> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hacktron.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Export findings

> Export findings across all scans as JSON, CSV, or SARIF.

Exports findings across every scan in your organization in one of three formats. This is the organization-wide counterpart to [Export scan findings](/api-reference/scans/export-scan-findings), which is scoped to a single scan. Only findings that have passed automated verification (`verification_status = approved`) are returned.

Use the same filters available on [List findings](/api-reference/findings/list-findings) — including `severity`, `state`, `scan_type`, `found_since`, and `found_until` — to export exactly the findings you are looking at. Scope the export to one repository with the `repo_url` filter.

<Info>**Scope required**: `read`</Info>

### `format=json`

```http theme={null}
Content-Type: application/json; charset=utf-8
```

Returns a JSON array of finding objects, each matching the schema described in [List findings](/api-reference/findings/list-findings#response-data).

### `format=csv`

```http theme={null}
Content-Type: text/csv; charset=utf-8
Content-Disposition: attachment; filename="findings.csv"
```

Returns a CSV document with one row per finding and a header row. Intended for spreadsheets, BI tools, and ad‑hoc review.

### `format=sarif`

```http theme={null}
Content-Type: application/sarif+json; charset=utf-8
Content-Disposition: attachment; filename="findings.sarif"
```

Returns a [SARIF 2.1.0](https://sarifweb.azurewebsites.net/) document. SARIF is consumed by GitHub code scanning, Azure DevOps, and most IDE security plugins; use this format to integrate Hacktron findings into existing security tooling.


## OpenAPI

````yaml openapi.json GET /findings/export
openapi: 3.0.0
info:
  title: Hacktron REST API
  description: Public REST API for programmatic access to Hacktron
  version: '1.0'
  contact: {}
servers:
  - url: https://api.hacktron.ai/v1
security:
  - api-key: []
tags: []
paths:
  /findings/export:
    get:
      tags:
        - REST API - Findings
      summary: >-
        Export findings as JSON, CSV, or SARIF, optionally filtered by
        repository
      operationId: RestFindingController_exportFindings
      parameters:
        - name: page
          required: false
          in: query
          description: The page number to retrieve.
          schema:
            default: 1
            type: number
        - name: limit
          required: false
          in: query
          description: The number of items to retrieve per page.
          schema:
            default: 100
            type: number
        - name: severity
          required: false
          in: query
          schema:
            type: string
            enum:
              - critical
              - high
              - medium
              - low
              - info
        - name: state
          required: false
          in: query
          schema:
            type: string
            enum:
              - open
              - true_positive
              - false_positive
              - accepted_risk
              - resolved
              - closed
        - name: scan_id
          required: false
          in: query
          schema:
            type: string
        - name: scan_type
          required: false
          in: query
          description: Filter by scan type across all scans associated with the finding.
          schema:
            type: string
            enum:
              - pr
              - full
        - name: repo_url
          required: false
          in: query
          description: Filter by exact repository URL.
          schema:
            type: string
        - name: found_since
          required: false
          in: query
          description: Only include findings discovered on/after this ISO 8601 timestamp.
          schema:
            type: string
        - name: found_until
          required: false
          in: query
          description: Only include findings discovered before this ISO 8601 timestamp.
          schema:
            type: string
        - name: sort_by
          required: false
          in: query
          schema:
            type: string
            enum:
              - found_at
              - updated_at
              - severity
        - name: sort_order
          required: false
          in: query
          schema:
            default: DESC
            type: string
            enum:
              - ASC
              - DESC
        - name: format
          required: true
          in: query
          description: Export format
          schema:
            type: string
            enum:
              - json
              - csv
              - sarif
      responses:
        '200':
          description: ''
components:
  securitySchemes:
    api-key:
      type: apiKey
      in: header
      name: X-Api-Key

````