List organization security finding occurrences (bearer twin)

Pages one finding’s occurrences by the status predicates its row counts with, so every count on the finding row can be expanded into the rows behind it. Resolved occurrences list newest resolution first; every other status lists in the finding detail’s workload order.

GET /api/v1/org/security/findings/{finding_id}/occurrences

List organization security finding occurrences (bearer twin)

Python

import requests

url = "https://platform.ankra.app/api/v1/org/security/findings/{finding_id}/occurrences"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

200

{
  "pagination": {
    "page": 123,
    "page_size": 123,
    "total_count": 123,
    "total_pages": 123
  },
  "result": [
    {
      "addon_attribution_confidence": "<string>",
      "addon_attribution_reason": "<string>",
      "addon_slug": "<string>",
      "cluster_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "cluster_name": "<string>",
      "container_name": "<string>",
      "effective_disposition": "<string>",
      "effective_policy_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "first_seen_at": "2023-11-07T05:31:56Z",
      "fixed_version": "<string>",
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "image_digest": "<string>",
      "image_ref": "<string>",
      "installed_version": "<string>",
      "last_evaluated_at": "2023-11-07T05:31:56Z",
      "last_seen_at": "2023-11-07T05:31:56Z",
      "report_name": "<string>",
      "report_namespace": "<string>",
      "report_scope": "<string>",
      "report_uid": "<string>",
      "resolved_at": "2023-11-07T05:31:56Z",
      "scan_state": "<string>",
      "workload_kind": "<string>",
      "workload_name": "<string>",
      "workload_namespace": "<string>",
      "workload_uid": "<string>"
    }
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

authorization · string | null

x-ankra-organisation-id · string | null

Path Parameters

finding_id · string<uuid> · required

Query Parameters

page · integer · default: 1

Required range: 1 <= x <= 10000

page_size · integer · default: 50

Values above 100 are clamped to 100.

Required range: x >= 1

status · enum<string>

Keep only occurrences in one status, using the same predicates the finding row's disposition_counts are built from: open is active with no disposition, acknowledged and accepted_risk are active with that disposition, resolved is the resolved scan state. Omit it to list every occurrence, live and resolved.

Available options: open, acknowledged, accepted_risk, resolved

cluster_id · string<uuid>

Keep only occurrences observed on this cluster.

Response

200

application/json

Successful response

pagination · object · required

Show child attributes

result · object[] · required

Show child attributes