Search

Search findings using full-text query and filters for severity, state, type, and app.

POST /api/v1/findings/search

Search

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.FindingSearch.Search(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.FindingSearchResponse != nil {
        // handle response
    }
}

200

{
  "list": [
    {
      "appId": "<string>",
      "appUserTarget": {
        "appId": "<string>",
        "appUserId": "<string>"
      },
      "assignedOwner": {
        "appOwnerAppId": "<string>",
        "identityUserId": "<string>",
        "managerOfUserId": "<string>",
        "userSetId": "<string>"
      },
      "computedOwner": {
        "appOwnerAppId": "<string>",
        "identityUserId": "<string>",
        "managerOfUserId": "<string>",
        "userSetId": "<string>"
      },
      "createdAt": "2023-11-07T05:31:56Z",
      "customTags": {},
      "fingerprint": "<string>",
      "firstObservedAt": "2023-11-07T05:31:56Z",
      "id": "<string>",
      "identityUserTarget": {
        "identityUserId": "<string>"
      },
      "lastObservedAt": "2023-11-07T05:31:56Z",
      "recurrenceCount": 123,
      "remediationDescription": "<string>",
      "resolvedAt": "2023-11-07T05:31:56Z",
      "riskAcceptanceExpiresAt": "2023-11-07T05:31:56Z",
      "riskAcceptanceJustification": "<string>",
      "riskScore": {
        "originalScore": 123,
        "overrideByUserId": "<string>",
        "overrideScore": 123,
        "riskFactors": [
          {
            "description": "<string>",
            "name": "<string>",
            "severity": "FINDING_SEVERITY_UNSPECIFIED",
            "weight": 123
          }
        ],
        "score": 123,
        "systemScore": 123
      },
      "serviceAccountMisclassification": {
        "currentAccountType": "APP_USER_TYPE_UNSPECIFIED",
        "detectedAccountType": "APP_USER_TYPE_UNSPECIFIED"
      },
      "serviceAccountMisclassificationEvidence": {
        "detectionReason": "<string>"
      },
      "severity": "FINDING_SEVERITY_UNSPECIFIED",
      "similarUsernameMatch": {
        "proposedIdentityUserId": "<string>"
      },
      "similarUsernameMatchEvidence": {
        "appUsername": "<string>",
        "identityUsername": "<string>",
        "similarityScore": 123
      },
      "snoozeReason": "<string>",
      "snoozeUntil": "2023-11-07T05:31:56Z",
      "sourceDetectorId": "<string>",
      "state": "FINDING_STATE_UNSPECIFIED",
      "stateUpdatedById": "<string>",
      "suppressReason": "<string>",
      "taskId": "<string>",
      "updatedAt": "2023-11-07T05:31:56Z"
    }
  ],
  "nextPageToken": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

The FindingSearchRequest message.

appIds · string[] | null

Filter by app IDs (OR within field).

appUserIds · string[] | null

Filter by app user IDs (OR within field). Matches findings whose target.app_user_target.app_user_id is in this list.

findingTypes · string[] | null

Filter by finding type discriminators (OR within field).

pageSize · integer<int32>

Maximum number of findings to return per page.

pageToken · string

Pagination token from a previous response.

query · string

Free text search query.

severities · enum<string>[] | null

Filter by severities (OR within field).

Available options: FINDING_SEVERITY_UNSPECIFIED, FINDING_SEVERITY_INFO, FINDING_SEVERITY_LOW, FINDING_SEVERITY_MEDIUM, FINDING_SEVERITY_HIGH, FINDING_SEVERITY_CRITICAL

states · enum<string>[] | null

Filter by states (OR within field).

Available options: FINDING_STATE_UNSPECIFIED, FINDING_STATE_OPEN, FINDING_STATE_IN_PROGRESS, FINDING_STATE_RESOLVED, FINDING_STATE_SNOOZED, FINDING_STATE_RISK_ACCEPTED, FINDING_STATE_SUPPRESSED

Response

200 - application/json

Successful response

The FindingSearchResponse message.

list · Finding · object[] | null

The list field.

Show child attributes

nextPageToken · string

The nextPageToken field.