Findings
List findings for a test.
Test Findings are scanner-agnostic representations of vulnerabilities and organization-level policy breaches. When Snyk runs a Test, the results of that Test are formatted into Findings.
This endpoint returns pages of Findings associated with a given Test ID. Findings are returned in sorted order by ID, with page size equal to the provided Limit query parameter. Page size is 10 Findings by default if no parameter is provided.
Note that the Findings returned from this endpoint are only the Findings that are not suppressed by policy and are not in violation of a set Test threshold (like Severity or Risk Score).
To retrieve the next (or previous) page of Findings, utilize the Next and Prev links returned in the response.
Required permissions
View Organization (org.read)
API key value must be prefixed with "Token ".
Snyk Org ID under which to run or query information about a Job or Test.
Test ID returned from the Test API to query.
The API version requested.
Opaque pagination cursor for forward traversal.
Opaque pagination cursor for reverse traversal.
The number of items to return.
10A unique ID assigned to each API request, for tracing and troubleshooting.
Snyk clients can optionally provide this ID.
Identifies the Snyk client interaction in which this API request occurs.
The identifier is an opaque string. though at the time of writing it may either be a uuid or a urn containing a uuid and some metadata.
Successful API response for a paginated collection.
Invalid input
GET /rest/orgs/{org_id}/tests/{test_id}/findings?version=text HTTP/1.1
Host: api.snyk.io
Authorization: YOUR_API_KEY
Accept: */*
{
"data": [
{
"attributes": {
"cause_of_failure": false,
"component_key": "text",
"description": "text",
"evidence": [
{
"path": [
{
"name": "my-app:1.0.0",
"version": "log4j:2.4.1"
}
],
"source": "dependency_path"
}
],
"finding_type": "sca",
"key": "text",
"locations": [
{
"package": {
"name": "log4j",
"version": "2.4.1"
},
"type": "package"
}
],
"policy_modifications": [
{
"pointer": "/rating/severity",
"policy": "local_policy",
"prior": "low",
"reason": "CWE-123 poses an elevated risk to workloads exposed to the public internet"
}
],
"problems": [
{
"id": "CWE-943",
"source": "cwe"
},
{
"default_configuration": {
"severity": "high"
},
"help": {
"markdown": "help text goes here"
},
"id": "javascript/NoSqli",
"name": "NoSqli",
"properties": {
"categories": [
"Security"
],
"cwe": [
"CWE-943"
],
"example_commit_descriptions": [],
"example_commit_fixes": [],
"precision": "very-high",
"repo_dataset_size": 30,
"tags": [
"javascript",
"NoSqli"
]
},
"short_description": {
"text": "NoSQL Injection"
},
"source": "snyk_code_rule"
}
],
"rating": {
"severity": "critical"
},
"risk": {
"risk_score": {
"value": 1
}
},
"suppression": {
"created_at": "2026-01-01T00:00:00.000Z",
"expires_at": "2026-01-01T00:00:00.000Z",
"justification": "text",
"path": [
"text"
],
"policy": "local_policy",
"skipIfFixable": true,
"status": "ignored"
},
"title": "text"
},
"id": "123e4567-e89b-12d3-a456-426614174000",
"links": {
"snyk_advisory": "https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720",
"snyk_learn": "https://learn.snyk.io/lesson/csrf-attack/"
},
"relationships": {
"asset": {
"data": {
"id": "123e4567-e89b-12d3-a456-426614174000",
"type": "text"
},
"links": {
"related": "https://example.com"
},
"meta": {
"ANY_ADDITIONAL_PROPERTY": "anything"
}
},
"fix": {
"data": {
"attributes": {
"action": {
"format": "upgrade_package_advice",
"package_name": "lodash",
"upgrade_paths": [
{
"dependency_path": [
{
"name": "lodash",
"version": "2.1.1"
},
{
"name": "minimist",
"version": "4.7.6"
}
],
"is_drop": false
}
]
},
"outcome": "fully_resolved"
},
"id": "123e4567-e89b-12d3-a456-426614174000",
"type": "text"
}
},
"org": {
"data": {
"id": "123e4567-e89b-12d3-a456-426614174000",
"type": "text"
}
},
"policy": {
"data": {
"attributes": {
"policies": [
{
"applied_policy": {
"action_type": "severity-change",
"policy_ref": {
"id": "123e4567-e89b-12d3-a456-426614174000",
"owner": "org"
},
"rule": {
"created": "2026-01-01T00:00:00.000Z",
"id": "123e4567-e89b-12d3-a456-426614174000",
"modified": "2026-01-01T00:00:00.000Z",
"name": "text",
"review": "approved",
"reviewed_at": "2026-01-01T00:00:00.000Z",
"reviewed_by": {
"email": "text",
"id": "123e4567-e89b-12d3-a456-426614174000",
"name": "text"
}
},
"severity_change": {
"new_severity": "critical",
"original_severity": "critical"
}
},
"id": "123e4567-e89b-12d3-a456-426614174000",
"type": "legacy_policy_snapshot"
}
]
},
"id": "123e4567-e89b-12d3-a456-426614174000",
"type": "text"
},
"links": {
"related": "https://example.com"
},
"meta": {
"ANY_ADDITIONAL_PROPERTY": "anything"
}
},
"project": {
"data": {
"id": "123e4567-e89b-12d3-a456-426614174000",
"type": "text"
}
},
"test": {
"data": {
"id": "123e4567-e89b-12d3-a456-426614174000",
"type": "text"
},
"links": {
"related": "https://example.com"
},
"meta": {
"ANY_ADDITIONAL_PROPERTY": "anything"
}
}
},
"type": "findings"
}
],
"jsonapi": {
"version": "1.0"
},
"links": {
"first": "https://example.com",
"last": "https://example.com",
"next": "https://example.com",
"prev": "https://example.com",
"self": "https://example.com"
},
"meta": {
"ANY_ADDITIONAL_PROPERTY": "anything"
}
}Last updated
Was this helpful?