> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get organization security finding detail (browser session) > Returns one CVE finding with its occurrences, a per-cluster breakdown, the disposition policies that match it, the available fix routes and any base-image bump pull requests already opened for it. Requires `security.read`; returns 404 when the finding does not exist. ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /org/security/findings/{finding_id} openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Organisation IAM description: >- Custom organisation roles and scoped role assignments for member and service-account identities. - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: AWS Clusters description: >- Provision and manage self-managed k3s / kubeadm clusters on AWS EC2 in your own VPC. - name: Ankra Cloud Clusters description: >- Provision and manage self-managed kubeadm / k3s clusters on Ankra Cloud servers: a private network, a NAT router and a bastion per cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Pipelines description: Pipeline definitions and the approval of the authority they declare. - name: Backups description: >- Backup vaults, restore points, protection posture and captures for stacks and application deployments; a completed capture is not a verified restore. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Services description: >- Versioned service packages and explicit sharing. Runtime admission is separate from publication. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Management description: >- Customer agent lifecycle, authenticated identity and organisation automation controls. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Remediation description: >- The organisation's auto-remediation policy: what the AI lanes may fix by themselves, and who approves the rest. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Decisions description: >- The decision ledger behind the Security and Cost queues: proposals a surface computed, the approve and set-aside decisions people took on them, and the receipts of running them. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: AWS Credentials description: >- AWS credentials: access keys or CloudFormation-onboarded STS roles for cost, EKS and self-managed provisioning. - name: Ankra Cloud Credentials description: >- Ankra Cloud API tokens, shared by the self-managed and managed Ankra Cloud lanes. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: Object Storage Buckets description: >- Buckets Ankra creates and manages on an organisation's own provider credentials. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. - name: AI Settings description: Organisation AI provider, model catalog and per-function model settings paths: /org/security/findings/{finding_id}: get: tags: - Security summary: Get organization security finding detail (browser session) description: >- Returns one CVE finding with its occurrences, a per-cluster breakdown, the disposition policies that match it, the available fix routes and any base-image bump pull requests already opened for it. Requires `security.read`; returns 404 when the finding does not exist. operationId: get_security_finding parameters: - in: path name: finding_id required: true schema: type: string format: uuid responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityFindingDetailResponse' description: Successful response '400': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Business validation error '403': content: application/json: schema: $ref: '#/components/schemas/SecurityPermissionDenied' description: Permission or CSRF denied '404': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Organization-scoped resource not found '409': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Disposition conflict '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation error '500': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Internal server error components: schemas: SecurityFindingDetailResponse: properties: clusters: items: $ref: '#/components/schemas/SecurityFindingClusterBreakdown' type: array finding: $ref: '#/components/schemas/SecurityFindingSummary' fix_routes: $ref: '#/components/schemas/SecurityFixRoutes' image_rebuild_pull_requests: description: >- The base-image bump pull requests the platform opened on application repositories for this finding (POST .../rebuild), oldest first; empty when none. items: $ref: '#/components/schemas/SecurityImageRebuildPullRequest' type: array matching_policies: items: $ref: '#/components/schemas/VulnerabilityDispositionPolicy' type: array occurrences: items: $ref: '#/components/schemas/SecurityOccurrence' type: array required: - finding - occurrences - matching_policies - clusters - fix_routes - image_rebuild_pull_requests type: object SecurityDetailError: properties: detail: type: string required: - detail type: object SecurityPermissionDenied: properties: detail: enum: - permission_denied type: string permission: type: string scope_type: type: string required: - detail - permission - scope_type type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object SecurityFindingClusterBreakdown: description: >- One cluster's share of a finding: its live workloads and the same four disposition counts the finding row carries. Each column sums across a finding's clusters to the finding's own count; soft-deleted clusters are included because their occurrences stay in those totals. properties: accepted_risk: type: integer acknowledged: type: integer affected_workloads: type: integer cluster_id: type: string format: uuid cluster_name: type: string deleted: description: >- True when the cluster is soft-deleted: its occurrences still count, but no cluster-scoped read (including this finding's occurrence list filtered by cluster_id) will accept it. type: boolean last_seen_at: type: string format: date-time open: type: integer resolved: type: integer required: - cluster_id - cluster_name - deleted - affected_workloads - open - acknowledged - accepted_risk - resolved - last_seen_at type: object SecurityFindingSummary: properties: affected_clusters: type: integer affected_workloads: type: integer cve_id: type: string disposition_counts: $ref: '#/components/schemas/SecurityDispositionCounts' first_seen_at: type: string format: date-time fixable_occurrences: type: integer id: type: string format: uuid last_seen_at: type: string format: date-time occurrences: type: integer package_name: type: string package_type: type: string primary_link: anyOf: - type: string - type: 'null' provider: type: string score: anyOf: - format: double type: number - type: 'null' severity: type: string title: anyOf: - type: string - type: 'null' known_exploited: type: boolean kev_date_added: anyOf: - type: string - type: 'null' kev_due_date: anyOf: - type: string - type: 'null' kev_ransomware_use: type: boolean epss_score: anyOf: - format: double type: number - type: 'null' epss_percentile: anyOf: - format: double type: number - type: 'null' kev_vendor_project: anyOf: - type: string - type: 'null' kev_product: anyOf: - type: string - type: 'null' kev_vulnerability_name: anyOf: - type: string - type: 'null' kev_required_action: anyOf: - type: string - type: 'null' required: - id - provider - cve_id - package_type - package_name - severity - title - primary_link - score - first_seen_at - last_seen_at - occurrences - affected_clusters - affected_workloads - fixable_occurrences - disposition_counts - known_exploited - kev_date_added - kev_due_date - kev_ransomware_use - epss_score - epss_percentile - kev_vendor_project - kev_product - kev_vulnerability_name - kev_required_action type: object SecurityFixRoutes: description: >- How a finding's actionable occurrences (active, not accepted risk) are cleared. An occurrence with a fixed version and a high-confidence add-on attribution is cleared by upgrading that add-on; one with a fixed version and no such attribution by rebuilding its image; one without a fixed version by neither. The three counts sum to the actionable occurrences and the first two to the fixable ones; route is the summary every surface agrees on. properties: addon_upgrade_occurrences: type: integer addons: items: $ref: '#/components/schemas/SecurityFixRouteAddon' type: array image_rebuild_occurrences: type: integer no_fix_occurrences: type: integer route: enum: - addon_upgrade - image_rebuild - mixed - none type: string required: - route - addon_upgrade_occurrences - image_rebuild_occurrences - no_fix_occurrences - addons type: object SecurityImageRebuildPullRequest: description: >- One pull request the platform opened (or reused) on an application repository for a finding. reused describes the execute call that answered it: true when the call found the pull request already open, false when it opened it; on the finding detail, which serves the stored records outside any call, it is null. properties: application_id: type: string format: uuid application_name: type: string base_image: type: string branch: type: string opened_at: type: string format: date-time opened_by: type: string format: uuid nullable: true pull_request_url: type: string repository: type: string reused: nullable: true type: boolean required: - application_id - application_name - repository - base_image - branch - pull_request_url - opened_at - opened_by - reused type: object VulnerabilityDispositionPolicy: properties: active_match_count: type: integer created_at: type: string format: date-time created_by: type: string disposition: enum: - acknowledged - accepted_risk type: string expire_when_fix_available: type: boolean expires_at: anyOf: - type: string format: date-time - type: 'null' fix_available_match_count: type: integer id: type: string format: uuid last_evaluated_at: anyOf: - type: string format: date-time - type: 'null' last_matched_at: anyOf: - type: string format: date-time - type: 'null' match_health: type: string matched_occurrence_count: type: integer reason: type: string revoked_at: anyOf: - type: string format: date-time - type: 'null' revoked_by: anyOf: - type: string - type: 'null' revoked_reason: anyOf: - type: string - type: 'null' selector: $ref: '#/components/schemas/VulnerabilityDispositionSelector' selector_hash: type: string status: type: string updated_at: type: string format: date-time updated_by: type: string required: - id - selector - selector_hash - disposition - reason - expires_at - expire_when_fix_available - created_by - updated_by - status - match_health - matched_occurrence_count - active_match_count - fix_available_match_count - last_evaluated_at - last_matched_at - revoked_at - revoked_by - revoked_reason - created_at - updated_at type: object SecurityOccurrence: properties: addon_attribution_confidence: type: string addon_attribution_reason: type: string addon_slug: anyOf: - type: string - type: 'null' cluster_id: type: string format: uuid cluster_name: type: string container_name: anyOf: - type: string - type: 'null' effective_disposition: type: string effective_policy_id: anyOf: - type: string format: uuid - type: 'null' first_seen_at: type: string format: date-time fixed_version: anyOf: - type: string - type: 'null' id: type: string format: uuid image_digest: anyOf: - type: string - type: 'null' image_ref: anyOf: - type: string - type: 'null' installed_version: anyOf: - type: string - type: 'null' last_evaluated_at: type: string format: date-time last_seen_at: type: string format: date-time report_name: type: string report_namespace: anyOf: - type: string - type: 'null' report_scope: type: string report_uid: anyOf: - type: string - type: 'null' resolved_at: anyOf: - type: string format: date-time - type: 'null' scan_state: type: string workload_kind: anyOf: - type: string - type: 'null' workload_name: anyOf: - type: string - type: 'null' workload_namespace: anyOf: - type: string - type: 'null' workload_uid: anyOf: - type: string - type: 'null' required: - id - cluster_id - cluster_name - report_scope - report_uid - report_name - report_namespace - workload_uid - workload_kind - workload_namespace - workload_name - container_name - image_ref - image_digest - installed_version - fixed_version - addon_slug - addon_attribution_confidence - addon_attribution_reason - scan_state - effective_disposition - effective_policy_id - first_seen_at - last_seen_at - last_evaluated_at - resolved_at type: object ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object SecurityDispositionCounts: properties: accepted_risk: type: integer acknowledged: type: integer open: type: integer resolved: type: integer required: - open - acknowledged - accepted_risk - resolved type: object SecurityFixRouteAddon: description: >- One add-on whose release upgrade clears part of a finding: the actionable fixable occurrences attributed to it with high confidence, and the clusters they sit on. properties: addon_slug: type: string clusters: type: integer occurrences: type: integer required: - addon_slug - occurrences - clusters type: object VulnerabilityDispositionSelector: properties: addon_slug: type: string cluster_id: type: string format: uuid cve_id: type: string explicit_broad: type: boolean image_digest: type: string organisation_id: type: string format: uuid package_name: type: string package_type: type: string workload_kind: type: string workload_name: type: string workload_namespace: type: string required: - organisation_id type: object ````