GetCodeFinding
Retrieves the current state and details of a finding.
Request Syntax
GET /environments/environmentId/code-findings/findingId HTTP/1.1
URI Request Parameters
The request uses the following URI parameters.
- environmentId
-
The identifier of the environment.
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern:
[a-z0-9]+Required: Yes
- findingId
-
The identifier of the finding.
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern:
[a-z0-9]+Required: Yes
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
Content-type: application/json
{
"affectedPackages": [
{
"fixedInVersion": "string",
"name": "string",
"packageManager": "string",
"version": "string"
}
],
"category": "string",
"completedAt": "string",
"createdAt": "string",
"createdIssueId": "string",
"cveId": "string",
"cvssBaseScore": number,
"cweIds": [ "string" ],
"detailedDescription": "string",
"discardReason": "string",
"discardReasoning": "string",
"duplicateOfIssueId": "string",
"endLine": number,
"environmentId": "string",
"filePath": "string",
"findingArn": "string",
"findingId": "string",
"findingTypes": [ "string" ],
"firstSeenAt": "string",
"lineNumber": number,
"mitigation": "string",
"mitreTechniques": [ "string" ],
"ocsfClass": "string",
"ocsfSchemaVersion": "string",
"owaspCategory": "string",
"posture": {
"application": "string",
"applicationUid": "string",
"applicationVersion": "string",
"checks": [
{
"description": "string",
"name": "string",
"uid": "string"
}
],
"control": "string",
"description": "string",
"remediation": "string",
"remediationReferences": [ "string" ],
"requirements": [ "string" ],
"standards": [ "string" ],
"status": "string",
"statusId": number
},
"productName": "string",
"productVendorName": "string",
"productVersion": "string",
"relevantInputs": [ "string" ],
"remediationReferences": [ "string" ],
"reportedAt": "string",
"resources": [
{
"name": "string",
"region": "string",
"type": "string",
"uid": "string"
}
],
"scanRunId": "string",
"severity": "string",
"source": "string",
"sourceFindingId": "string",
"sourceStatus": "string",
"sourceStatusId": number,
"status": "string",
"statusMessage": "string",
"statusUpdatedAt": "string",
"stepsToReproduce": [ "string" ],
"subCategory": "string",
"summary": "string",
"title": "string",
"type": "string",
"validation": {
"blockingReason": "string",
"confidence": number,
"evidence": [
{
"file": "string",
"line": number,
"snippet": "string"
}
],
"mitigatingControls": [ "string" ],
"preconditions": [ "string" ],
"rationale": "string",
"severityAdjustment": "string",
"verdict": "string"
},
"vulnerabilities": [
{
"additionalCweIds": [ "string" ],
"affectedPackages": [
{
"fixedInVersion": "string",
"name": "string",
"packageManager": "string",
"version": "string"
}
],
"code": "string",
"cveId": "string",
"cvssBaseScore": number,
"cweCaption": "string",
"cweId": "string",
"description": "string",
"details": "string",
"fixCoverage": "string",
"fixCoverageId": number,
"locations": [
{
"endLine": number,
"filePath": "string",
"startLine": number
}
],
"remediation": "string",
"remediationReferences": [ "string" ],
"title": "string"
}
],
"vulnerableCode": "string"
}Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
- affectedPackages
-
The affected Packages.
Type: Array of AffectedPackage objects
Array Members: Minimum number of 0 items. Maximum number of 256 items.
- category
-
The category.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
- completedAt
-
The completed At.
Type: Timestamp
- createdAt
-
The timestamp when the resource was created.
Type: Timestamp
- createdIssueId
-
The identifier of the created Issue.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern:
[a-z0-9]+ - cveId
-
The identifier of the cve.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
- cvssBaseScore
-
The cvss Base Score.
Type: Double
- cweIds
-
The cwe Ids.
Type: Array of strings
Array Members: Minimum number of 0 items. Maximum number of 64 items.
Length Constraints: Minimum length of 1. Maximum length of 64.
- detailedDescription
-
The detailed Description.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 65536.
- discardReason
-
Why a finding was not escalated into an issue. Present only when status is DISCARDED.
Type: String
Valid Values:
SCANNER_VALIDATED_FALSE_POSITIVE | SCANNER_NEEDS_REVIEW | FALSE_POSITIVE_VALIDATED_AGAINST_CONTEXT | DUPLICATE_OF_OPEN_ISSUE | DUPLICATE_OF_CLOSED_ISSUE | COMPENSATING_CONTROL_PRESENT | OUT_OF_SCOPE | INSUFFICIENT_EVIDENCE | PROCESSING_FAILED | SOURCE_REPO_NOT_FOUND - discardReasoning
-
The discard Reasoning.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 1024.
- duplicateOfIssueId
-
The identifier of the duplicate Of Issue.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern:
[a-z0-9]+ - endLine
-
The end Line.
Type: Integer
- environmentId
-
The identifier of the environment.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern:
[a-z0-9]+ - filePath
-
The file Path.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 4096.
- findingArn
-
The Amazon Resource Name (ARN) of the finding.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 1011.
Pattern:
arn:[a-z0-9-]+:continuum:[a-z0-9-]+:[0-9]{12}:environments/[a-z0-9]+/code-findings/[a-z0-9]+ - findingId
-
The identifier of the finding.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern:
[a-z0-9]+ - findingTypes
-
The finding Types.
Type: Array of strings
Array Members: Minimum number of 0 items. Maximum number of 256 items.
Length Constraints: Minimum length of 1. Maximum length of 8192.
- firstSeenAt
-
The first Seen At.
Type: Timestamp
- lineNumber
-
The line Number.
Type: Integer
- mitigation
-
The mitigation.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 65536.
- mitreTechniques
-
The mitre Techniques.
Type: Array of strings
Array Members: Minimum number of 0 items. Maximum number of 256 items.
Length Constraints: Minimum length of 1. Maximum length of 8192.
- ocsfClass
-
The ocsf Class.
Type: String
Valid Values:
VULNERABILITY_FINDING | APPLICATION_SECURITY_POSTURE_FINDING - ocsfSchemaVersion
-
The ocsf Schema Version.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
- owaspCategory
-
The owasp Category.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
- posture
-
The compliance posture a finding reports, for the Application Security Posture Finding class. Absent for a vulnerability finding.
Type: FindingPosture object
- productName
-
The product Name.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
- productVendorName
-
The product Vendor Name.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
- productVersion
-
The product Version.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
- relevantInputs
-
The relevant Inputs.
Type: Array of strings
Array Members: Minimum number of 0 items. Maximum number of 256 items.
Length Constraints: Minimum length of 1. Maximum length of 8192.
- remediationReferences
-
The remediation References.
Type: Array of strings
Array Members: Minimum number of 0 items. Maximum number of 256 items.
Length Constraints: Minimum length of 1. Maximum length of 8192.
- reportedAt
-
The reported At.
Type: Timestamp
- resources
-
The resources.
Type: Array of FindingResource objects
Array Members: Minimum number of 0 items. Maximum number of 256 items.
- scanRunId
-
The identifier of the scan Run.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 64.
Pattern:
[a-z0-9]+ - severity
-
The severity.
Type: String
Valid Values:
UNKNOWN | INFORMATIONAL | LOW | MEDIUM | HIGH | CRITICAL | FATAL | OTHER - source
-
The source.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 256.
- sourceFindingId
-
The identifier of the source Finding.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 1024.
- sourceStatus
-
The source Status.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
- sourceStatusId
-
The identifier of the source Status.
Type: Integer
- status
-
The lifecycle status of a finding as it moves through Continuum's processing pipeline. CONFIRMED and DISCARDED are terminal states — a CONFIRMED finding is promoted into a separate Issue (not yet implemented), which owns the subsequent remediation lifecycle; the finding's own status does not change after that.
Type: String
Valid Values:
SUBMITTED | VALIDATING | CONFIRMED | DISCARDED - statusMessage
-
The status Message.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 1024.
- statusUpdatedAt
-
The status Updated At.
Type: Timestamp
- stepsToReproduce
-
The steps To Reproduce.
Type: Array of strings
Array Members: Minimum number of 0 items. Maximum number of 256 items.
Length Constraints: Minimum length of 1. Maximum length of 8192.
- subCategory
-
The sub Category.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 512.
- summary
-
The summary.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 65536.
- title
-
The title.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 2048.
- type
-
What kind of finding this is, and who produced it.
Type: String
Valid Values:
CONTINUUM_CODE_VULN | CUSTOMER_CODE_VULN - validation
-
A validator's assessment of a finding. Present only when validation actually ran — absent for finding types that are ingested untested, rather than reporting a verdict Continuum did not reach.
Type: FindingValidation object
- vulnerabilities
-
The vulnerabilities.
Type: Array of FindingVulnerability objects
Array Members: Minimum number of 0 items. Maximum number of 256 items.
- vulnerableCode
-
The vulnerable Code.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 32768.
Errors
For information about the errors that are common to all actions, see Common Error Types.
- AccessDeniedException
-
The request is not authorized. Verify that your credentials and request signature are valid and that you have permission to perform this action.
HTTP Status Code: 403
- InternalServerException
-
The request couldn't be processed because of an internal server issue. Try again later. If the problem persists, contact AWS Support.
HTTP Status Code: 500
- ResourceNotFoundException
-
The specified resource was not found. Verify that the resource identifier is correct and that the resource exists.
HTTP Status Code: 404
- ThrottlingException
-
The request was denied due to request throttling.
HTTP Status Code: 429
- ValidationException
-
The request failed to satisfy the constraints specified by AWS Continuum. Correct the fields identified in the error and retry the request.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
