Export findings

1 min

, , , , ,

Exports findings from every scan in your organisation in one of three formats. It is the organisation-wide counterpart to GET /scans/{id}/findings/export, which covers a single scan. Only findings that have passed automated verification (verification_status = approved) are returned.

To export exactly the findings you’re looking at, use the filters that GET /findings takes, including severity, state, scan_type, found_since, and found_until. To export a single repository, filter on repo_url.

`format=json`

1
Content-Type: application/json; charset=utf-8

Returns a JSON array of finding objects, each matching the schema in GET /findings.

`format=csv`

1
Content-Type: text/csv; charset=utf-8
2
Content-Disposition: attachment; filename="findings.csv"

Returns a CSV document with a header row and one row per finding, for spreadsheets, BI tools, and ad hoc review.

`format=sarif`

1
Content-Type: application/sarif+json; charset=utf-8
2
Content-Disposition: attachment; filename="findings.sarif"

Returns a SARIF 2.1.0 document. GitHub code scanning, Azure DevOps, and most IDE security plugins read SARIF, so use this format to bring Hacktron findings into the security tooling you already use.

Request

GET /findings/export

Send an API key with the read scope in the X-Api-Key header.

Query parameters

Parameter	Description
`page` number	The page number to retrieve. Default `1`.
`limit` number	The number of items to retrieve per page. Default `100`.
`severity` string	One of `critical`, `high`, `medium`, `low`, or `info`.
`state` string	One of `open`, `true_positive`, `false_positive`, `accepted_risk`, `resolved`, or `closed`.
`scan_id` string
`scan_type` string	Filter by scan type across all scans associated with the finding. One of `pr` or `full`.
`repo_url` string	Filter by repository URL. Case-insensitive; a trailing slash or .git suffix is ignored.
`found_since` string	Only include findings discovered on/after this ISO 8601 timestamp.
`found_until` string	Only include findings discovered before this ISO 8601 timestamp.
`sort_by` string	One of `found_at`, `updated_at`, or `severity`.
`sort_order` string	One of `ASC` or `DESC`. Default `DESC`.
`format` string, required	Export format. One of `json`, `csv`, or `sarif`.