How do I pull the findings for one scan through the API?

Steps

1. Find the scan ID. A CI trigger returns it, and the list of scans holds it too.
2. Send GET /api/issues with scanId set to that value and your Bearer token.
3. Narrow the list if you want. The reference names these filters: targetId, severity, confidence, vulnClass and triageStatus.
4. Fetch one finding with GET /api/issues/:id. It adds the resolved target URL and surface.
5. For a file, call GET /api/export/issues, which returns JSON or CSV and needs issue:export.

Good to know

Reading issues needs issue:read. Triage changes go through PATCH /api/issues/:id and need issue:triage, so a read-only token cannot alter a finding by accident.

Issues persist per target across scans, so the Issues page and this endpoint show a rolling set that grows and shrinks as findings appear and get fixed over time. Passing scanId is how you ask for the findings of just one run.

In the app, the same list lives on the Findings tab of the scan detail page, where you can click a row to read the evidence. It is a handy way to compare what the API returns with what you see on screen. A pipeline that only needs a summary can use the CI result route, which already includes a findings list. The page on checking a CI scan's result explains how. To see only what changed since the last scan, use the diff endpoint. To get a file you can open in a spreadsheet, read how to export findings as CSV.

Related questions

• How do I get the new, fixed and regressed findings for a scan through the API?
• How do I check a CI-triggered scan's result through the API?
• How do I launch a scan through the API?
• How do I find the endpoint I need and the permission it requires?
• How do I export findings to CSV?

Full tutorial

Cyberlop API reference: authentication, permissions and the OpenAPI spec

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre