> ## Documentation Index > Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a finding > Create a finding. Regular human tokens and purposeless customer automation tokens may create drafts but cannot publish; platform-minted agent-run tokens, verified super-admins, and scoped pentesters may publish. Accepts optional `sourceAgentName` provenance for agent-authored drafts. ## OpenAPI ````yaml /api-reference/openapi.json post /api/v1/orgs/{orgSlug}/findings openapi: 3.0.3 info: title: Tolmo API version: 1.0.0 description: >- The Tolmo REST API. Every endpoint is scoped to one organization and authenticated with an API token. servers: - url: https://api.tolmo.com description: Production security: - bearerAuth: [] paths: /api/v1/orgs/{orgSlug}/findings: post: tags: - findings summary: Create a finding description: >- Create a finding. Regular human tokens and purposeless customer automation tokens may create drafts but cannot publish; platform-minted agent-run tokens, verified super-admins, and scoped pentesters may publish. Accepts optional `sourceAgentName` provenance for agent-authored drafts. operationId: createFinding parameters: - schema: type: string in: path name: orgSlug required: true requestBody: required: true content: application/json: schema: type: array items: type: object properties: title: type: string minLength: 1 maxLength: 512 severity: type: string enum: - critical - high - medium - low - info description: type: string resourceName: nullable: true type: string maxLength: 512 resourceKey: nullable: true type: string maxLength: 2048 resourceType: nullable: true type: string maxLength: 128 resourceArn: nullable: true type: string maxLength: 2048 targetUrl: nullable: true type: string maxLength: 2048 category: nullable: true type: string maxLength: 48 tags: default: [] maxItems: 24 type: array items: type: string maxLength: 48 cwe: nullable: true type: string maxLength: 16 sourceAgentName: nullable: true type: string maxLength: 128 sourceName: default: Tolmo type: string maxLength: 256 workflowRunId: nullable: true type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ modusOperandi: nullable: true type: string visibility: default: published type: string enum: - draft - published status: default: open type: string enum: - open - in_review - closed - acknowledged - false_positive - canceled required: - title - severity - description responses: '200': description: Default Response content: application/json: schema: type: array items: type: object properties: id: type: string orgId: type: string agentId: nullable: true type: string sourceAgentName: nullable: true type: string isManual: type: boolean shownVerbatim: type: boolean severity: type: string title: type: string description: type: string resourceType: nullable: true type: string resourceName: nullable: true type: string resourceArn: nullable: true type: string resourceKey: nullable: true type: string targetUrl: nullable: true type: string category: nullable: true type: string tags: type: array items: type: string cwe: nullable: true type: string owasp: nullable: true type: string status: type: string visibility: type: string taskIds: {} tickets: type: array items: type: object properties: id: type: string provider: type: string integrationId: nullable: true type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ accountAlias: nullable: true type: string externalId: type: string identifier: type: string url: type: string createdAt: type: string syncStatus: nullable: true type: string enum: - syncing - synced - needs_attention syncError: nullable: true type: string syncedAt: nullable: true type: string required: - id - provider - integrationId - accountAlias - externalId - identifier - url - createdAt - syncStatus - syncError - syncedAt additionalProperties: false acknowledgedAt: nullable: true type: string acknowledgedBy: nullable: true type: string falsePositiveReason: nullable: true type: string closedReason: nullable: true type: string sourceName: type: string ingestionStatus: nullable: true type: string ingestedAt: nullable: true type: string createdAt: type: string updatedAt: type: string attachmentCount: type: integer minimum: 0 maximum: 9007199254740991 sourceSecret: nullable: true type: object properties: secretFindingId: type: string ruleId: type: string verificationState: type: string isActive: nullable: true type: boolean activeLastSeenAt: nullable: true type: string lastValidatedAt: nullable: true type: string validationMethod: nullable: true type: string required: - secretFindingId - ruleId - verificationState - isActive - activeLastSeenAt - lastValidatedAt - validationMethod additionalProperties: false required: - id - orgId - agentId - sourceAgentName - isManual - shownVerbatim - severity - title - description - resourceType - resourceName - resourceArn - resourceKey - targetUrl - category - tags - cwe - owasp - status - visibility - taskIds - tickets - acknowledgedAt - acknowledgedBy - falsePositiveReason - closedReason - sourceName - ingestionStatus - ingestedAt - createdAt - updatedAt additionalProperties: false '403': description: Default Response content: application/json: schema: $ref: '#/components/schemas/HttpError' components: schemas: HttpError: type: object properties: statusCode: type: number code: type: string error: type: string message: type: string title: HttpError securitySchemes: bearerAuth: type: http scheme: bearer description: >- A Tolmo API token, sent as `Authorization: Bearer `. Either a user token (`usr_tok.*`, minted by `tolmo auth login`, scoped to your own permissions) or an org API token created in the Tolmo app, for CI and automation. ````