# List target execution findings

Returns a paginated list of findings for one target execution (repo or artifact). Pass variantId (overview variantId, or targetVariantId from a scan-history row) so findings match that version — the same pipeline execution can scan multiple variants of one target. Each scan that reported an occurrence is returned as its own row (no cross-scan dedupe); FE can dedupe with occurrenceInternalId + scanId. Each row includes issueId, scanId, occurrenceInternalId, optional exemptionId (occurrence-scoped), reference identifiers, and enrichment fields (CVE/CWE, EPSS, KEV, reachability, AI triage) so the UI can render the findings table without N+1 calls.

Endpoint: GET /sto/api/v2/targets/{id}/executions/{executionId}/occurrences
Version: 1.0
Security: 

## Query parameters:

  - `accountId` (string, required)
    Harness Account ID
    Example: "abcdef1234567890ghijkl"

  - `orgId` (string, required)
    Harness Organization ID
    Example: "example_org"

  - `projectId` (string, required)
    Harness Project ID
    Example: "example_project"

  - `variantId` (string)
    Optional variant scope. Overview passes variantId; scan history passes the row's targetVariantId. When set, only scans for that version in this execution are listed. When omitted, every variant of the target in this execution is included.
    Example: "xyz987zyx654wvu321tsr9"

  - `page` (integer)
    Page number to fetch (starting from 0)
    Example: 4

  - `pageSize` (integer)
    Number of results per page
    Example: 50

  - `search` (string)
    Search finding title, CVE, or CWE
    Example: "CVE-2022-6703"

  - `severityCodes` (string)
    Keep findings whose severity is in this comma-separated set
    Example: "Critical,High"

  - `issueTypes` (string)
    Keep findings whose issue type is in this comma-separated set
    Example: "SAST,SCA,SECRET"

  - `scanners` (string)
    Keep findings whose scanner product name is in this comma-separated set. Empty/absent means no filter.
    Example: "snyk,aqua-trivy"

  - `fixAvailable` (string)
    Keep findings whose scanner fix-available flag is in this comma-separated set (Yes, No). Empty, absent, or both values means no filter.
    Example: "Yes"

  - `reachability` (string)
    Keep findings whose occurrence reachability is in this comma-separated set. Empty/absent means no filter.
    Example: "reachable,unproven"

  - `epss` (string)
    EPSS probability filter (single select): all (no filter), gte_15 (>=15%), gte_5 (>=5%), gte_1 (>=1%), na (no EPSS data). Same enum as the all-issues page. Score in the row is the 0-1 probability; FE may also show it as a percent.
    Example: "gte_15"

  - `epssPercentile` (string)
    EPSS percentile filter (single select): all (no filter), gte_99 (>=99th), gte_90 (>=90th), gte_80 (>=80th), na (no EPSS data). Same enum as the all-issues page.
    Example: "gte_99"

  - `inKev` (string)
    CISA KEV catalog filter (multi-select, OR within): all (no filter), true (in KEV catalog), false (not in KEV catalog, including no CVE refs). Same enum as the all-issues page.
    Example: "true"

  - `aiTriaged` (string)
    Filter by AI triage verdict. Comma-separated list of enum values ('LikelyFP', 'LikelyTP', 'NotEvaluatedYet') or UI labels ('Likely FP', 'Likely TP', 'Not Evaluated Yet'). Occurrence-scoped: uses this occurrence's verdict.
    Example: "Likely TP"

  - `owaspCategories` (string)
    Keep findings whose effective OWASP 2017 slugs intersect this comma-separated set (OR within). Reads occurrence.unique_details.owaspCategories when a non-empty JSON array; else all Qwiet owasp_category tags in _raw._rawTags; else scalar owaspCategory / _raw._rawOwaspCategory. Exact slug match. Findings without a 2017 category are excluded when this filter is set. Empty/absent means no filter.
    Example: "a1-injection,a7-xss"

  - `owasp2021Categories` (string)
    Keep findings whose effective OWASP 2021 slugs intersect this comma-separated set (OR within). Reads occurrence.unique_details.owasp2021Categories when a non-empty JSON array; else all Qwiet owasp_2021_category tags; else scalar owasp2021Category. Exact slug match. Empty/absent means no filter.
    Example: "a03-injection,a01-broken-access-control"

  - `owasp2025Categories` (string)
    Keep findings whose effective OWASP 2025 slugs intersect this comma-separated set (OR within). Reads occurrence.unique_details.owasp2025Categories when a non-empty JSON array; else all Qwiet owasp_2025_category tags; else scalar owasp2025Category. Exact slug match. Empty/absent means no filter.
    Example: "a05-injection,a07-authentication-failures"

  - `cweCategories` (string)
    Keep findings whose Qwiet cwe_category IDs intersect this comma-separated set of integers (OR within). Not results[].cwes from referenceIdentifiers. Reads unique_details.cweCategories when a non-empty JSON array; else all _rawTags with key cwe_category. Exact ID match: 122 does not match 1222. Empty/absent means no filter.
    Example: "327,328"

## Path parameters:

  - `id` (string, required)
    Target ID
    Example: "abcdef1234567890ghijkl"

  - `executionId` (string, required)
    Harness Execution ID
    Example: "abcdef1234567890ghijkl"

## Response 200 fields (application/json):

  - `pagination` (object, required)
    Example: {"link":"","page":4,"pageSize":20,"totalItems":230,"totalPages":12}

  - `pagination.link` (string)
    Link-based paging

  - `pagination.page` (integer, required)
    Page number (starting from 0)
    Example: 4

  - `pagination.pageSize` (integer, required)
    Requested page size
    Example: 20

  - `pagination.totalItems` (integer, required)
    Total results available
    Example: 230

  - `pagination.totalPages` (integer, required)
    Total pages available
    Example: 12

  - `results` (array, required)
    Example: [{"aiTriaged":"LikelyFP","cves":["CVE-2022-6703"],"cwes":["CWE-89"],"epssLastModified":"2025-05-01","epssPercentile":0.15,"epssScore":0.035,"exemptionId":"abcdef1234567890ghijkl","fixAvailable":true,"inKev":true,"issueId":"abcdef1234567890ghijkl","issueType":"SAST","occurrenceInternalId":12345,"reachability":"reachable","referenceIdentifiers":[{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."},{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."}],"scanId":"scan111111111111111111","scanner":{"id":"trivy","prettyName":"Trivy"},"severityCode":"Critical","title":"SQL injection enables authentication bypass"},{"aiTriaged":"LikelyFP","cves":["CVE-2022-6703"],"cwes":["CWE-89"],"epssLastModified":"2025-05-01","epssPercentile":0.15,"epssScore":0.035,"exemptionId":"abcdef1234567890ghijkl","fixAvailable":true,"inKev":true,"issueId":"abcdef1234567890ghijkl","issueType":"SAST","occurrenceInternalId":12345,"reachability":"reachable","referenceIdentifiers":[{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."},{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."}],"scanId":"scan111111111111111111","scanner":{"id":"trivy","prettyName":"Trivy"},"severityCode":"Critical","title":"SQL injection enables authentication bypass"}]

  - `results.aiTriaged` (string)
    Aggregate AI triage verdict. 'LikelyFP' if every occurrence is FALSE_POSITIVE; 'LikelyTP' if any is TRUE_POSITIVE; 'NotEvaluatedYet' if only some are triaged. Field is absent when no occurrence has been triaged yet.
    Enum: "LikelyFP", "LikelyTP", "NotEvaluatedYet"

  - `results.cves` (array)
    CVE ids from this occurrence's effective referenceIdentifiers (occurrence list when present, otherwise issue list)
    Example: ["CVE-2022-6703"]

  - `results.cwes` (array)
    CWE ids from this occurrence's effective referenceIdentifiers
    Example: ["CWE-89"]

  - `results.epssLastModified` (string)
    Last date the issue EPSS data was last modified
    Example: "2025-05-01"

  - `results.epssPercentile` (number)
    EPSS percentile of the issue CVE identifier
    Example: 0.15

  - `results.epssScore` (number)
    EPSS score of the issue CVE identifier
    Example: 0.035

  - `results.exemptionId` (string)
    ID of an occurrence-scoped exemption for this finding on the target, matched via exemption_occurrence fingerprint. Null/omitted when none exists. Issue-level exemptions are not returned.
    Example: "abcdef1234567890ghijkl"

  - `results.fixAvailable` (boolean, required)
    True when the scanner provided a fix: a non-empty upgrade/fixed version or non-placeholder scanner remediation steps. Harness AI remediations are not counted.
    Example: true

  - `results.inKev` (boolean)
    True when any linked CVE is in the CISA KEV catalog
    Example: true

  - `results.issueId` (string, required)
    Issue ID used by the existing ticket and exemption APIs
    Example: "abcdef1234567890ghijkl"

  - `results.issueType` (string, required)
    Finding issue type
    Enum: "SAST", "DAST", "SCA", "IAC", "SECRET", "MISCONFIG", "BUG_SMELLS", "CODE_SMELLS", "CODE_COVERAGE", "EXTERNAL_POLICY"

  - `results.occurrenceInternalId` (integer, required)
    Internal ID used to fetch occurrence details or request an occurrence-level exemption
    Example: 12345

  - `results.reachability` (string)
    Occurrence reachability. 'reachable', 'not-reachable', or 'unproven' (missing/unknown).
    Enum: "reachable", "not-reachable", "unproven"

  - `results.referenceIdentifiers` (array)
    Effective reference identifiers for this occurrence (occurrence list when present, otherwise issue list). Empty array when none exist.
    Example: [{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."},{"id":"Nulla magnam assumenda doloremque consectetur.","type":"Nobis pariatur eos voluptatibus nesciunt similique dolor."}]

  - `results.referenceIdentifiers.id` (string)
    Example: "Totam facilis ut quae."

  - `results.referenceIdentifiers.type` (string)
    Example: "Et est a."

  - `results.scanId` (string, required)
    ID of the scan containing this occurrence
    Example: "scan111111111111111111"

  - `results.scanner` (object)
    Example: {"id":"trivy","prettyName":"Trivy"}

  - `results.scanner.id` (string, required)
    Scanner product name used as the filter id
    Example: "trivy"

  - `results.scanner.prettyName` (string, required)
    Scanner display name (product.prettyName, falling back to product name)
    Example: "Trivy"

  - `results.severityCode` (string, required)
    Finding severity
    Enum: "Critical", "High", "Medium", "Low", "Info", "Unassigned"

  - `results.title` (string, required)
    Finding title
    Example: "SQL injection enables authentication bypass"

## Response 400 fields (application/json):

  - `message` (string, required)
    Example: "Not Found"

  - `status` (integer)
    Example: 404