> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List code and secret findings

> Lists code vulnerability and secret findings, up to 100 per page. Filter by repository, scan, state, finding kind, severity or search text; secret_validation_status requires finding_kind=secret. Follow next_cursor with the same filters.

> [tab] CLI Tool
>
> ```bash
> coderabbit api request /security/findings
> ```
>
> To install and sign in to the CLI, see [Call from the CLI](https://docs.coderabbit.ai/api/cli.md).

> [tab] MCP Server
>
> An agent connected to the [CodeRabbit MCP server](https://docs.coderabbit.ai/api/mcp.md) runs this operation as the `list_security_findings` tool. The connection selects the organization, so the arguments have no `org_id` or `org_name`.
>
> ```json
> {
>   "method": "tools/call",
>   "params": {
>     "name": "list_security_findings",
>     "arguments": {}
>   }
> }
> ```


## OpenAPI

````yaml /openapi.json get /v1/security/findings
openapi: 3.0.0
info:
  title: CodeRabbit API
  version: 1.0.0
  description: >-
    Read and manage CodeRabbit reviews, coding tasks, Verify, Triage, security
    findings, Knowledge Base, configuration, and users for your organization.
servers:
  - url: https://api.coderabbit.ai
    description: US region
  - url: https://api.eu.coderabbit.ai
    description: EU region
security:
  - ApiKeyAuth: []
tags:
  - name: Organizations and repositories
  - name: Pull requests and reviews
  - name: Coding Agent
  - name: Coding environments
  - name: Verify
  - name: Triage
  - name: Security
  - name: Knowledge Base
  - name: Automations
  - name: Reports
  - name: Configuration
  - name: Connections
  - name: Users and roles
  - name: Usage and metrics
paths:
  /v1/security/findings:
    get:
      tags:
        - Security
      summary: List code and secret findings
      description: >-
        Lists code vulnerability and secret findings, up to 100 per page. Filter
        by repository, scan, state, finding kind, severity or search text;
        secret_validation_status requires finding_kind=secret. Follow
        next_cursor with the same filters.
      operationId: list_security_findings
      parameters:
        - name: org_id
          in: query
          schema:
            type: string
            minLength: 1
            description: >-
              Organization for a workspace key: the Git-provider organization ID
              (scope.provider_organization_id) or the CodeRabbit organization ID
              (scope.id, or id from list organizations). Supply either org_id or
              org_name, never both. Omit for organization keys and MCP
              connections.
          allowEmptyValue: true
          allowReserved: true
        - name: org_name
          in: query
          schema:
            type: string
            pattern: ^[A-Za-z0-9][A-Za-z0-9-]{0,38}$
            description: >-
              GitHub organization login, such as coderabbitai, not its display
              name. Matched case-insensitively within the authenticated
              workspace. Supply either org_name or org_id, never both; omit for
              organization keys and MCP connections.
          allowEmptyValue: true
          allowReserved: true
        - name: repository_ids
          in: query
          schema:
            type: array
            minItems: 1
            maxItems: 1000
            items:
              type: string
              minLength: 1
              maxLength: 255
          style: form
          explode: true
          allowEmptyValue: true
          allowReserved: true
        - name: scan_id
          in: query
          schema:
            type: string
            format: uuid
          allowEmptyValue: true
          allowReserved: true
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
          allowEmptyValue: true
          allowReserved: true
        - name: cursor
          in: query
          schema:
            type: string
            minLength: 1
            maxLength: 2048
          allowEmptyValue: true
          allowReserved: true
        - name: search
          in: query
          schema:
            type: string
            minLength: 1
            maxLength: 200
          allowEmptyValue: true
          allowReserved: true
        - name: state
          in: query
          schema:
            enum:
              - open
              - fixed
              - dismissed
              - superseded
              - all
            type: string
          allowEmptyValue: true
          allowReserved: true
        - name: finding_kind
          in: query
          schema:
            enum:
              - vulnerability
              - secret
            type: string
          allowEmptyValue: true
          allowReserved: true
        - name: severity
          in: query
          schema:
            type: array
            maxItems: 4
            items:
              type: string
              minLength: 1
              maxLength: 50
          style: form
          explode: true
          allowEmptyValue: true
          allowReserved: true
        - name: secret_validation_status
          in: query
          schema:
            type: array
            maxItems: 3
            items:
              enum:
                - valid
                - invalid
                - unknown
              type: string
          style: form
          explode: true
          allowEmptyValue: true
          allowReserved: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      type: object
                      properties:
                        secretAssessment:
                          type: object
                          properties:
                            policyVersion:
                              enum:
                                - '2026-10-01'
                            scanVerification:
                              type: string
                              maxLength: 32
                            verificationCheckedAt:
                              type: string
                              format: date-time
                            verification:
                              enum:
                                - valid
                                - needs_validation
                                - invalid
                                - revoked
                                - unknown
                                - error
                              type: string
                            detectors:
                              type: array
                              maxItems: 100
                              items:
                                type: string
                                maxLength: 120
                            relatedLocations:
                              type: array
                              maxItems: 100
                              items:
                                type: object
                                properties:
                                  file:
                                    type: string
                                    maxLength: 4096
                                  startLine:
                                    type: integer
                                    minimum: 0
                                    exclusiveMinimum: true
                                  endLine:
                                    type: integer
                                    minimum: 0
                                    exclusiveMinimum: true
                                required:
                                  - file
                                  - startLine
                                  - endLine
                            status:
                              enum:
                                - assessed
                                - unassessed
                              type: string
                            classification:
                              enum:
                                - public_config
                                - synthetic_fixture
                                - private_credential
                                - non_credential
                                - uncertain
                              type: string
                            confidence:
                              enum:
                                - high
                                - medium
                                - low
                              type: string
                            environment:
                              enum:
                                - production
                                - sandbox
                                - unknown
                              type: string
                            impact:
                              enum:
                                - privileged_access
                                - limited_service
                                - unknown
                              type: string
                            reason:
                              enum:
                                - public_provider_role
                                - synthetic_value
                                - private_provider_role
                                - private_key_material
                                - authentication_usage
                                - not_authentication_material
                                - insufficient_context
                                - conflicting_evidence
                              type: string
                            missingEvidence:
                              type: array
                              maxItems: 5
                              items:
                                enum:
                                  - usage
                                  - provider_role
                                  - environment
                                  - permissions
                                  - complete_value
                                type: string
                          required:
                            - policyVersion
                            - status
                            - classification
                            - confidence
                            - environment
                            - impact
                            - reason
                            - missingEvidence
                        id:
                          type: string
                        repoId:
                          type: string
                        repoName:
                          type: string
                        findingKind:
                          enum:
                            - secret
                            - vulnerability
                          type: string
                        category:
                          type: string
                        severity:
                          type: string
                        source:
                          type: string
                        reachability:
                          type: string
                        exploitability:
                          type: string
                        filePath:
                          type: string
                        startLine:
                          type: number
                        endLine:
                          type: number
                        description:
                          type: string
                        recommendation:
                          type: string
                        cwe:
                          anyOf:
                            - type: string
                            - type: string
                              nullable: true
                              enum:
                                - null
                        state:
                          type: string
                        detectedAt:
                          anyOf:
                            - type: string
                            - type: string
                              nullable: true
                              enum:
                                - null
                        fingerprint:
                          anyOf:
                            - type: string
                            - type: string
                              nullable: true
                              enum:
                                - null
                        fixStatus:
                          anyOf:
                            - type: string
                            - type: string
                              nullable: true
                              enum:
                                - null
                        fixTaskId:
                          type: string
                        fixPrUrl:
                          anyOf:
                            - type: string
                            - type: string
                              nullable: true
                              enum:
                                - null
                        verificationSteps:
                          anyOf:
                            - type: string
                            - type: string
                              nullable: true
                              enum:
                                - null
                      required:
                        - id
                        - repoId
                        - repoName
                        - category
                        - severity
                        - source
                        - reachability
                        - exploitability
                        - filePath
                        - startLine
                        - endLine
                        - description
                        - recommendation
                        - cwe
                        - state
                        - detectedAt
                        - fingerprint
                        - fixStatus
                        - fixPrUrl
                        - verificationSteps
                  total:
                    type: number
                  next_cursor:
                    anyOf:
                      - type: string
                      - type: string
                        nullable: true
                        enum:
                          - null
                required:
                  - items
                  - total
                  - next_cursor
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - invalid_request
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - unauthenticated
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - forbidden
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '404':
          description: Not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - not_found
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - head_changed
                          - conflict
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '412':
          description: Precondition failed
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - precondition_failed
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '413':
          description: Content too large
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - payload_too_large
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - rate_limit_exceeded
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        enum:
                          - internal_error
                        type: string
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
        '503':
          description: Service unavailable
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      code:
                        type: string
                        enum:
                          - unavailable
                      message:
                        type: string
                      retry_after:
                        type: integer
                        minimum: 0
                        exclusiveMinimum: true
                    required:
                      - code
                      - message
                    additionalProperties: false
                required:
                  - error
                additionalProperties: false
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-coderabbitai-api-key
      description: >-
        See [Authentication](/api/authentication) for the key types and where to
        create a key.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.