Skip to content
zkaozkaozkao docs
These docs describe staging.zkao.io and the @zksecurity/zkao-cli@next release. For production, see docs.zkao.io.

List findings

GET
/projects/{projectId}/findings
curl --request GET \
  --url 'https://zkao.io/api/v1/projects/example/findings?page=1&limit=50' \
  --header 'Authorization: Bearer <token>'

Requires scope: read. Optionally filter by scanId.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters”
projectId
required
string

Query Parameters

Section titled “Query Parameters”
page
integer
default: 1 >= 1
limit
integer
default: 50 >= 1 <= 100
scanId
string

Only findings belonging to this scan.

Responses

Section titled “ Responses ”

200

Section titled “200”

OK

Media typeapplication/json
object
items
required
Array<object>
object
id
required
string
displayId
required
integer
title
required
string
location
required
string
severity
required

Effective severity (user override if set, else AI severity).

string
Allowed values: CRITICAL HIGH MEDIUM LOW INFO
category
required
string
triageStatus
required
string
Allowed values: PENDING NEW DUPLICATE RECURRING CONFIRMED FALSE_POSITIVE INCONCLUSIVE
confirmationEvidence

What backs a CONFIRMED verdict. POC means a proof of concept ran and demonstrated the issue. ANALYSIS means it was confirmed by code analysis alone. Null for other statuses or when not recorded.

string | null
Allowed values: POC ANALYSIS
resolutionStatus
required
string
Allowed values: NOT_STARTED IN_PROGRESS RESOLVED WONT_FIX MITIGATED FALSE_POSITIVE DUPLICATE
notesCount
required
integer
page
required
integer
limit
required
integer
total
required
integer
Example
{
  "items": [
    {
      "severity": "CRITICAL",
      "triageStatus": "PENDING",
      "confirmationEvidence": "POC",
      "resolutionStatus": "NOT_STARTED"
    }
  ]
}

401

Section titled “401”

Missing, malformed, expired, or revoked token

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal
message
required
string
Example
{
  "error": {
    "code": "unauthorized"
  }
}

403

Section titled “403”

The token lacks the required scope

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal
message
required
string
Example
{
  "error": {
    "code": "unauthorized"
  }
}

404

Section titled “404”

Resource not in this token’s project or repo allowlist

Media typeapplication/json
object
error
required
object
code
required
string
Allowed values: unauthorized forbidden not_found bad_request conflict insufficient_credits repository_initializing diff_base_required diff_base_not_allowed diff_base_invalid diff_empty rate_limited internal
message
required
string
Example
{
  "error": {
    "code": "unauthorized"
  }
}