Get organization security finding detail

Returns one CVE finding with its occurrences, a per-cluster breakdown, the disposition policies that match it, the available fix routes and any base-image bump pull requests already opened for it. Requires security.read; returns 404 when the finding does not exist.

GET /api/v1/org/security/findings/{finding_id}

Get organization security finding detail

Python

import requests

url = "https://platform.ankra.app/api/v1/org/security/findings/{finding_id}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

200

{
  "clusters": [
    {
      "accepted_risk": 123,
      "acknowledged": 123,
      "affected_workloads": 123,
      "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "cluster_name": "<string>",
      "deleted": true,
      "last_seen_at": "2023-11-07T05:31:56Z",
      "open": 123,
      "resolved": 123
    }
  ],
  "finding": {
    "affected_clusters": 123,
    "affected_workloads": 123,
    "cve_id": "<string>",
    "disposition_counts": {
      "accepted_risk": 123,
      "acknowledged": 123,
      "open": 123,
      "resolved": 123
    },
    "first_seen_at": "2023-11-07T05:31:56Z",
    "fixable_occurrences": 123,
    "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "last_seen_at": "2023-11-07T05:31:56Z",
    "occurrences": 123,
    "package_name": "<string>",
    "package_type": "<string>",
    "primary_link": "<string>",
    "provider": "<string>",
    "score": 123,
    "severity": "<string>",
    "title": "<string>",
    "known_exploited": true,
    "kev_date_added": "<string>",
    "kev_due_date": "<string>",
    "kev_ransomware_use": true,
    "epss_score": 123,
    "epss_percentile": 123,
    "kev_vendor_project": "<string>",
    "kev_product": "<string>",
    "kev_vulnerability_name": "<string>",
    "kev_required_action": "<string>"
  },
  "fix_routes": {
    "addon_upgrade_occurrences": 123,
    "addons": [
      {
        "addon_slug": "<string>",
        "clusters": 123,
        "named_clusters": [
          {
            "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
            "cluster_name": "<string>"
          }
        ],
        "occurrences": 123,
        "target_chart_version": "<string>",
        "target_scanned_at": "2023-11-07T05:31:56Z",
        "target_verdict": "fixes",
        "target_verdict_reason": "<string>"
      }
    ],
    "image_rebuild_occurrences": 123,
    "no_fix_occurrences": 123,
    "platform_occurrences": 123,
    "route": "addon_upgrade"
  },
  "image_rebuild_pull_requests": [
    {
      "application_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "application_name": "<string>",
      "base_image": "<string>",
      "branch": "<string>",
      "opened_at": "2023-11-07T05:31:56Z",
      "opened_by": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "pull_request_url": "<string>",
      "repository": "<string>",
      "reused": true
    }
  ],
  "matching_policies": [
    {
      "active_match_count": 123,
      "created_at": "2023-11-07T05:31:56Z",
      "created_by": "<string>",
      "disposition": "acknowledged",
      "expire_when_fix_available": true,
      "expires_at": "2023-11-07T05:31:56Z",
      "fix_available_match_count": 123,
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "last_evaluated_at": "2023-11-07T05:31:56Z",
      "last_matched_at": "2023-11-07T05:31:56Z",
      "match_health": "<string>",
      "matched_occurrence_count": 123,
      "reason": "<string>",
      "revoked_at": "2023-11-07T05:31:56Z",
      "revoked_by": "<string>",
      "revoked_reason": "<string>",
      "selector": {
        "organisation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "addon_slug": "<string>",
        "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "cve_id": "<string>",
        "explicit_broad": true,
        "image_digest": "<string>",
        "package_name": "<string>",
        "package_type": "<string>",
        "workload_kind": "<string>",
        "workload_name": "<string>",
        "workload_namespace": "<string>"
      },
      "selector_hash": "<string>",
      "status": "<string>",
      "updated_at": "2023-11-07T05:31:56Z",
      "updated_by": "<string>"
    }
  ],
  "occurrences": [
    {
      "addon_attribution_confidence": "<string>",
      "addon_attribution_reason": "<string>",
      "addon_slug": "<string>",
      "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "cluster_name": "<string>",
      "container_name": "<string>",
      "effective_disposition": "<string>",
      "effective_policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "first_seen_at": "2023-11-07T05:31:56Z",
      "fixed_version": "<string>",
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "image_digest": "<string>",
      "image_ref": "<string>",
      "installed_version": "<string>",
      "last_evaluated_at": "2023-11-07T05:31:56Z",
      "last_seen_at": "2023-11-07T05:31:56Z",
      "report_name": "<string>",
      "report_namespace": "<string>",
      "report_scope": "<string>",
      "report_uid": "<string>",
      "resolved_at": "2023-11-07T05:31:56Z",
      "scan_state": "<string>",
      "workload_kind": "<string>",
      "workload_name": "<string>",
      "workload_namespace": "<string>",
      "workload_uid": "<string>"
    }
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Path Parameters

finding_id · string<uuid> · required

Response

200

application/json

Successful response

clusters · object[] · required

Show child attributes

finding · object · required

Show child attributes

fix_routes · object · required

How a finding's actionable occurrences (active, not accepted risk) are cleared. An occurrence with a fixed version and a high-confidence add-on attribution is cleared by upgrading that add-on; one with a fixed version on a platform component the cluster builders installed (a cloud provider's controller manager or CSI driver the add-on catalogue does not list) by upgrading that component's chart; one with a fixed version and neither by rebuilding its image; one without a fixed version by none of them. The four counts sum to the actionable occurrences and the first three to the fixable ones; route is the summary every surface agrees on, mixed when more than one route has occurrences.

Show child attributes

image_rebuild_pull_requests · object[] · required

The base-image bump pull requests the platform opened on application repositories for this finding (POST .../rebuild), oldest first; empty when none.

Show child attributes

matching_policies · object[] · required

Show child attributes

occurrences · object[] · required

Show child attributes