> ## Documentation Index > Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt > Use this file to discover all available pages before exploring further. # List findings > List the organization's findings, newest first, with the shared lean paginated contract. Regular callers see published findings only; effective super-admins may additionally read all drafts, and a scoped pentester may list drafts they authored. ## OpenAPI ````yaml /api-reference/openapi.json get /api/v1/orgs/{orgSlug}/findings openapi: 3.0.3 info: title: Tolmo API version: 1.0.0 description: >- The Tolmo REST API. Every endpoint is scoped to one organization and authenticated with an API token. servers: - url: https://api.tolmo.com description: Production security: - bearerAuth: [] paths: /api/v1/orgs/{orgSlug}/findings: get: tags: - findings summary: List findings description: >- List the organization's findings, newest first, with the shared lean paginated contract. Regular callers see published findings only; effective super-admins may additionally read all drafts, and a scoped pentester may list drafts they authored. operationId: apiListFindings parameters: - schema: type: string enum: - open - in_review - closed - acknowledged - false_positive - canceled in: query name: status required: false - schema: type: string enum: - critical - high - medium - low - info in: query name: severity required: false - schema: anyOf: - type: string enum: - open - in_review - closed - acknowledged - false_positive - canceled - type: array items: type: string enum: - open - in_review - closed - acknowledged - false_positive - canceled in: query name: statuses required: false - schema: anyOf: - type: string enum: - open - in_review - closed - acknowledged - false_positive - canceled - type: array items: type: string enum: - open - in_review - closed - acknowledged - false_positive - canceled in: query name: statusExcluded required: false - schema: anyOf: - type: string enum: - critical - high - medium - low - info - type: array items: type: string enum: - critical - high - medium - low - info in: query name: severities required: false - schema: anyOf: - type: string enum: - critical - high - medium - low - info - type: array items: type: string enum: - critical - high - medium - low - info in: query name: severityExcluded required: false - schema: anyOf: - type: string - type: array items: type: string in: query name: source required: false - schema: anyOf: - type: string - type: array items: type: string in: query name: sourceExcluded required: false - schema: anyOf: - type: string - type: array items: type: string in: query name: agent required: false - schema: anyOf: - type: string - type: array items: type: string in: query name: agentExcluded required: false - schema: type: string maxLength: 512 in: query name: q required: false - schema: type: string pattern: ^\d{4}-\d{2}-\d{2}$ in: query name: createdAfter required: false - schema: type: string pattern: ^\d{4}-\d{2}-\d{2}$ in: query name: createdBefore required: false - schema: type: string pattern: ^\d{4}-\d{2}-\d{2}$ in: query name: updatedAfter required: false - schema: type: string pattern: ^\d{4}-\d{2}-\d{2}$ in: query name: updatedBefore required: false - schema: type: string enum: - severity - status - created - updated - createdAt - updatedAt in: query name: sortBy required: false - schema: type: string enum: - asc - desc in: query name: sortDir required: false - schema: type: integer minimum: 1 maximum: 10000 in: query name: page required: false - schema: type: integer minimum: 1 maximum: 100 in: query name: pageSize required: false - schema: type: boolean in: query name: includeDrafts required: false - schema: type: boolean in: query name: draftsOnly required: false - schema: type: integer minimum: 1 maximum: 100 in: query name: limit required: false - schema: type: boolean in: query name: idsOnly required: false - schema: anyOf: - type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ - maxItems: 1000 type: array items: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ in: query name: excludeIds required: false - schema: type: string in: path name: orgSlug required: true responses: '200': description: Default Response content: application/json: schema: anyOf: - type: object properties: items: type: array items: type: object properties: id: type: string orgId: type: string orgSlug: nullable: true type: string orgName: nullable: true type: string agentId: nullable: true type: string sourceAgentName: nullable: true type: string workflowRunId: nullable: true type: string severity: type: string title: type: string resourceType: nullable: true type: string resourceName: nullable: true type: string resourceArn: nullable: true type: string resourceKey: nullable: true type: string targetUrl: nullable: true type: string category: nullable: true type: string tags: type: array items: type: string cwe: nullable: true type: string owasp: nullable: true type: string status: type: string visibility: type: string taskIds: {} tickets: type: array items: type: object properties: id: type: string provider: type: string externalId: type: string identifier: nullable: true type: string url: nullable: true type: string createdAt: type: string stateName: nullable: true type: string stateType: nullable: true type: string required: - id - provider - externalId - identifier - url - createdAt additionalProperties: false acknowledgedAt: nullable: true type: string acknowledgedBy: nullable: true type: string hasCloseJustification: type: boolean sourceName: type: string isManual: type: boolean shownVerbatim: type: boolean ingestionStatus: nullable: true type: string ingestedAt: nullable: true type: string agenticStatus: nullable: true type: string lastRetestedAt: nullable: true type: string lastRetestVerdict: nullable: true type: string lastRetestConfidence: nullable: true type: string lastRetestScanId: nullable: true type: string attachmentCount: type: integer minimum: 0 maximum: 9007199254740991 createdBy: nullable: true type: string createdByUser: nullable: true type: object properties: userId: type: string email: nullable: true type: string name: nullable: true type: string imageUrl: nullable: true type: string required: - userId - email - name - imageUrl additionalProperties: false origins: type: array items: type: string createdAt: type: string updatedAt: type: string required: - id - orgId - orgSlug - orgName - agentId - sourceAgentName - workflowRunId - severity - title - resourceType - resourceName - resourceArn - resourceKey - targetUrl - category - tags - cwe - owasp - status - visibility - taskIds - tickets - acknowledgedAt - acknowledgedBy - hasCloseJustification - sourceName - isManual - shownVerbatim - ingestionStatus - ingestedAt - agenticStatus - lastRetestedAt - lastRetestVerdict - lastRetestConfidence - lastRetestScanId - attachmentCount - createdBy - createdByUser - origins - createdAt - updatedAt additionalProperties: false total: type: integer minimum: 0 maximum: 9007199254740991 page: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 pageSize: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 publishedTotal: type: integer minimum: 0 maximum: 9007199254740991 required: - items - total - page - pageSize additionalProperties: false - type: object properties: ids: type: array items: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ total: type: integer minimum: 0 maximum: 9007199254740991 required: - ids - total additionalProperties: false '403': description: Default Response content: application/json: schema: $ref: '#/components/schemas/HttpError' components: schemas: HttpError: type: object properties: statusCode: type: number code: type: string error: type: string message: type: string title: HttpError securitySchemes: bearerAuth: type: http scheme: bearer description: >- A Tolmo API token, sent as `Authorization: Bearer `. Either a user token (`usr_tok.*`, minted by `tolmo auth login`, scoped to your own permissions) or an org API token created in the Tolmo app, for CI and automation. ````