# GET /api/v1/scan/{scanId}/alert/{pluginId}

**List scan result alert findings**

## List Scan Alert Findings

Get the specific scan findings associated with this scan and plugin.

This endpoint reports details of the Alert that was triggered from a scan, with details on how to address it and the scanned application paths that triggered the alert.

Scan Alerts by plugin return paginated results of the `applicationScanAlertUri`.

### Alert Response

Calling this endpoint with a given `scanId` and `pluginId` returns an `alertResponse` object. This alert contains the paginated `applicationAlertUris`, identifying each path in the scanned host that triggered this alert.

Paginated response of the scan alert and paths associated with this finding.

| Parameter | Default | Description |
|:---:|:---:|:---:|
|alert|{}|The meaningful scan alert _finding_.|
|category|""|The category of this finding.|
|applicationScanAlertUris|[]|Path uris that triggered this alert.|
|cheetsheet|""|external url to an OWASP cheatsheet for reference.|
|appHost|""|The host URI this alert was triggered for.|
|isEachRuleLocked|false|if the scan alert and uris cannot be triaged within the StackHawk Platform.|
|nextPageToken|""|pageToken to provide for the next page of results.|
|totalCount|0|total number of results.|

### Application Alert Uri

Represents a meaningful path-level finding in a scanned application.

| Parameter | Default | Description |
|:---:|:---:|:---:|
|scan|{}|The underlying scan this application alert URI was found in.|
|pluginId|""|The id of the StackHawk/ZAP plugin that triggered this alert application alert URI.|
|uri|""|The URI of the path in the scanned application.|
|msgId|""|A unique identifier of the individual request/response pair that triggered this Alert.|
|requestMethod|""|The HTTP method used to find this path.|
|status|"UNKNOWN"|The Triaged status of this application alert.|
|matchedRuleNote|""|Message from the last time this alert was triaged.|
|matchedRuleLastUpdated|0|Timestamp of the last time this alert was updated.|
|appUriId|""|Unique identifier for this app x uri|
|alertUriId|""|Unique identifier for this alert x uri|
|matchedRuleUserId|""|The last user who triaged this alert.|
|ruleHistories|[]|The triage history of this application alert.|
|statusLink|""|Optional URL of external promotion tool linked to triaged alert.|
|findingHash|""|The SHA-256 finding hash — a stable identifier for this finding across scans.|

See the [Scan Results Analysis](https://apidocs.stackhawk.com/docs/scan-results-analysis) guide for further details on how to use these endpoints.

> Requires `read:scan` permission.

## Parameters

- `scanId` (in: path, string<uuid>) *(required)* — UUID identifier for this StackHawk Scan.
- `pluginId` (in: path, string) *(required)* — Identifier for the Plugin.
- `pageSize` (in: query, integer<int32>) — Pagination response size limit. A page size greater than 100 will be automatically reduced to 100 items.
- `pageToken` (in: query, integer<int32>) — Pagination request page increment.

## Responses

### 200 — Paginated response of the scan alert and paths associated with this finding.

#### application/json

- `alert` (application.ApplicationAlert)
  - `alertStatusStats` (application.AlertStatusStats[]) — Statistical snapshot of alerts by status.
    - `alertStatus` (string) — Triage status of this scan alert.
    - `severityStats` (object) — A map of finding counts by severity ("High" "Medium" "Low")
    - `totalCount` (integer<int32>) — Total number of findings on paths
  - `cweId` (string) — The cwe id of this alert.
  - `description` (string) — A markdown flavored description of this alert.
  - `externalAlertsResult` (sast.ExternalAlertsResult[]) — External findings associated with this alert.
    - `externalAlerts` (sast.ExternalAlert[])
      - `codeRegion` (sast.CodeRegion)
        - `endColumn` (integer<int32>)
        - `endLine` (integer<int32>)
        - `startColumn` (integer<int32>)
        - `startLine` (integer<int32>)
      - `codeSnippet` (sast.CodeSnippet)
        - `lines` (sast.CodeLine[])
      - `cweId` (string)
      - `description` (string)
      - `filePath` (string)
      - `fileUrl` (string)
      - `id` (string)
      - `integrationType` (string)
      - `issueUrl` (string)
      - `origin` (string)
      - `severity` (string)
      - `title` (string)
    - `integrationType` (string)
    - `isAllExternalAlerts` (boolean)
    - `projectUrl` (string)
  - `name` (string) — The name of the Zap plugin this alert triggered for.
  - `pluginId` (string) — The id of the Zap plugin that triggered this alert.
  - `references` (string[]) — External urls and study references to understand this findings.
  - `requestMethod` (string) — **Deprecated** - 4/25/22
  - `scan` (scanresults.Scan)
    - `applicationId` (string) — the UUID applicationId corresponding to the scanned application
    - `applicationName` (string) — the name of the corresponding scanned application
    - `env` (string) — the name of the scanned environment
    - `envId` (string) — the UUID environmentId corresponding to the scanned environment
    - `externalUserId` (string) — the UUID identifier of the StackHawk user that started this scan
    - `hawkScanType` (string) — The type of HawkScan execution (traditional, hosted, etc.)
    - `id` (string) — the UUID identifier of this scan
    - `metadata` (scanresults.MetaData)
      - `tags` (object)
    - `parentScanId` (string) — If this scan is a result of a retest, this is the id of the scan it retested
    - `repoId` (string) — a hash of the scanned repo git name
    - `status` (string) — the current state of the running scan (STARTED / COMPLETED / ERROR)
    - `timestamp` (integer<int64>) — seconds since unix epoch timestamp of when the scan was started
    - `version` (string) — the version of HawkScan used to scan this application
  - `severity` (string) — The severity of this finding. One of "High" "Medium" or "Low".
  - `uriCount` (integer<int32>) — The number of scanned urls that report this alert.
- `appHost` (string) — The host URI this alert was triggered for.
- `applicationScanAlertUris` (application.ApplicationAlertUri[]) — Path uris that triggered this alert.
  - `alertUriId` (string) — Unique identifier for this alert x uri
  - `appUriId` (string) — Unique identifier for this app x uri
  - `findingHash` (string) — The SHA-256 finding hash — a stable identifier for this finding across scans.
  - `matchedRuleLastUpdated` (integer<int64>) — Timestamp of the last time this alert was updated.
  - `matchedRuleNote` (string) — Message from the last time this alert was triaged.
  - `matchedRuleUserId` (string) — The last user who triaged this alert.
  - `msgId` (string) — A unique identifier of the individual request/response pair that triggered this Alert.
  - `pluginId` (string) — The id of the StackHawk/ZAP plugin that triggered this alert application alert URI.
  - `requestMethod` (string) — The HTTP method used to find this path.
  - `ruleHistories` (application.AlertRuleHistory[]) — The triage history of this application alert.
    - `newResult` (string)
    - `note` (string)
    - `oldResult` (string)
    - `operation` (string)
    - `ruleEffectiveDate` (integer<int64>)
    - `timestamp` (integer<int64>)
    - `userId` (string)
  - `scan` (scanresults.Scan)
    - `applicationId` (string) — the UUID applicationId corresponding to the scanned application
    - `applicationName` (string) — the name of the corresponding scanned application
    - `env` (string) — the name of the scanned environment
    - `envId` (string) — the UUID environmentId corresponding to the scanned environment
    - `externalUserId` (string) — the UUID identifier of the StackHawk user that started this scan
    - `hawkScanType` (string) — The type of HawkScan execution (traditional, hosted, etc.)
    - `id` (string) — the UUID identifier of this scan
    - `metadata` (scanresults.MetaData)
      - `tags` (object)
    - `parentScanId` (string) — If this scan is a result of a retest, this is the id of the scan it retested
    - `repoId` (string) — a hash of the scanned repo git name
    - `status` (string) — the current state of the running scan (STARTED / COMPLETED / ERROR)
    - `timestamp` (integer<int64>) — seconds since unix epoch timestamp of when the scan was started
    - `version` (string) — the version of HawkScan used to scan this application
  - `status` (string) — The Triaged status of this application alert.
  - `statusLink` (string) — Optional URL of external promotion tool linked to triaged alert.
  - `uri` (string) — The URI of the path in the scanned application.
- `category` (string) — The category of this finding.
- `cheetsheet` (string) — external url to an OWASP cheatsheet for reference.
- `isEachRuleLocked` (boolean) — if the scan alert and uris cannot be triaged within the StackHawk Platform.
- `nextPageToken` (string) — pageToken to provide for the next page of results.
- `totalCount` (integer<int64>) — total number of results.

#### application/x-protobuf

- `alert` (application.ApplicationAlert)
  - `alertStatusStats` (application.AlertStatusStats[]) — Statistical snapshot of alerts by status.
    - `alertStatus` (string) — Triage status of this scan alert.
    - `severityStats` (object) — A map of finding counts by severity ("High" "Medium" "Low")
    - `totalCount` (integer<int32>) — Total number of findings on paths
  - `cweId` (string) — The cwe id of this alert.
  - `description` (string) — A markdown flavored description of this alert.
  - `externalAlertsResult` (sast.ExternalAlertsResult[]) — External findings associated with this alert.
    - `externalAlerts` (sast.ExternalAlert[])
      - `codeRegion` (sast.CodeRegion)
        - `endColumn` (integer<int32>)
        - `endLine` (integer<int32>)
        - `startColumn` (integer<int32>)
        - `startLine` (integer<int32>)
      - `codeSnippet` (sast.CodeSnippet)
        - `lines` (sast.CodeLine[])
      - `cweId` (string)
      - `description` (string)
      - `filePath` (string)
      - `fileUrl` (string)
      - `id` (string)
      - `integrationType` (string)
      - `issueUrl` (string)
      - `origin` (string)
      - `severity` (string)
      - `title` (string)
    - `integrationType` (string)
    - `isAllExternalAlerts` (boolean)
    - `projectUrl` (string)
  - `name` (string) — The name of the Zap plugin this alert triggered for.
  - `pluginId` (string) — The id of the Zap plugin that triggered this alert.
  - `references` (string[]) — External urls and study references to understand this findings.
  - `requestMethod` (string) — **Deprecated** - 4/25/22
  - `scan` (scanresults.Scan)
    - `applicationId` (string) — the UUID applicationId corresponding to the scanned application
    - `applicationName` (string) — the name of the corresponding scanned application
    - `env` (string) — the name of the scanned environment
    - `envId` (string) — the UUID environmentId corresponding to the scanned environment
    - `externalUserId` (string) — the UUID identifier of the StackHawk user that started this scan
    - `hawkScanType` (string) — The type of HawkScan execution (traditional, hosted, etc.)
    - `id` (string) — the UUID identifier of this scan
    - `metadata` (scanresults.MetaData)
      - `tags` (object)
    - `parentScanId` (string) — If this scan is a result of a retest, this is the id of the scan it retested
    - `repoId` (string) — a hash of the scanned repo git name
    - `status` (string) — the current state of the running scan (STARTED / COMPLETED / ERROR)
    - `timestamp` (integer<int64>) — seconds since unix epoch timestamp of when the scan was started
    - `version` (string) — the version of HawkScan used to scan this application
  - `severity` (string) — The severity of this finding. One of "High" "Medium" or "Low".
  - `uriCount` (integer<int32>) — The number of scanned urls that report this alert.
- `appHost` (string) — The host URI this alert was triggered for.
- `applicationScanAlertUris` (application.ApplicationAlertUri[]) — Path uris that triggered this alert.
  - `alertUriId` (string) — Unique identifier for this alert x uri
  - `appUriId` (string) — Unique identifier for this app x uri
  - `findingHash` (string) — The SHA-256 finding hash — a stable identifier for this finding across scans.
  - `matchedRuleLastUpdated` (integer<int64>) — Timestamp of the last time this alert was updated.
  - `matchedRuleNote` (string) — Message from the last time this alert was triaged.
  - `matchedRuleUserId` (string) — The last user who triaged this alert.
  - `msgId` (string) — A unique identifier of the individual request/response pair that triggered this Alert.
  - `pluginId` (string) — The id of the StackHawk/ZAP plugin that triggered this alert application alert URI.
  - `requestMethod` (string) — The HTTP method used to find this path.
  - `ruleHistories` (application.AlertRuleHistory[]) — The triage history of this application alert.
    - `newResult` (string)
    - `note` (string)
    - `oldResult` (string)
    - `operation` (string)
    - `ruleEffectiveDate` (integer<int64>)
    - `timestamp` (integer<int64>)
    - `userId` (string)
  - `scan` (scanresults.Scan)
    - `applicationId` (string) — the UUID applicationId corresponding to the scanned application
    - `applicationName` (string) — the name of the corresponding scanned application
    - `env` (string) — the name of the scanned environment
    - `envId` (string) — the UUID environmentId corresponding to the scanned environment
    - `externalUserId` (string) — the UUID identifier of the StackHawk user that started this scan
    - `hawkScanType` (string) — The type of HawkScan execution (traditional, hosted, etc.)
    - `id` (string) — the UUID identifier of this scan
    - `metadata` (scanresults.MetaData)
      - `tags` (object)
    - `parentScanId` (string) — If this scan is a result of a retest, this is the id of the scan it retested
    - `repoId` (string) — a hash of the scanned repo git name
    - `status` (string) — the current state of the running scan (STARTED / COMPLETED / ERROR)
    - `timestamp` (integer<int64>) — seconds since unix epoch timestamp of when the scan was started
    - `version` (string) — the version of HawkScan used to scan this application
  - `status` (string) — The Triaged status of this application alert.
  - `statusLink` (string) — Optional URL of external promotion tool linked to triaged alert.
  - `uri` (string) — The URI of the path in the scanned application.
- `category` (string) — The category of this finding.
- `cheetsheet` (string) — external url to an OWASP cheatsheet for reference.
- `isEachRuleLocked` (boolean) — if the scan alert and uris cannot be triaged within the StackHawk Platform.
- `nextPageToken` (string) — pageToken to provide for the next page of results.
- `totalCount` (integer<int64>) — total number of results.

### 401 — Unauthorized

- (no body)