Get a single finding (full detail)

GET

/projects/{projectId}/findings/{findingId}

curl --request GET \
  --url https://zkao.io/api/v1/projects/example/findings/example \
  --header 'Authorization: Bearer <token>'

• Production
• Staging

Requires scope: read. Includes description, PoC, recommended fix, and notes.

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

findingId

required

string

The finding id, or the ZK- label shown on the finding page (the id’s last eight characters, prefix optional). A label that matches more than one finding in the project is refused with 409 conflict; use the full id.

Responses

200

OK

Media typeapplication/json

object

finding

required

object

id

required

string

displayId

required

integer

title

required

string

location

required

string

severity

required

Effective severity (user override if set, else AI severity).

string

Allowed values: CRITICAL HIGH MEDIUM LOW INFO

category

required

string

triageStatus

required

string

Allowed values: PENDING NEW DUPLICATE RECURRING CONFIRMED FALSE_POSITIVE INCONCLUSIVE

confirmationEvidence

What backs a CONFIRMED verdict. POC means a proof of concept ran and demonstrated the issue. ANALYSIS means it was confirmed by code analysis alone. Null for other statuses or when not recorded.

string | null

Allowed values: POC ANALYSIS

resolutionStatus

required

string

Allowed values: NOT_STARTED IN_PROGRESS RESOLVED WONT_FIX MITIGATED FALSE_POSITIVE DUPLICATE

notesCount

required

integer

description

required

string

pocReport

string | null

recommendedFix

string | null

scanId

required

string

commitHash

string | null

repo

object

owner

string

name

string

url

string

createdAt

required

string format: date-time

notes

required

Array<object>

object

id

required

string

body

required

string

createdAt

required

string format: date-time

author

object

id

string

name

string | null

email

string

Example

{
  "finding": {
    "severity": "CRITICAL",
    "triageStatus": "PENDING",
    "confirmationEvidence": "POC",
    "resolutionStatus": "NOT_STARTED"
  }
}

401

Missing, malformed, expired, or revoked token

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal

message

required

string

Example

{
  "error": {
    "code": "unauthorized"
  }
}

403

The token lacks the required scope

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal

message

required

string

Example

{
  "error": {
    "code": "unauthorized"
  }
}

404

Resource not in this token’s project or repo allowlist

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal

message

required

string

Example

{
  "error": {
    "code": "unauthorized"
  }
}

409

A compare-and-set (expectedContent) missed: the guidance changed since it was read. Re-read the current guidance and retry.

Media typeapplication/json

object

error

required

object

code

required

string

Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal

message

required

string

Example

{
  "error": {
    "code": "unauthorized"
  }
}