                          or secondary (supplemental information).'
                      vector:
                        description: The CVSS vector string.
                        type: string
                    required:
                    - assigner
                    - modified_at
                    - severity
                    - vector
                    - base_score
                    - cvss_version
                    - type
                    type: object
                  type: array
                cvss_vector:
                  description: 'The primary CVSS Base vector, either Snyk curated or from the recommended

                    source, in v3.0, v3.1 or v4.0 CVSS versions. Might include exploit

                    values where applicable.'
                  example: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
                  type: string
                disclosed_at:
                  description: 'Timestamp of when the vulnerability was first made publicly available

                    (either known to us or as appears in the vulnerability source)'
                  example: '2022-10-09T23:55:03Z'
                  format: date-time
                  type: string
                ecosystem:
                  allOf:
                  - description: Describe a software package ecosystem.
                    discriminator:
                      propertyName: type
                    oneOf:
                    - description: 'Software packages supporting the application build process.


                        These are generally development libraries, which may be distributed in source

                        or compiled form, used during the application build process by various

                        programming language toolchains.


                        Examples include, but are not limited to: Javascript NPM, Java Maven, Python pip, etc.'
                      properties:
                        client:
                          description: 'Ecosystem client is the tool the consumer used to manage the dependencies.

                            In managed ecosystems, this is commonly refered to as the package manager,

                            while in the case of C++, this would be "unmanaged".'
                          type: string
                        language:
                          deprecated: true
                          type: string
                        package_manager:
                          deprecated: true
                          type: string
                        type:
                          enum:
                          - build
                          type: string
                      required:
                      - type
                      - language
                      - package_manager
                      type: object
                    - description: 'Software packages supporting operating system software installation and

                        upgrades.


                        These are generally software packages containing runtime libraries and

                        applications which are installed as part of an operating system software

                        distribution.'
                      properties:
                        distribution:
                          description: Distribution name providing the package.
                          example: debian
                          type: string
                        os_name:
                          description: Name of the operating system.
                          example: linux
                          type: string
                        release:
                          description: 'Release version of the operating system distribution.


                            Note that for Linux distributions this is the release version (typically a

                            semver or date-derived number), rather than the codename for the release.'
                          example: '12.6'
                          type: string
                        type:
                          enum:
                          - os
                          type: string
                      required:
                      - type
                      - os_name
                      - distribution
                      - release
                      type: object
                    - description: 'Package ecosystem which this API version is not capable of expressing.


                        More information may be available in a newer version of this API.'
                      properties:
                        type:
                          enum:
                          - other
                          type: string
                      required:
                      - type
                      type: object
                  description: 'Package ecosystem in which the package is distributed.


                    This applies to private packages distributed with ecosystem tooling as well

                    as those publicly distributed.'
                epss_details:
                  allOf:
                  - description: 'Exploit Prediction Scoring System (EPSS), which predicts the likelihood (probability) of the vulnerability to be

                      exploited, and the percentile of the EPSS of a vulnerability relative to all other vulnerabilities.

                      We are using the latest model.

                      https://www.first.org/epss/model'
                    properties:
                      model_version:
                        description: The version of the EPSS model we use.
                        example: v2025.03.14
                        type: string
                      percentile:
                        description: 'The

# --- truncated at 32 KB (90 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/snyk/refs/heads/main/openapi/snyk-findings-api-openapi.yml