Findings and reports
Findings with their five answers, status changes, reports and every export format.
| Method | Path | Needs | Returns |
|---|---|---|---|
| GET | /sites/:siteId/findings?status=&severity=&domain=&admission= | finding.read | published findings, paginated, sorted and searched server-side |
| GET | /findings/:findingId | finding.read | summary, explanation (what, why, abuse, fix, verify), technicalDetails, history |
| POST | /findings/:findingId/status | finding.update | { status: CONFIRMED | FIXING | FALSE_POSITIVE | ACCEPTED_RISK | OPEN, reason } |
| GET | /sites/:siteId/reports | report.read | paginated summaries |
| GET | /reports/:reportId | report.read | report with findings and change: NEW | REGRESSED | UNCHANGED |
| GET | /reports/:reportId/export?format=csv|md|json|pdf | report.export | a file download |
| GET | /sites/:siteId/findings/export?format=csv|json | report.export | every published finding, same filters as the list |
Status transitions are validated and audited; a dismissed finding never spends a credit again. Exports never carry raw evidence, CSV cells that look like formulas are neutralised, and the findings export stops at two thousand rows and says so.
Something here wrong, missing or out of date? Tell us and we will fix the page.