Skip to main content
Use tolmo findings to review Tolmo-authored findings and findings from connected scanners in one list. All subcommands accept --org and --profile. Use --json for structured output.

​
List and filter findings

The CLI follows the API’s pagination and returns all matching findings. JSON output is an array. Ordinary callers see published Tolmo findings and ingested scanner findings. Informational findings and findings without a severity are excluded unless you pass --include-info. Use the filter facets endpoint to discover filter values for your organization.

​
View a finding

The detail view works for Tolmo-authored and scanner findings. You can use a full UUID or a unique ID prefix from the list. Use a longer prefix if the CLI reports multiple matches.

​
Create a draft

API keys and ordinary user tokens can create draft findings. They cannot publish findings.
--title and --severity are required. When you use a user token, also supply --resource-name to identify the affected resource. The default visibility is draft, and the default status is open. Use either --description for inline Markdown or --description-file for a file. Pass --description-file - to read stdin. Save the ID returned by creation. Drafts are not included in the ordinary customer findings list.

​
Import a scanner report

Use upload to import a Markdown security report as third-party findings:
The report must contain a ## Unified finding details section and findings with ### USR-<number>: <title> headings:
security-report.md
The CLI parses findings locally and uploads them in batches. Keep the provider, source, and finding identifiers stable when you import an updated report. Matching records are updated instead of duplicated.

​
Change status

The supported statuses are open, in_review, closed, acknowledged, and false_positive. Use the underscore in false_positive. You can attach a justification to in_review, closed, or false_positive. Use either --justification or --justification-file; - reads stdin. --proof-url is available only for in_review and requires an HTTP or HTTPS URL. For scanner findings, status changes affect Tolmo’s record. They do not update the source provider. A later scan can replace the local status.

​
Review status history

​
Manage evidence attachments

Sign in with tolmo auth login to manage attachments. These operations require a user token; organization API keys are not accepted.
Uploads support files up to 250 MiB. Downloads use the stored filename unless you pass --output. Pass --force to overwrite an existing local file. Attachment deletion is permanent and requires --yes.