Skip to main content
GET
/
scans
/
{id}
/
findings
List scan findings
curl --request GET \
  --url https://api.example.com/scans/{id}/findings
Returns findings produced by a specific scan, with the same filtering and sorting controls as List findings. Only findings that have passed automated verification (verification_status = approved) are returned.
Scope required: read

​
Request

curl "https://api.hacktron.ai/v1/scans/a1b2c3d4-e5f6-7890-abcd-ef1234567890/findings?severity=high&state=open&page=1&limit=50" \
  -H "X-Api-Key: $HACKTRON_API_KEY"

​
Path parameters

ParameterTypeDescription
idUUIDScan UUID.

​
Query parameters

ParameterTypeDefaultDescription
pageinteger11‑based page number.
limitinteger15Items per page. Max 100.
severityenum—Filter by severity: critical, high, medium, low, info.
stateenum—Filter by state: open, true_positive, false_positive, accepted_risk, resolved.
sort_byenumfound_atOne of found_at, updated_at, severity.
sort_orderenumDESCASC or DESC.

​
Response

200 OK 
{
  "data": [
    {
      "id": "d1e2f3a4-b5c6-7890-1234-567890abcdef",
      "title": "SQL injection in /api/v1/checkout",
      "category": "injection",
      "severity": "critical",
      "state": "open",
      "description": "User-supplied cart ID is concatenated into a SQL query...",
      "affected_file": "apps/api/src/checkout/checkout.service.ts",
      "affected_code": "const rows = await conn.query(`SELECT * FROM carts WHERE id = '${cartId}'`);",
      "proof_of_concept": "POST /api/v1/checkout with cart_id=1' OR '1'='1",
      "impact": "Full read access to the carts table, including other customers' items.",
      "root_cause": "String interpolation instead of parameterised query.",
      "remediation": "Use parameterised queries via the driver's placeholder API.",
      "tags": ["injection", "sql"],
      "scan_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "found_at": "2026-04-13T12:15:00.000Z",
      "updated_at": "2026-04-13T12:20:00.000Z"
    }
  ],
  "total": 11,
  "page": 1,
  "limit": 50
}
See List findings for the field reference.

​
Errors

  • 404 — scan not found or not visible to your organization.