> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# Get workflow job findings
> Returns the findings produced by a completed workflow job.
This endpoint is **experimental**. It may change or be removed without notice and is not covered by API stability guarantees.
## OpenAPI
````yaml /public_v2.openapi.yaml get /api/workflows/v1/deployments/{deploymentId}/jobs/id/{jobId}/findings
openapi: 3.0.3
info:
title: Semgrep API
description: >-
The API v2 is currently a work in progress as we expand and improve our
platform capabilities. There are no current plans to deprecate the [v1
API](/api/v1/docs) – we remain committed to supporting existing integrations
and will ensure that all v1 use cases are fully supported in v2 before any
deprecation occurs.
## API Maturity Levels
Each endpoint in the v2 API is marked with a maturity badge to help you
understand its current state:
🚧 **Experimental** - Use at your own risk. This endpoint was not originally
designed for third-party use or is under active development. Expect
significant breaking changes.
⚠️ **Beta** - This endpoint is being refined. We will communicate breaking
changes to Beta partners as we tweak the implementation.
✅ **Stable** - No breaking changes will be made to this API. You can
confidently build production integrations against these endpoints.
We recommend using Stable endpoints for production applications and treating
Experimental/Beta endpoints as previews of upcoming functionality. This API
is documented in the **OpenAPI format**.
# Authentication
The API supports authentication with an API token with the "Web API"
permission, without limited scopes of access.
You can provision an API token [from the Settings
page](https://semgrep.dev/orgs/-/settings/tokens).
# Terms of Use
Please note, the materials made available herein are subject to the [Semgrep
Terms of Use](https://semgrep.dev/resources/website-terms/), and your access
or use of any of the same is your acknowledgment and acceptance of the such
terms.
___
contact:
email: support@semgrep.com
version: v2.0.0.alpha
x-logo:
url: https://semgrep.dev/images/SemgrepLogoWithTextWithMargin.svg
backgroundColor: '#fafafa'
altText: Semgrep logo
servers:
- url: https://semgrep.dev
description: Semgrep AppSec Platform
security: []
tags:
- name: AiFixJobsService
description: Manage AI fix jobs for automated security fixes
x-displayName: AI Fix Jobs
x-group: AI Fix Jobs
- name: AiTasksService
description: Manage AI tasks, such as triage, auto-triage, and issue tagging backfill
x-displayName: AI tasks
x-group: AI tasks
- name: AutofixService
description: Trigger automated fixes for SAST, AI SAST, and SCA issues.
x-displayName: Autofix
x-group: Autofix
- name: AutomationsService
description: >-
Automations are a way to automatically take actions on findings based on
certain conditions.
x-displayName: Automations
x-group: Automations
- name: AutotriageFeedbackService
description: Feedback for the quality of autotriage, guidance or autofix
x-displayName: Autotriage Feedback
x-group: Autotriage Feedback
- name: ChecklistService
description: Manage onboarding checklist
x-displayName: Onboarding Checklist
x-group: Onboarding Checklist
- name: DeploymentProductsService
description: Manage deployment product configurations.
x-displayName: Deployment Products
x-group: Deployment Products
- name: DeploymentService
description: Manage deployment and its resources.
x-displayName: Deployment
x-group: Deployment
- name: DeploymentSsoProvidersService
description: Manage Deployment SSO Providers
x-displayName: Deployment SSO Providers
x-group: Deployment SSO Providers
- name: DeploymentTagService
description: Assign tags to a deployment.
x-displayName: Deployment Tags
x-group: Deployment Tags
- name: DeploymentsService
description: >-
Deployments encapsulate your organization's security organization, with
multiple projects, policies, and integrations. As the root object of the
organization, they're similarly the root object of the API.
x-displayName: Deployments
x-group: Deployments
- name: EditorService
description: Run Semgrep patterns against target code in the editor playground
x-displayName: Editor
x-group: Editor
- name: ExternalTicketingService
description: APIs that power the External Ticketing experience.
x-displayName: External Ticketing
x-group: External Ticketing
- name: FeatureRolloutsService
description: View feature flags rolled out to all deployments
x-displayName: Feature Rollouts
x-group: Feature Rollouts
- name: IgnoresService
description: >-
API for managing global ignores. See
https://semgrep.dev/docs/ignoring-files-folders-code
x-displayName: Global Ignores
x-group: Global Ignores
- name: InfrastructureConfigurationsService
description: Infrastructure configuration information.
x-displayName: Infrastructure Configurations
x-group: Infrastructure Configurations
- name: IssuesService
description: Manage findings found by Semgrep scans
x-displayName: Issues
x-group: Issues
- name: ManagedScanSettingsService
description: Settings that affect all of a deployment's Managed Scans
x-displayName: Managed Scan Settings
x-group: Managed Scan Settings
- name: MemoriesService
description: Memories help reduce noise from findings.
x-displayName: Memories
x-group: Memories
- name: MiscService
description: Miscellaneous endpoints
x-displayName: Other
x-group: Other
- name: NotificationRulesService
description: Setup rules to get notified about new findings
x-displayName: Notification Rules
x-group: Notification Rules
- name: NotificationWebhooksService
description: Manage webhook endpoints for deployment notifications.
x-displayName: Notification Webhooks
x-group: Notification Webhooks
- name: NotificationsService
description: Notifications show in-app toasts to users.
x-displayName: Notifications
x-group: Notifications
- name: PoliciesService
description: >-
**Deprecated.** View and manage the Policies of your organization.
This API is deprecated. Use the [Policies V2
API](/api/v2/docs/#tag/PoliciesV2Service) instead. Once a deployment is
migrated to the Unified Policies model, every endpoint in this service
returns `410 Gone` with the error code `DEPLOYMENT_MIGRATED`.
x-displayName: Policies
x-group: Policies
- name: PoliciesV2Service
description: >-
Declarative management of detection and remediation policies for
deployments on the Unified Policies model. Designed for GitOps-style
reconciliation: read the current bundle, edit it, preview the diff with a
dry run, then apply it strictly with optimistic concurrency control.
x-displayName: Policies V2
x-group: Policies V2
- name: ProjectManagedScanSettingsService
description: Settings that affect a specific project's Managed Scans
x-displayName: Projects - Managed Scan Settings
x-group: Projects - Managed Scan Settings
- name: ProjectsService
description: >-
Projects are groups of files that are scanned by Semgrep. These normally
correspond to repositories.
x-displayName: Projects
x-group: Projects
- name: PublicIssuesService
description: >-
Search, inspect, and triage issues generated by Semgrep Agentic Workflows.
This API does not include issues from other Semgrep products.
x-displayName: Issues (Semgrep Agentic Workflows)
x-group: Issues (Semgrep Agentic Workflows)
- name: ReportsService
description: APIs for Reporting Dashboards
x-displayName: Reporting
x-group: Reporting
- name: ReviewCommentProductContentService
description: >-
Review comment product content is a way to add additional per-product
information to a review comment.
x-displayName: Review Comment Product Content
x-group: Review Comment Product Content
- name: RuleboardService
description: >-
The [Policies API](/api/v2/docs/#tag/PoliciesService) is *strongly*
recommended. It is also newer than this Ruleboard service. Deployments on
the Unified Policies model use the [Policies V2
API](/api/v2/docs/#tag/PoliciesV2Service) instead: once a deployment is
migrated, every endpoint in this service returns `410 Gone` with the error
code `DEPLOYMENT_MIGRATED` to API token callers.
Manage Ruleboards (sets of policies).
x-displayName: Ruleboards
x-group: Ruleboards
- name: ScansService
description: View details of scans associated with projects in your organization.
x-displayName: Scans
x-group: Scans
- name: ScmAppsService
description: >-
Manage connections to source code management systems (Github, Gitlab,
etc.)
x-displayName: Source Code Management (SCM) apps
x-group: Source Code Management (SCM) apps
- name: ScmService
description: >-
Manage connections to source code management systems (Github, Gitlab,
etc.)
x-displayName: Source Code Management (SCM) configurations
x-group: Source Code Management (SCM) configurations
- name: ScmSubscriptionsService
description: Manage SCM Webhook Subscriptions
x-displayName: Source Code Management (SCM) webhooks
x-group: Source Code Management (SCM) webhooks
- name: SemgrepWorkflowsService
description: API for querying and managing Semgrep Agentic Workflow jobs.
x-displayName: Semgrep Agentic Workflows
x-group: Semgrep Agentic Workflows
- name: SlackService
description: Manage Slack app installations and notification channel mappings
x-displayName: Slack
x-group: Slack
- name: SmsPackageManagerConfigService
description: >-
Manage authentication configurations for package managers used in Supply
Chain Analysis (SCA) scans.
x-displayName: Supply Chain - Managed Scans package manager configurations
x-group: Supply Chain - Managed Scans package manager configurations
- name: SmsScaResolutionConfigService
description: >-
Retrieve custom dependency resolution configurations for lockfileless
scans.
x-displayName: Supply Chain - Managed Scans dependency resolution configurations
x-group: Supply Chain - Managed Scans dependency resolution configurations
- name: SupplyChain2Service
description: >-
The Supply Chain is all of the dependencies of code, rather than the code
itself. This service gives information about the supply chain.
x-displayName: Supply Chain
x-group: Supply Chain
- name: SupportService
description: Create and List Support Cases
x-displayName: Support
x-group: Support
- name: SurveysService
description: Retrieve and submit company surveys
x-displayName: Surveys
x-group: Surveys
- name: TasksService
description: >-
Many tasks are done asynchronously; this service deals with managing async
tasks.
x-displayName: Tasks
x-group: Tasks
- name: TeamsService
description: >-
Teams are used to manage access control for resources within a deployment.
For more information visit https://semgrep.dev/docs/deployment/teams.
x-displayName: Teams
x-group: Teams
- name: TokenService
description: >-
Tokens are used for programmatic access to the Semgrep Cloud Platform
APIs.
x-displayName: Tokens
x-group: Tokens
- name: UsersService
description: Manage user accounts, settings, and organization memberships
x-displayName: Users
x-group: Users
- name: VersionsService
description: Semgrep version information
x-displayName: Versions
x-group: Versions
- name: WizCredentialService
description: Manage Wiz credentials
x-displayName: Wiz Credentials
x-group: Wiz Credentials
paths:
/api/workflows/v1/deployments/{deploymentId}/jobs/id/{jobId}/findings:
get:
tags:
- SemgrepWorkflowsService
summary: Get workflow job findings
description: Returns the findings produced by a completed workflow job.
operationId: GetWorkflowJobFindings
parameters:
- name: deploymentId
in: path
required: true
schema:
example: '1234'
title: Deployment ID
type: string
description: >-
The unique numerical identifier of the deployment. Can be found
via the Deployments Service or in your Settings in the web UI.
format: int64
- name: jobId
in: path
required: true
schema:
type: string
description: The unique identifier of the workflow job.
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: >-
#/components/schemas/protos.ai.v1.GetWorkflowJobFindingsResponse
security:
- SemgrepWebToken: []
- SemgrepJWT: []
components:
schemas:
protos.ai.v1.GetWorkflowJobFindingsResponse:
type: object
properties:
findings:
type: array
items:
$ref: '#/components/schemas/semgrep.wf.v1.Finding'
description: >-
Findings produced by the workflow run, taken from the FindingsReport
in
the WorkflowResult result.json artifact.
semgrep.wf.v1.Finding:
type: object
properties:
package:
allOf:
- $ref: '#/components/schemas/semgrep.wf.v1.PackageRef'
description: |-
The vulnerable package, when the scan identified one.
When evidence includes a trace, steps[-1] is the sink and steps[0] is the source.
domain:
type: string
cwe:
type: array
items:
type: string
description: Weakness taxonomy — security findings only.
owasp:
type: array
items:
type: string
severity:
enum:
- SEVERITY_CRITICAL
- SEVERITY_HIGH
- SEVERITY_MEDIUM
- SEVERITY_LOW
- SEVERITY_INFO
type: string
description: |+
| value | description |
|-------|---------------|
| SEVERITY_CRITICAL | |
| SEVERITY_HIGH | |
| SEVERITY_MEDIUM | |
| SEVERITY_LOW | |
| SEVERITY_INFO | |
format: enum
reasoning:
type: string
evidence:
type: array
items:
$ref: '#/components/schemas/semgrep.wf.v1.Evidence'
extra:
type: object
title:
type: string
description: Human-readable display fields — GitHub-flavoured markdown.
description:
type: string
identity:
type: object
description: >-
Structured identity for dedup: the subset of finding fields that
uniquely
identify "the same problem" within a workflow. Populated by the SDK from
the workflow's identity config ([tool.wf.identity].fields).
Empty when the workflow hasn't defined identity fields — no dedup is performed.
semgrep.wf.v1.PackageRef:
type: object
properties:
ecosystem:
type: string
name:
type: string
version:
type: string
description: |-
Identifies a package in a specific ecosystem.
ecosystem: "npm", "pypi", "maven", "cargo", "go", "gem", "nuget", "hex", ...
semgrep.wf.v1.Evidence:
type: object
properties:
trace:
$ref: '#/components/schemas/semgrep.wf.v1.CodeTrace'
snippet:
$ref: '#/components/schemas/semgrep.wf.v1.CodeSnippet'
depPath:
$ref: '#/components/schemas/semgrep.wf.v1.DependencyPath'
rule:
$ref: '#/components/schemas/semgrep.wf.v1.Rule'
description: >-
One piece of scan-time evidence. A finding carries a list of evidence
items;
each item holds exactly one kind. Detectors include whichever kinds are relevant.
Triage assessments (validity, etc.) live on the Issue, not here.
semgrep.wf.v1.CodeTrace:
type: object
properties:
steps:
type: array
items:
$ref: '#/components/schemas/semgrep.wf.v1.CodeLocation'
description: |-
A dataflow path through source code: source → ... → sink.
steps[-1] is the sink (the primary finding location).
For point findings (pattern match, no taint flow), steps has exactly one element.
semgrep.wf.v1.CodeSnippet:
type: object
properties:
location:
$ref: '#/components/schemas/semgrep.wf.v1.CodeLocation'
text:
type: string
description: |-
A source location and the text at that location matched by a rule.
Lets inspectors see exactly what triggered the finding without checking out the repo.
semgrep.wf.v1.DependencyPath:
type: object
properties:
chain:
type: array
items:
$ref: '#/components/schemas/semgrep.wf.v1.PackageRef'
description: |-
The dependency chain from the project root to a package.
chain[0] is a direct dependency of the scanned project.
chain[-1] is the vulnerable/flagged package.
A single-element chain means the package is a direct dependency.
semgrep.wf.v1.Rule:
type: object
properties:
id:
type: string
name:
type: string
description: A rule that fired and contributed to this finding.
semgrep.wf.v1.CodeLocation:
type: object
properties:
path:
type: string
startLine:
type: integer
format: int64
startColumn:
type: integer
format: int64
endLine:
type: integer
format: int64
endColumn:
type: integer
format: int64
description: A single location in source code.
securitySchemes:
SemgrepWebToken:
type: http
description: >-
Get access to data with your API token. Example header:
`Authorization: Bearer
2991e2fb4b540fe75b8f90677b0b892b6314e4961cb001fe6eb452eee248a628`
The token can be provisioned from the Tokens section in your Settings,
and requires explicitly enabling `Web API` access.
scheme: bearer
bearerFormat: string
SemgrepJWT:
type: http
description: Get access to data with your user's JSON Web Token.
scheme: bearer
bearerFormat: string
````