> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hacktron.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List scan findings

> Paginate through the findings produced by a scan.

Returns findings produced by a specific scan, with the same filtering and sorting controls as [List findings](/api-reference/findings/list-findings).

Only findings that have passed automated verification (`verification_status = approved`) are returned.

<Info>**Scope required**: `read`</Info>


## OpenAPI

````yaml GET /scans/{id}/findings
openapi: 3.0.0
info:
  title: Hacktron REST API
  description: Public REST API for programmatic access to Hacktron
  version: '1.0'
  contact: {}
servers:
  - url: https://api.hacktron.ai/v1
security:
  - api-key: []
tags: []
paths:
  /scans/{id}/findings:
    get:
      tags:
        - REST API - Scans
      summary: List findings for a specific scan
      operationId: RestScanController_listScanFindings
      parameters:
        - name: id
          required: true
          in: path
          schema:
            type: string
        - name: page
          required: false
          in: query
          description: The page number to retrieve.
          schema:
            default: 1
            type: number
        - name: limit
          required: false
          in: query
          description: The number of items to retrieve per page.
          schema:
            default: 100
            type: number
        - name: severity
          required: false
          in: query
          schema:
            type: string
            enum:
              - critical
              - high
              - medium
              - low
              - info
        - name: state
          required: false
          in: query
          schema:
            type: string
            enum:
              - open
              - true_positive
              - false_positive
              - accepted_risk
              - resolved
              - closed
        - name: scan_id
          required: false
          in: query
          schema:
            type: string
        - name: scan_type
          required: false
          in: query
          description: Filter by scan type across all scans associated with the finding.
          schema:
            type: string
            enum:
              - pr
              - full
        - name: repo_url
          required: false
          in: query
          description: Filter by exact repository URL.
          schema:
            type: string
        - name: found_since
          required: false
          in: query
          description: Only include findings discovered on/after this ISO 8601 timestamp.
          schema:
            type: string
        - name: found_until
          required: false
          in: query
          description: Only include findings discovered before this ISO 8601 timestamp.
          schema:
            type: string
        - name: sort_by
          required: false
          in: query
          schema:
            type: string
            enum:
              - found_at
              - updated_at
              - severity
        - name: sort_order
          required: false
          in: query
          schema:
            default: DESC
            type: string
            enum:
              - ASC
              - DESC
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestFindingListResponseDto'
components:
  schemas:
    RestFindingListResponseDto:
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/RestFindingResponseDto'
        total:
          type: number
        page:
          type: number
        limit:
          type: number
      required:
        - data
        - total
        - page
        - limit
    RestFindingResponseDto:
      type: object
      properties:
        id:
          type: string
          description: Finding UUID
        title:
          type: string
        category:
          type: string
        severity:
          type: string
          enum:
            - critical
            - high
            - medium
            - low
            - info
        state:
          type: string
          enum:
            - open
            - true_positive
            - false_positive
            - accepted_risk
            - resolved
            - closed
        description:
          type: string
        affected_file:
          type: string
        affected_code:
          type: string
        proof_of_concept:
          type: string
          nullable: true
        tags:
          type: array
          items:
            type: string
        scan_id:
          type: string
          nullable: true
        found_at:
          type: string
        updated_at:
          type: string
        resolved_at:
          type: string
          nullable: true
          description: >-
            Timestamp of the most recent transition to resolved (ISO 8601). Null
            if never resolved.
      required:
        - id
        - title
        - category
        - severity
        - state
        - description
        - affected_file
        - affected_code
        - proof_of_concept
        - tags
        - scan_id
        - found_at
        - updated_at
        - resolved_at
  securitySchemes:
    api-key:
      type: apiKey
      in: header
      name: X-Api-Key

````