> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetrident.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Findings API: Query Security Issues Programmatically

> GET /api/public/trident/findings — retrieve security findings from red-team, firewall, SAST, and cloud scanners with filtering and pagination.

The Findings API returns security issues that Trident has detected across all of its scan surfaces — red-team campaigns, the runtime firewall, SAST tools, cloud posture scanners, MCP safety audits, and agent self-reports. The response shape mirrors the Findings Inbox in the dashboard, making it straightforward to build custom alert pipelines, CI gates, or compliance exports.

## GET /api/public/trident/findings

Fetch findings for your project with optional filters and a configurable look-back window.

**Endpoint:** `GET https://app.usetrident.dev/api/public/trident/findings`

**Authentication:** HTTP Basic — see [Authentication](/api/authentication)

### Query parameters

<ParamField query="agentId" type="string">
  Return findings for a specific agent only. Omit to return findings across all
  agents in the project.
</ParamField>

<ParamField query="redteamRunId" type="string">
  Filter to findings produced by a specific red-team or campaign run. Useful
  in CI pipelines to retrieve findings from the run you just triggered without
  picking up stale findings from earlier scans against the same agent.
</ParamField>

<ParamField query="severity" type="string | string[]">
  One or more severity levels: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`. You can
  pass the parameter multiple times to include several levels —
  `?severity=HIGH&severity=CRITICAL`.
</ParamField>

<ParamField query="status" type="string | string[]">
  One or more statuses: `OPEN`, `ACKNOWLEDGED`, `IN_PROGRESS`, `RESOLVED`,
  `WONT_FIX`, `DUPLICATE`. Repeatable like `severity`.
</ParamField>

<ParamField query="source" type="string | string[]">
  Filter by the scanner that produced the finding. Accepted values:
  `REDTEAM`, `FIREWALL`, `CERT`, `INTENT`, `SBOM`, `NETWORK`, `SAST`,
  `MONITOR`, `CSPM`, `KSPM`, `IAC`, `SECRET`, `VULN`, `RUNTIME`, `MCP`,
  `SELF_REPORT`.
</ParamField>

<ParamField query="sinceDays" type="number" default="30">
  Look-back window in days. Must be between `1` and `180`. Findings older than
  this window are excluded.
</ParamField>

<ParamField query="limit" type="number" default="50">
  Maximum number of findings to return. Minimum `1`, maximum `200`.
</ParamField>

### Example request

```bash curl theme={null}
CREDENTIALS=$(echo -n "$TRIDENT_PROJECT_PUBLIC_KEY:$TRIDENT_PROJECT_SECRET_KEY" | base64)

# Critical and high findings from red-team runs in the last 7 days
curl "https://app.usetrident.dev/api/public/trident/findings\
?severity=CRITICAL\
&severity=HIGH\
&source=REDTEAM\
&sinceDays=7\
&limit=20" \
  -H "Authorization: Basic $CREDENTIALS" \
  -H "Accept: application/json"
```

### Example response

```json theme={null}
{
  "count": 2,
  "findings": [
    {
      "id": "find_01HY8ZQXKB4T5V3NP2M7W0R1J",
      "agentId": "prod-rag-assistant",
      "severity": "CRITICAL",
      "source": "REDTEAM",
      "category": "prompt-injection:indirect",
      "status": "OPEN",
      "title": "Indirect prompt injection via retrieved document chunk",
      "traceId": "01HY8ZQ000000000000000ABC",
      "redteamRunId": "e3f7b2d1-9a0c-4b5e-8f1d-7c6a2e9b3d4f",
      "certificateId": null,
      "createdAt": "2025-06-10T14:22:07.000Z",
      "riskScore": 9.1,
      "owaspCode": "LLM01"
    },
    {
      "id": "find_01HY7YQXKB4T5V3NP2M7W0R2K",
      "agentId": "prod-rag-assistant",
      "severity": "HIGH",
      "source": "REDTEAM",
      "category": "data-exfiltration:pii",
      "status": "ACKNOWLEDGED",
      "title": "Agent can be instructed to repeat user PII in response",
      "traceId": null,
      "redteamRunId": "e3f7b2d1-9a0c-4b5e-8f1d-7c6a2e9b3d4f",
      "certificateId": null,
      "createdAt": "2025-06-10T13:58:44.000Z",
      "riskScore": 7.4,
      "owaspCode": "LLM06"
    }
  ]
}
```

### Response fields

<ResponseField name="count" type="number" required>
  Number of findings returned in this response. Limited by the `limit`
  parameter.
</ResponseField>

<ResponseField name="findings" type="array" required>
  Array of finding objects, sorted by severity descending then creation date
  descending.

  <Expandable title="Finding object fields">
    <ResponseField name="id" type="string" required>
      Unique finding identifier. Use this to reference the finding in
      integrations or when building links to the dashboard.
    </ResponseField>

    <ResponseField name="agentId" type="string" required>
      The agent this finding was recorded against.
    </ResponseField>

    <ResponseField name="severity" type="string" required>
      One of `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.
    </ResponseField>

    <ResponseField name="source" type="string" required>
      The scanner that produced this finding. See the `source` query parameter
      above for all possible values.
    </ResponseField>

    <ResponseField name="category" type="string" required>
      A slash-separated category path, for example
      `"prompt-injection:indirect"` or `"self-report:tool-call-failure"`.
    </ResponseField>

    <ResponseField name="status" type="string" required>
      Lifecycle status: `OPEN`, `ACKNOWLEDGED`, `IN_PROGRESS`, `RESOLVED`,
      `WONT_FIX`, or `DUPLICATE`.
    </ResponseField>

    <ResponseField name="title" type="string" required>
      Short human-readable summary of the finding, as shown in the dashboard
      inbox.
    </ResponseField>

    <ResponseField name="traceId" type="string | null" required>
      Links the finding to an OTel trace when available. `null` if no trace
      context was captured.
    </ResponseField>

    <ResponseField name="redteamRunId" type="string | null" required>
      The run or campaign job ID that produced this finding. Use with the
      `redteamRunId` query parameter to filter findings to a specific scan.
    </ResponseField>

    <ResponseField name="certificateId" type="string | null" required>
      Links the finding to a specific certificate issuance when relevant.
      `null` for findings that are not certificate-derived.
    </ResponseField>

    <ResponseField name="createdAt" type="string" required>
      ISO 8601 creation timestamp.
    </ResponseField>

    <ResponseField name="riskScore" type="number" required>
      Computed AI Vulnerability Scoring System (AIVSS) score, 0–10. Higher
      values indicate greater exploitability and potential impact.
    </ResponseField>

    <ResponseField name="owaspCode" type="string | null" required>
      OWASP LLM Top 10 code where applicable — for example `"LLM01"` for
      prompt injection, `"LLM06"` for sensitive information disclosure.
      `null` when the finding does not map to a specific OWASP category.
    </ResponseField>
  </Expandable>
</ResponseField>

<Tip>
  In CI/CD pipelines, combine `redteamRunId` (returned when you trigger a
  scan) with `severity=CRITICAL` to gate deployments on zero critical
  findings from the latest scan run.
</Tip>