> ## Documentation Index > Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt > Use this file to discover all available pages before exploring further. # List findings > List every finding in the organization — Tolmo-authored and third-party scanner rows — from the unified findings read. Filter with origin=tolmo for Tolmo-authored rows only. The lean catalog (source/agent facets, idsOnly) lives at GET /findings/catalog. ## OpenAPI ````yaml /api-reference/openapi.json get /api/v1/orgs/{orgSlug}/findings openapi: 3.0.3 info: title: Tolmo API version: 1.0.0 description: >- The Tolmo REST API. Use an organization API key for automation or a CLI user token for user-authenticated operations. Most endpoints are scoped to one organization. servers: - url: https://api.tolmo.com description: Production security: [] paths: /api/v1/orgs/{orgSlug}/findings: get: tags: - findings summary: List findings description: >- List every finding in the organization — Tolmo-authored and third-party scanner rows — from the unified findings read. Filter with origin=tolmo for Tolmo-authored rows only. The lean catalog (source/agent facets, idsOnly) lives at GET /findings/catalog. operationId: apiListFindings parameters: - schema: type: string minLength: 1 maxLength: 512 in: query name: q required: false - schema: type: string minLength: 1 maxLength: 255 in: query name: origin required: false - schema: type: string minLength: 1 maxLength: 64 in: query name: severity required: false - schema: type: string minLength: 1 maxLength: 512 in: query name: state required: false - schema: type: string minLength: 1 maxLength: 128 in: query name: retest required: false - schema: type: string minLength: 1 maxLength: 512 in: query name: rule required: false - schema: type: string minLength: 1 maxLength: 256 in: query name: status required: false - schema: type: string minLength: 1 maxLength: 64 in: query name: providerStatus required: false - schema: type: string enum: - tolmo - none in: query name: verdict required: false - schema: default: all type: string enum: - open - all in: query name: scope required: false - schema: type: boolean in: query name: includeInfo required: false - schema: type: boolean in: query name: draftsOnly required: false - schema: type: string minLength: 1 maxLength: 4096 in: query name: query required: false - schema: type: integer minimum: 1 maximum: 500 in: query name: page required: false - schema: type: integer minimum: 1 maximum: 100 in: query name: pageSize required: false - schema: type: string minLength: 1 maxLength: 2048 in: query name: cursor required: false - schema: type: integer minimum: 1 maximum: 100 in: query name: limit required: false - schema: type: string in: path name: orgSlug required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: items: type: array items: type: object properties: id: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ externalId: type: string title: type: string severity: type: string origin: type: string recordOrigin: type: string enum: - external - agent - manual originalPlatformUrl: nullable: true type: string originalPlatformStatus: nullable: true type: string status: type: string enum: - open - in_review - closed - acknowledged - false_positive - canceled statusEditable: type: boolean platformResolution: nullable: true type: string inReviewReason: nullable: true type: string inReviewUrl: nullable: true type: string state: type: string enum: - unprocessed - duplicate - ingested - awaiting_exploit - exploit_blocked - defense_in_depth - exploited - exploit_not_produced - false_positive - resolved agenticStatus: nullable: true type: string lastRetestVerdict: nullable: true type: string lastRetestedAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ retest: type: string enum: - none - pending - confirmed - failed cveDispatchable: type: boolean resourceKey: nullable: true type: string resourceName: nullable: true type: string kind: nullable: true type: string ruleName: nullable: true type: string targetUrls: type: array items: type: string firstSeenAt: nullable: true type: string lastSeenAt: nullable: true type: string updatedAt: type: string lastActivity: nullable: true type: object properties: kind: type: string enum: - state - status from: nullable: true type: string to: type: string at: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ by: nullable: true type: string required: - kind - from - to - at - by additionalProperties: false tolmoFinding: nullable: true type: object properties: id: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ title: type: string severity: type: string status: type: string relationship: type: string enum: - created - linked - duplicate - merged url: type: string required: - id - title - severity - status - relationship - url additionalProperties: false required: - id - externalId - title - severity - origin - recordOrigin - originalPlatformUrl - originalPlatformStatus - status - statusEditable - platformResolution - inReviewReason - inReviewUrl - state - agenticStatus - lastRetestVerdict - lastRetestedAt - retest - cveDispatchable - resourceKey - resourceName - kind - ruleName - targetUrls - firstSeenAt - lastSeenAt - updatedAt - lastActivity - tolmoFinding additionalProperties: false total: type: integer minimum: 0 maximum: 9007199254740991 page: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 pageSize: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 facets: type: object properties: origins: type: array items: type: object properties: value: type: string label: type: string count: type: integer minimum: 0 maximum: 9007199254740991 required: - value - label - count additionalProperties: false severities: type: array items: type: object properties: value: type: string label: type: string count: type: integer minimum: 0 maximum: 9007199254740991 required: - value - label - count additionalProperties: false states: type: array items: type: object properties: value: type: string label: type: string count: type: integer minimum: 0 maximum: 9007199254740991 required: - value - label - count additionalProperties: false retests: type: array items: type: object properties: value: type: string label: type: string count: type: integer minimum: 0 maximum: 9007199254740991 required: - value - label - count additionalProperties: false rules: type: array items: type: object properties: value: type: string label: type: string count: type: integer minimum: 0 maximum: 9007199254740991 required: - value - label - count additionalProperties: false statuses: type: array items: type: object properties: value: type: string label: type: string count: type: integer minimum: 0 maximum: 9007199254740991 required: - value - label - count additionalProperties: false providerStatuses: type: array items: type: object properties: value: type: string label: type: string count: type: integer minimum: 0 maximum: 9007199254740991 required: - value - label - count additionalProperties: false verdicts: type: array items: type: object properties: value: type: string label: type: string count: type: integer minimum: 0 maximum: 9007199254740991 required: - value - label - count additionalProperties: false required: - origins - severities - states - retests - rules - statuses - providerStatuses - verdicts additionalProperties: false description: >- Cross-filtered facets for page mode; all arrays are empty in cursor mode. The state/retest/status/providerStatus/verdict facets ignore `scope`, so the pickers still show what the default view is hiding. scope: type: string enum: - open - all includeInfo: type: boolean hiddenInformational: nullable: true type: integer minimum: 0 maximum: 9007199254740991 nextCursor: nullable: true type: string required: - items - total - page - pageSize - facets - scope - includeInfo - hiddenInformational - nextCursor additionalProperties: false '400': description: Default Response content: application/json: schema: $ref: '#/components/schemas/HttpError' security: - bearerAuth: [] components: schemas: HttpError: type: object properties: statusCode: type: number code: type: string error: type: string message: type: string title: HttpError securitySchemes: bearerAuth: type: http scheme: bearer description: >- A Tolmo API token, sent as `Authorization: Bearer `. Either a user token (`usr_tok.*`, minted by `tolmo auth login`, scoped to your own permissions) or an org API token created in the Tolmo app, for CI and automation. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.