Create and manage organizations in your account. You use organizations to group together related projects. For example, you can use an organization to group together projects within a business unit or division.
- Get target execution occurrence
Targets#ListTargets
Targets#CreateTarget
Targets#DeleteTarget
Targets#FindTargetById
Targets#PatchTarget
Targets#UpdateTarget
Get target compliance counts
List target executions
Get target execution metadata
List target execution findings
Get target finding tags
Get target overview
Get target scan report
Get target SBOM
Get target SCA licenses
Get target SCA packages
List scanner filter options
Get target execution occu...
Harness APIs (1.0)
The Harness Software Delivery Platform uses OpenAPI Specification v3.0. Harness constantly improves these APIs. Please be aware that some improvements could cause breaking changes.
The Harness API allows you to integrate and use all the services and modules we provide on the Harness Platform. If you use client-side SDKs, Harness functionality can be integrated with your client-side automation, helping you reduce manual efforts and deploy code faster.
For more information about how Harness works, read our documentation or visit the Harness Developer Hub.
The Harness API is a RESTful API that uses standard HTTP verbs. You can send requests in JSON, YAML, or form-data format. The format of the response matches the format of your request. You must send a single request at a time and ensure that you include your authentication key. For more information about this, go to Authentication.
Before you start integrating, get to know our API better by reading the following topics:
The methods you need to integrate with depend on the functionality you want to use. Work with your Harness Solutions Engineer to determine which methods you need.
To authenticate with the Harness API, you need to:
- Generate an API token on the Harness Platform.
- Send the API token you generate in the
x-api-keyheader in each request.
To generate an API token, complete the following steps:
- Go to the Harness Platform.
- On the left-hand navigation, click My Profile.
- Click +API Key, enter a name for your key and then click Save.
- Within the API Key tile, click +Token.
- Enter a name for your token and click Generate Token. Important: Make sure to save your token securely. Harness does not store the API token for future reference, so make sure to save your token securely before you leave the page.
Send the token you created in the Harness Platform in the x-api-key header. For example: x-api-key: YOUR_API_KEY_HERE
The structure for each request and response is outlined in the API documentation. We have examples in JSON and YAML for every request and response. You can use our online editor to test the examples.
| Field Name | Type | Default | Description |
|---|---|---|---|
| identifier | string | none | URL-friendly version of the name, used to identify a resource within it's scope and so needs to be unique within the scope. |
| name | string | none | Human-friendly name for the resource. |
| org | string | none | Limit to provided org identifiers. |
| project | string | none | Limit to provided project identifiers. |
| description | string | none | More information about the specific resource. |
| tags | map[string]string | none | List of labels applied to the resource. |
| order | string | desc | Order to use when sorting the specified fields. Type: enum(asc,desc). |
| sort | string | none | Fields on which to sort. Note: Specify the fields that you want to use for sorting. When doing so, consider the operational overhead of sorting fields. |
| limit | int | 30 | Pagination: Number of items to return. |
| page | int | 1 | Pagination page number strategy: Specify the page number within the paginated collection related to the number of items in each page. |
| created | int64 | none | Unix timestamp that shows when the resource was created (in milliseconds). |
| updated | int64 | none | Unix timestamp that shows when the resource was last edited (in milliseconds). |
Harness uses conventional HTTP status codes to indicate the status of an API request. Generally, 2xx responses are reserved for success and 4xx status codes are reserved for failures. A 5xx response code indicates an error on the Harness server.
| Error Code | Description |
|---|---|
| 200 | OK |
| 201 | Created |
| 202 | Accepted |
| 204 | No Content |
| 400 | Bad Request |
| 401 | Unauthorized |
| 403 | Forbidden |
| 412 | Precondition Failed |
| 415 | Unsupported Media Type |
| 500 | Server Error |
To view our error response structures, go here.
The current version of our Beta APIs is yet to be announced. The version number will use the date-header format and will be valid only for our Beta APIs.
All our beta APIs are versioned as a Generation, and this version is included in the path to every API resource. For example, v1 beta APIs begin with app.harness.io/v1/, where v1 is the API Generation.
The version number represents the core API and does not change frequently. The version number changes only if there is a significant departure from the basic underpinnings of the existing API. For example, when Harness performs a system-wide refactoring of core concepts or resources.
We use pagination to place limits on the number of responses associated with list endpoints. Pagination is achieved by the use of limit query parameters. The limit defaults to 30. Its maximum value is 100.
Following are the pagination headers supported in the response bodies of paginated APIs:
- X-Total-Elements : Indicates the total number of entries in a paginated response.
- X-Page-Number : Indicates the page number currently returned for a paginated response.
- X-Page-Size : Indicates the number of entries per page for a paginated response.
For example:
X-Total-Elements : 30
X-Page-Number : 0
X-Page-Size : 10Download OpenAPI description
Overview
Languages
Servers
Harness host URL
https://app.harness.io
Vanity URL
https://{vanity}
Request
Returns a paginated list of findings for one target execution (repo or artifact). Pass variantId (overview variantId, or targetVariantId from a scan-history row) so findings match that version — the same pipeline execution can scan multiple variants of one target. Each scan that reported an occurrence is returned as its own row (no cross-scan dedupe); FE can dedupe with occurrenceInternalId + scanId. Each row includes issueId, scanId, occurrenceInternalId, optional exemptionId (occurrence-scoped), reference identifiers, and enrichment fields (CVE/CWE, EPSS, KEV, reachability, AI triage) so the UI can render the findings table without N+1 calls.
Query
Harness Account ID
Example: accountId=abcdef1234567890ghijkl
Harness Organization ID
Example: orgId=example_org
Harness Project ID
Example: projectId=example_project
Optional variant scope. Overview passes variantId; scan history passes the row's targetVariantId. When set, only scans for that version in this execution are listed. When omitted, every variant of the target in this execution is included.
Example: variantId=xyz987zyx654wvu321tsr9
Keep findings whose severity is in this comma-separated set
Example: severityCodes=Critical,High
Keep findings whose issue type is in this comma-separated set
Example: issueTypes=SAST,SCA,SECRET
Keep findings whose scanner product name is in this comma-separated set. Empty/absent means no filter.
Example: scanners=snyk,aqua-trivy
Keep findings whose scanner fix-available flag is in this comma-separated set (Yes, No). Empty, absent, or both values means no filter.
Example: fixAvailable=Yes
Keep findings whose occurrence reachability is in this comma-separated set. Empty/absent means no filter.
Example: reachability=reachable,unproven
EPSS probability filter (single select): all (no filter), gte_15 (>=15%), gte_5 (>=5%), gte_1 (>=1%), na (no EPSS data). Same enum as the all-issues page. Score in the row is the 0-1 probability; FE may also show it as a percent.
Example: epss=gte_15
EPSS percentile filter (single select): all (no filter), gte_99 (>=99th), gte_90 (>=90th), gte_80 (>=80th), na (no EPSS data). Same enum as the all-issues page.
Example: epssPercentile=gte_99
CISA KEV catalog filter (multi-select, OR within): all (no filter), true (in KEV catalog), false (not in KEV catalog, including no CVE refs). Same enum as the all-issues page.
Example: inKev=true
Filter by AI triage verdict. Comma-separated list of enum values ('LikelyFP', 'LikelyTP', 'NotEvaluatedYet') or UI labels ('Likely FP', 'Likely TP', 'Not Evaluated Yet'). Occurrence-scoped: uses this occurrence's verdict.
Example: aiTriaged=Likely TP
Keep findings whose effective OWASP 2017 slugs intersect this comma-separated set (OR within). Reads occurrence.unique_details.owaspCategories when a non-empty JSON array; else all Qwiet owasp_category tags in _raw._rawTags; else scalar owaspCategory / _raw._rawOwaspCategory. Exact slug match. Findings without a 2017 category are excluded when this filter is set. Empty/absent means no filter.
Example: owaspCategories=a1-injection,a7-xss
Keep findings whose effective OWASP 2021 slugs intersect this comma-separated set (OR within). Reads occurrence.unique_details.owasp2021Categories when a non-empty JSON array; else all Qwiet owasp_2021_category tags; else scalar owasp2021Category. Exact slug match. Empty/absent means no filter.
Example: owasp2021Categories=a03-injection,a01-broken-access-control
Keep findings whose effective OWASP 2025 slugs intersect this comma-separated set (OR within). Reads occurrence.unique_details.owasp2025Categories when a non-empty JSON array; else all Qwiet owasp_2025_category tags; else scalar owasp2025Category. Exact slug match. Empty/absent means no filter.
Example: owasp2025Categories=a05-injection,a07-authentication-failures
Keep findings whose Qwiet cwe_category IDs intersect this comma-separated set of integers (OR within). Not results[].cwes from referenceIdentifiers. Reads unique_details.cweCategories when a non-empty JSON array; else all _rawTags with key cwe_category. Exact ID match: 122 does not match 1222. Empty/absent means no filter.
Example: cweCategories=327,328
- Harness host URLhttps://app.harness.io/sto/api/v2/targets/{id}/executions/{executionId}/occurrences
- Vanity URLhttps://app.harness.io/sto/api/v2/targets/{id}/executions/{executionId}/occurrences
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://app.harness.io/sto/api/v2/targets/abcdef1234567890ghijkl/executions/abcdef1234567890ghijkl/occurrences?accountId=abcdef1234567890ghijkl&orgId=example_org&projectId=example_project&variantId=xyz987zyx654wvu321tsr9&page=4&pageSize=50&search=CVE-2022-6703&severityCodes=Critical%2CHigh&issueTypes=SAST%2CSCA%2CSECRET&scanners=snyk%2Caqua-trivy&fixAvailable=Yes&reachability=reachable%2Cunproven&epss=gte_15&epssPercentile=gte_99&inKev=true&aiTriaged=Likely+TP&owaspCategories=a1-injection%2Ca7-xss&owasp2021Categories=a03-injection%2Ca01-broken-access-control&owasp2025Categories=a05-injection%2Ca07-authentication-failures&cweCategories=327%2C328'OK response.
Example: {"link":"","page":4,"pageSize":20,"totalItems":230,"totalPages":12}
Example: [{"aiTriaged":"LikelyFP","cves":["CVE-2022-6703"],"cwes":["CWE-89"],"epssLastModified":"2025-05-01","epssPercentile":0.15,"epssScore":0.035,"exemptionId":"abcdef1234567890ghijkl","fixAvailable":true,"inKev":true,"issueId":"abcdef1234567890ghijkl","issueType":"SAST","occurrenceInternalId":12345,"reachability":"reachable","referenceIdentifiers":[{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."},{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."}],"scanId":"scan111111111111111111","scanner":{"id":"trivy","prettyName":"Trivy"},"severityCode":"Critical","title":"SQL injection enables authentication bypass"},{"aiTriaged":"LikelyFP","cves":["CVE-2022-6703"],"cwes":["CWE-89"],"epssLastModified":"2025-05-01","epssPercentile":0.15,"epssScore":0.035,"exemptionId":"abcdef1234567890ghijkl","fixAvailable":true,"inKev":true,"issueId":"abcdef1234567890ghijkl","issueType":"SAST","occurrenceInternalId":12345,"reachability":"reachable","referenceIdentifiers":[{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."},{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."}],"scanId":"scan111111111111111111","scanner":{"id":"trivy","prettyName":"Trivy"},"severityCode":"Critical","title":"SQL injection enables authentication bypass"}]
Aggregate AI triage verdict. 'LikelyFP' if every occurrence is FALSE_POSITIVE; 'LikelyTP' if any is TRUE_POSITIVE; 'NotEvaluatedYet' if only some are triaged. Field is absent when no occurrence has been triaged yet.
Enum"LikelyFP""LikelyTP""NotEvaluatedYet"
Example: "LikelyFP"
CVE ids from this occurrence's effective referenceIdentifiers (occurrence list when present, otherwise issue list)
Example: ["CVE-2022-6703"]
CWE ids from this occurrence's effective referenceIdentifiers
Example: ["CWE-89"]
Last date the issue EPSS data was last modified
Example: "2025-05-01"
ID of an occurrence-scoped exemption for this finding on the target, matched via exemption_occurrence fingerprint. Null/omitted when none exists. Issue-level exemptions are not returned.
Example: "abcdef1234567890ghijkl"
True when the scanner provided a fix: a non-empty upgrade/fixed version or non-placeholder scanner remediation steps. Harness AI remediations are not counted.
Example: true
Issue ID used by the existing ticket and exemption APIs
Example: "abcdef1234567890ghijkl"
Finding issue type
Enum"SAST""DAST""SCA""IAC""SECRET""MISCONFIG""BUG_SMELLS""CODE_SMELLS""CODE_COVERAGE""EXTERNAL_POLICY"
Example: "SAST"
Internal ID used to fetch occurrence details or request an occurrence-level exemption
Example: 12345
Occurrence reachability. 'reachable', 'not-reachable', or 'unproven' (missing/unknown).
Enum"reachable""not-reachable""unproven"
Example: "reachable"
Effective reference identifiers for this occurrence (occurrence list when present, otherwise issue list). Empty array when none exist.
Example: [{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."},{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."}]
ID of the scan containing this occurrence
Example: "scan111111111111111111"
Finding severity
Enum"Critical""High""Medium""Low""Info""Unassigned"
Example: "Critical"
Response
application/json
{ "pagination": { "link": "", "page": 4, "pageSize": 20, "totalItems": 230, "totalPages": 12 }, "results": [ { … }, { … } ] }
Request
Returns one occurrence from a target execution by occurrenceInternalId for a specific scan. Pass scanId from the findings list row — the same occurrenceInternalId may appear once per scan in an execution. The response is the same occurrence Details object used by the vulnerabilities and Issue Page V2 APIs.
Query
Harness Account ID
Example: accountId=abcdef1234567890ghijkl
Harness Organization ID
Example: orgId=example_org
Harness Project ID
Example: projectId=example_project
Scan ID from the findings list row. Required so detail matches the clicked scan when the same occurrence appears in multiple scans of one execution.
Example: scanId=scan111111111111111111
- Harness host URLhttps://app.harness.io/sto/api/v2/targets/{id}/executions/{executionId}/occurrences/{occurrenceInternalId}
- Vanity URLhttps://app.harness.io/sto/api/v2/targets/{id}/executions/{executionId}/occurrences/{occurrenceInternalId}
- curl
- JavaScript
- Node.js
- Python
- Java
- C#
- PHP
- Go
- Ruby
- R
- Payload
curl -i -X GET \
'https://app.harness.io/sto/api/v2/targets/abcdef1234567890ghijkl/executions/abcdef1234567890ghijkl/occurrences/12345?accountId=abcdef1234567890ghijkl&orgId=example_org&projectId=example_project&scanId=scan111111111111111111&variantId=xyz987zyx654wvu321tsr9'Response
application/json
{ "Iste at temporibus velit.": "Quia asperiores in sit.", "Soluta nobis corrupti dolor aut cupiditate illo.": "Illum possimus." }