import requests
url = "https://api.platform.ankra.app/org/security/findings/{finding_id}/occurrences"
headers = {"cookie": "ankra_session="}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {cookie: 'ankra_session='}};
fetch('https://api.platform.ankra.app/org/security/findings/{finding_id}/occurrences', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request GET \
--url https://api.platform.ankra.app/org/security/findings/{finding_id}/occurrences \
--cookie ankra_session={
"pagination": {
"page": 123,
"page_size": 123,
"total_count": 123,
"total_pages": 123
},
"result": [
{
"addon_attribution_confidence": "<string>",
"addon_attribution_reason": "<string>",
"addon_release_name": "<string>",
"addon_slug": "<string>",
"check_id": "<string>",
"cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"cluster_name": "<string>",
"container_name": "<string>",
"effective_disposition": "<string>",
"effective_policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"endpoint_host": "<string>",
"endpoint_port": 123,
"endpoint_scheme": "<string>",
"first_seen_at": "2023-11-07T05:31:56Z",
"fixed_version": "<string>",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"image_digest": "<string>",
"image_ref": "<string>",
"installed_version": "<string>",
"last_evaluated_at": "2023-11-07T05:31:56Z",
"last_seen_at": "2023-11-07T05:31:56Z",
"report_name": "<string>",
"report_namespace": "<string>",
"report_scope": "<string>",
"report_uid": "<string>",
"resolved_at": "2023-11-07T05:31:56Z",
"scan_state": "<string>",
"workload_kind": "<string>",
"workload_name": "<string>",
"workload_namespace": "<string>",
"workload_revision_state": "current",
"workload_uid": "<string>",
"evidence": "<string>",
"references": [
"<string>"
],
"remediation": "<string>"
}
]
}{
"detail": "<string>"
}{
"detail": "permission_denied",
"permission": "<string>",
"scope_type": "<string>"
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}{
"detail": "<string>"
}List organization security finding occurrences (browser session)
Pages one finding’s occurrences by the status predicates its row counts with, so every count on the finding row can be expanded into the rows behind it. Resolved occurrences list newest resolution first; every other status lists in the finding detail’s workload order.
import requests
url = "https://api.platform.ankra.app/org/security/findings/{finding_id}/occurrences"
headers = {"cookie": "ankra_session="}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {cookie: 'ankra_session='}};
fetch('https://api.platform.ankra.app/org/security/findings/{finding_id}/occurrences', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));curl --request GET \
--url https://api.platform.ankra.app/org/security/findings/{finding_id}/occurrences \
--cookie ankra_session={
"pagination": {
"page": 123,
"page_size": 123,
"total_count": 123,
"total_pages": 123
},
"result": [
{
"addon_attribution_confidence": "<string>",
"addon_attribution_reason": "<string>",
"addon_release_name": "<string>",
"addon_slug": "<string>",
"check_id": "<string>",
"cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"cluster_name": "<string>",
"container_name": "<string>",
"effective_disposition": "<string>",
"effective_policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"endpoint_host": "<string>",
"endpoint_port": 123,
"endpoint_scheme": "<string>",
"first_seen_at": "2023-11-07T05:31:56Z",
"fixed_version": "<string>",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"image_digest": "<string>",
"image_ref": "<string>",
"installed_version": "<string>",
"last_evaluated_at": "2023-11-07T05:31:56Z",
"last_seen_at": "2023-11-07T05:31:56Z",
"report_name": "<string>",
"report_namespace": "<string>",
"report_scope": "<string>",
"report_uid": "<string>",
"resolved_at": "2023-11-07T05:31:56Z",
"scan_state": "<string>",
"workload_kind": "<string>",
"workload_name": "<string>",
"workload_namespace": "<string>",
"workload_revision_state": "current",
"workload_uid": "<string>",
"evidence": "<string>",
"references": [
"<string>"
],
"remediation": "<string>"
}
]
}{
"detail": "<string>"
}{
"detail": "permission_denied",
"permission": "<string>",
"scope_type": "<string>"
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>"
}
]
}{
"detail": "<string>"
}Authorizations
Query Parameters
Keep only occurrences in one status, using the same predicates the finding row's disposition_counts are built from: open is active with no disposition, acknowledged and accepted_risk are active with that disposition, resolved is the resolved scan state. Omit it to list every occurrence, live and resolved.
open, acknowledged, accepted_risk, resolved Keep only occurrences whose finding comes from these providers: trivy_operator, node_kernel or samma. A finding has one provider, so naming another answers an empty page; it exists so a client can pass its provider filter through unchanged.
trivy_operator, node_kernel, samma