[{"data":1,"prerenderedAt":1036},["ShallowReactive",2],{"-docs-reference-findings-export":3,"-docs-reference-findings-export-surround":1029},{"id":4,"title":5,"body":6,"description":1019,"extension":1020,"links":1021,"meta":1022,"navigation":1023,"path":1025,"seo":1026,"stem":1027,"__hash__":1028},"docs\u002Fdocs\u002F4.reference\u002F4.findings-export.md","Findings export",{"type":7,"value":8,"toc":1011},"minimark",[9,14,31,35,47,51,186,189,193,857,860,864,874,877,881,884,893,899,903,993,1007],[10,11,13],"h2",{"id":12},"endpoint","Endpoint",[15,16,21],"pre",{"className":17,"code":18,"language":19,"meta":20,"style":20},"language-http shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","GET \u002Fv1\u002Fprojects\u002F{projectId}\u002Ffindings\u002Fexport\n","http","",[22,23,24],"code",{"__ignoreMap":20},[25,26,29],"span",{"class":27,"line":28},"line",1,[25,30,18],{},[32,33,34],"p",{},"The endpoint accepts a Better Auth browser session or bearer token that can read the project. Tenant scoping and PostgreSQL row-level security apply before the export query runs.",[32,36,37,38,42,43,46],{},"The web application calls this endpoint from ",[39,40,41],"strong",{},"Findings → Export JSON"," and downloads ",[22,44,45],{},"thespider-findings-project-{projectId}.json",".",[10,48,50],{"id":49},"query-parameters","Query parameters",[52,53,54,70],"table",{},[55,56,57],"thead",{},[58,59,60,64,67],"tr",{},[61,62,63],"th",{},"Parameter",[61,65,66],{},"Type",[61,68,69],{},"Description",[71,72,73,87,100,112,124,136,148,160],"tbody",{},[58,74,75,81,84],{},[76,77,78],"td",{},[22,79,80],{},"campaignId",[76,82,83],{},"integer",[76,85,86],{},"Include live findings sighted in this campaign.",[58,88,89,94,97],{},[76,90,91],{},[22,92,93],{},"status",[76,95,96],{},"string",[76,98,99],{},"Match one persisted finding status.",[58,101,102,107,109],{},[76,103,104],{},[22,105,106],{},"severity",[76,108,96],{},[76,110,111],{},"Match one canonical severity or impact value.",[58,113,114,119,121],{},[76,115,116],{},[22,117,118],{},"bucket",[76,120,96],{},[76,122,123],{},"Match a bucket code.",[58,125,126,131,133],{},[76,127,128],{},[22,129,130],{},"category",[76,132,96],{},[76,134,135],{},"Match findings with a report in this category.",[58,137,138,143,145],{},[76,139,140],{},[22,141,142],{},"branch",[76,144,96],{},[76,146,147],{},"Match findings sighted on this branch.",[58,149,150,155,157],{},[76,151,152],{},[22,153,154],{},"q",[76,156,96],{},[76,158,159],{},"Case-insensitive title, fingerprint, or bucket search.",[58,161,162,167,169],{},[76,163,164],{},[22,165,166],{},"sort",[76,168,96],{},[76,170,171,174,175,178,179,182,183,46],{},[22,172,173],{},"priority"," (default), ",[22,176,177],{},"updated_desc",", ",[22,180,181],{},"updated_asc",", or ",[22,184,185],{},"title",[32,187,188],{},"Filters combine with AND. The endpoint ignores list pagination fields and returns the complete filtered set up to the export safety limit.",[10,190,192],{"id":191},"response","Response",[15,194,198],{"className":195,"code":196,"language":197,"meta":20,"style":20},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"schemaVersion\": 1,\n  \"exportedAt\": \"2026-07-22T12:00:00.000Z\",\n  \"project\": {\n    \"id\": 42,\n    \"slug\": \"payments-api\",\n    \"name\": \"Payments API\",\n    \"mode\": \"security\"\n  },\n  \"filters\": {\n    \"campaignId\": \"81\",\n    \"severity\": \"high\"\n  },\n  \"mergedFindingsIncluded\": false,\n  \"total\": 1,\n  \"findings\": [\n    {\n      \"id\": 501,\n      \"canonical_title\": \"Authorization missing on refund\",\n      \"canonical_severity\": \"high\",\n      \"status\": \"new\",\n      \"fingerprint\": \"…\",\n      \"bucket_code\": \"auth\",\n      \"reports\": [\n        {\n          \"id\": 702,\n          \"model_code\": \"sonnet\",\n          \"pass_code\": \"http\",\n          \"categories\": [\"authz\"],\n          \"cwes\": [\"CWE-862\"],\n          \"files\": [\n            { \"path\": \"src\u002Frefunds.ts\", \"line\": 88 }\n          ],\n          \"evidence\": \"…\",\n          \"impact\": \"…\",\n          \"recommendation\": \"…\"\n        }\n      ]\n    }\n  ]\n}\n","json",[22,199,200,206,229,252,267,286,307,328,348,354,368,388,406,411,426,442,457,463,480,501,521,541,562,583,597,603,620,641,661,686,709,723,763,769,789,809,827,833,839,845,851],{"__ignoreMap":20},[25,201,202],{"class":27,"line":28},[25,203,205],{"class":204},"sMK4o","{\n",[25,207,209,212,216,219,222,226],{"class":27,"line":208},2,[25,210,211],{"class":204},"  \"",[25,213,215],{"class":214},"spNyl","schemaVersion",[25,217,218],{"class":204},"\"",[25,220,221],{"class":204},":",[25,223,225],{"class":224},"sbssI"," 1",[25,227,228],{"class":204},",\n",[25,230,232,234,237,239,241,244,248,250],{"class":27,"line":231},3,[25,233,211],{"class":204},[25,235,236],{"class":214},"exportedAt",[25,238,218],{"class":204},[25,240,221],{"class":204},[25,242,243],{"class":204}," \"",[25,245,247],{"class":246},"sfazB","2026-07-22T12:00:00.000Z",[25,249,218],{"class":204},[25,251,228],{"class":204},[25,253,255,257,260,262,264],{"class":27,"line":254},4,[25,256,211],{"class":204},[25,258,259],{"class":214},"project",[25,261,218],{"class":204},[25,263,221],{"class":204},[25,265,266],{"class":204}," {\n",[25,268,270,273,277,279,281,284],{"class":27,"line":269},5,[25,271,272],{"class":204},"    \"",[25,274,276],{"class":275},"sBMFI","id",[25,278,218],{"class":204},[25,280,221],{"class":204},[25,282,283],{"class":224}," 42",[25,285,228],{"class":204},[25,287,289,291,294,296,298,300,303,305],{"class":27,"line":288},6,[25,290,272],{"class":204},[25,292,293],{"class":275},"slug",[25,295,218],{"class":204},[25,297,221],{"class":204},[25,299,243],{"class":204},[25,301,302],{"class":246},"payments-api",[25,304,218],{"class":204},[25,306,228],{"class":204},[25,308,310,312,315,317,319,321,324,326],{"class":27,"line":309},7,[25,311,272],{"class":204},[25,313,314],{"class":275},"name",[25,316,218],{"class":204},[25,318,221],{"class":204},[25,320,243],{"class":204},[25,322,323],{"class":246},"Payments API",[25,325,218],{"class":204},[25,327,228],{"class":204},[25,329,331,333,336,338,340,342,345],{"class":27,"line":330},8,[25,332,272],{"class":204},[25,334,335],{"class":275},"mode",[25,337,218],{"class":204},[25,339,221],{"class":204},[25,341,243],{"class":204},[25,343,344],{"class":246},"security",[25,346,347],{"class":204},"\"\n",[25,349,351],{"class":27,"line":350},9,[25,352,353],{"class":204},"  },\n",[25,355,357,359,362,364,366],{"class":27,"line":356},10,[25,358,211],{"class":204},[25,360,361],{"class":214},"filters",[25,363,218],{"class":204},[25,365,221],{"class":204},[25,367,266],{"class":204},[25,369,371,373,375,377,379,381,384,386],{"class":27,"line":370},11,[25,372,272],{"class":204},[25,374,80],{"class":275},[25,376,218],{"class":204},[25,378,221],{"class":204},[25,380,243],{"class":204},[25,382,383],{"class":246},"81",[25,385,218],{"class":204},[25,387,228],{"class":204},[25,389,391,393,395,397,399,401,404],{"class":27,"line":390},12,[25,392,272],{"class":204},[25,394,106],{"class":275},[25,396,218],{"class":204},[25,398,221],{"class":204},[25,400,243],{"class":204},[25,402,403],{"class":246},"high",[25,405,347],{"class":204},[25,407,409],{"class":27,"line":408},13,[25,410,353],{"class":204},[25,412,414,416,419,421,423],{"class":27,"line":413},14,[25,415,211],{"class":204},[25,417,418],{"class":214},"mergedFindingsIncluded",[25,420,218],{"class":204},[25,422,221],{"class":204},[25,424,425],{"class":204}," false,\n",[25,427,429,431,434,436,438,440],{"class":27,"line":428},15,[25,430,211],{"class":204},[25,432,433],{"class":214},"total",[25,435,218],{"class":204},[25,437,221],{"class":204},[25,439,225],{"class":224},[25,441,228],{"class":204},[25,443,445,447,450,452,454],{"class":27,"line":444},16,[25,446,211],{"class":204},[25,448,449],{"class":214},"findings",[25,451,218],{"class":204},[25,453,221],{"class":204},[25,455,456],{"class":204}," [\n",[25,458,460],{"class":27,"line":459},17,[25,461,462],{"class":204},"    {\n",[25,464,466,469,471,473,475,478],{"class":27,"line":465},18,[25,467,468],{"class":204},"      \"",[25,470,276],{"class":275},[25,472,218],{"class":204},[25,474,221],{"class":204},[25,476,477],{"class":224}," 501",[25,479,228],{"class":204},[25,481,483,485,488,490,492,494,497,499],{"class":27,"line":482},19,[25,484,468],{"class":204},[25,486,487],{"class":275},"canonical_title",[25,489,218],{"class":204},[25,491,221],{"class":204},[25,493,243],{"class":204},[25,495,496],{"class":246},"Authorization missing on refund",[25,498,218],{"class":204},[25,500,228],{"class":204},[25,502,504,506,509,511,513,515,517,519],{"class":27,"line":503},20,[25,505,468],{"class":204},[25,507,508],{"class":275},"canonical_severity",[25,510,218],{"class":204},[25,512,221],{"class":204},[25,514,243],{"class":204},[25,516,403],{"class":246},[25,518,218],{"class":204},[25,520,228],{"class":204},[25,522,524,526,528,530,532,534,537,539],{"class":27,"line":523},21,[25,525,468],{"class":204},[25,527,93],{"class":275},[25,529,218],{"class":204},[25,531,221],{"class":204},[25,533,243],{"class":204},[25,535,536],{"class":246},"new",[25,538,218],{"class":204},[25,540,228],{"class":204},[25,542,544,546,549,551,553,555,558,560],{"class":27,"line":543},22,[25,545,468],{"class":204},[25,547,548],{"class":275},"fingerprint",[25,550,218],{"class":204},[25,552,221],{"class":204},[25,554,243],{"class":204},[25,556,557],{"class":246},"…",[25,559,218],{"class":204},[25,561,228],{"class":204},[25,563,565,567,570,572,574,576,579,581],{"class":27,"line":564},23,[25,566,468],{"class":204},[25,568,569],{"class":275},"bucket_code",[25,571,218],{"class":204},[25,573,221],{"class":204},[25,575,243],{"class":204},[25,577,578],{"class":246},"auth",[25,580,218],{"class":204},[25,582,228],{"class":204},[25,584,586,588,591,593,595],{"class":27,"line":585},24,[25,587,468],{"class":204},[25,589,590],{"class":275},"reports",[25,592,218],{"class":204},[25,594,221],{"class":204},[25,596,456],{"class":204},[25,598,600],{"class":27,"line":599},25,[25,601,602],{"class":204},"        {\n",[25,604,606,609,611,613,615,618],{"class":27,"line":605},26,[25,607,608],{"class":204},"          \"",[25,610,276],{"class":224},[25,612,218],{"class":204},[25,614,221],{"class":204},[25,616,617],{"class":224}," 702",[25,619,228],{"class":204},[25,621,623,625,628,630,632,634,637,639],{"class":27,"line":622},27,[25,624,608],{"class":204},[25,626,627],{"class":224},"model_code",[25,629,218],{"class":204},[25,631,221],{"class":204},[25,633,243],{"class":204},[25,635,636],{"class":246},"sonnet",[25,638,218],{"class":204},[25,640,228],{"class":204},[25,642,644,646,649,651,653,655,657,659],{"class":27,"line":643},28,[25,645,608],{"class":204},[25,647,648],{"class":224},"pass_code",[25,650,218],{"class":204},[25,652,221],{"class":204},[25,654,243],{"class":204},[25,656,19],{"class":246},[25,658,218],{"class":204},[25,660,228],{"class":204},[25,662,664,666,669,671,673,676,678,681,683],{"class":27,"line":663},29,[25,665,608],{"class":204},[25,667,668],{"class":224},"categories",[25,670,218],{"class":204},[25,672,221],{"class":204},[25,674,675],{"class":204}," [",[25,677,218],{"class":204},[25,679,680],{"class":246},"authz",[25,682,218],{"class":204},[25,684,685],{"class":204},"],\n",[25,687,689,691,694,696,698,700,702,705,707],{"class":27,"line":688},30,[25,690,608],{"class":204},[25,692,693],{"class":224},"cwes",[25,695,218],{"class":204},[25,697,221],{"class":204},[25,699,675],{"class":204},[25,701,218],{"class":204},[25,703,704],{"class":246},"CWE-862",[25,706,218],{"class":204},[25,708,685],{"class":204},[25,710,712,714,717,719,721],{"class":27,"line":711},31,[25,713,608],{"class":204},[25,715,716],{"class":224},"files",[25,718,218],{"class":204},[25,720,221],{"class":204},[25,722,456],{"class":204},[25,724,726,729,731,735,737,739,741,744,746,749,751,753,755,757,760],{"class":27,"line":725},32,[25,727,728],{"class":204},"            {",[25,730,243],{"class":204},[25,732,734],{"class":733},"swJcz","path",[25,736,218],{"class":204},[25,738,221],{"class":204},[25,740,243],{"class":204},[25,742,743],{"class":246},"src\u002Frefunds.ts",[25,745,218],{"class":204},[25,747,748],{"class":204},",",[25,750,243],{"class":204},[25,752,27],{"class":733},[25,754,218],{"class":204},[25,756,221],{"class":204},[25,758,759],{"class":224}," 88",[25,761,762],{"class":204}," }\n",[25,764,766],{"class":27,"line":765},33,[25,767,768],{"class":204},"          ],\n",[25,770,772,774,777,779,781,783,785,787],{"class":27,"line":771},34,[25,773,608],{"class":204},[25,775,776],{"class":224},"evidence",[25,778,218],{"class":204},[25,780,221],{"class":204},[25,782,243],{"class":204},[25,784,557],{"class":246},[25,786,218],{"class":204},[25,788,228],{"class":204},[25,790,792,794,797,799,801,803,805,807],{"class":27,"line":791},35,[25,793,608],{"class":204},[25,795,796],{"class":224},"impact",[25,798,218],{"class":204},[25,800,221],{"class":204},[25,802,243],{"class":204},[25,804,557],{"class":246},[25,806,218],{"class":204},[25,808,228],{"class":204},[25,810,812,814,817,819,821,823,825],{"class":27,"line":811},36,[25,813,608],{"class":204},[25,815,816],{"class":224},"recommendation",[25,818,218],{"class":204},[25,820,221],{"class":204},[25,822,243],{"class":204},[25,824,557],{"class":246},[25,826,347],{"class":204},[25,828,830],{"class":27,"line":829},37,[25,831,832],{"class":204},"        }\n",[25,834,836],{"class":27,"line":835},38,[25,837,838],{"class":204},"      ]\n",[25,840,842],{"class":27,"line":841},39,[25,843,844],{"class":204},"    }\n",[25,846,848],{"class":27,"line":847},40,[25,849,850],{"class":204},"  ]\n",[25,852,854],{"class":27,"line":853},41,[25,855,856],{"class":204},"}\n",[32,858,859],{},"The export includes finding columns plus every attached report and its category, Common Weakness Enumeration (CWE), and file provenance. Model-derived strings remain plain JSON strings.",[10,861,863],{"id":862},"identity-and-merge-behavior","Identity and merge behavior",[32,865,866,867,869,870,873],{},"The export includes live keeper findings only. Soft-merged tombstones are excluded, and ",[22,868,418],{}," is always ",[22,871,872],{},"false"," in schema version 1. Reports absorbed by a keeper appear under that keeper.",[32,875,876],{},"Campaign filtering uses finding sightings. It does not filter by the campaign where a finding was first created.",[10,878,880],{"id":879},"size-behavior","Size behavior",[32,882,883],{},"A filtered export can contain at most 20,000 findings. A larger result returns:",[15,885,887],{"className":17,"code":886,"language":19,"meta":20,"style":20},"413 export_too_large\n",[22,888,889],{"__ignoreMap":20},[25,890,891],{"class":27,"line":28},[25,892,886],{},[32,894,895,896,898],{},"Narrow the request with ",[22,897,80],{},", severity, status, bucket, category, branch, or search filters. The endpoint returns one JSON document and does not paginate or create an asynchronous export job.",[10,900,902],{"id":901},"errors","Errors",[52,904,905,918],{},[55,906,907],{},[58,908,909,912,915],{},[61,910,911],{},"Status",[61,913,914],{},"Error",[61,916,917],{},"Meaning",[71,919,920,935,948,963,978],{},[58,921,922,927,932],{},[76,923,924],{},[22,925,926],{},"400",[76,928,929],{},[22,930,931],{},"invalid_project_id",[76,933,934],{},"The path identifier is not an integer.",[58,936,937,942,945],{},[76,938,939],{},[22,940,941],{},"401",[76,943,944],{},"authentication error",[76,946,947],{},"No valid session or bearer token.",[58,949,950,955,960],{},[76,951,952],{},[22,953,954],{},"404",[76,956,957],{},[22,958,959],{},"project_not_found",[76,961,962],{},"The project does not exist in the authenticated tenant or token scope.",[58,964,965,970,975],{},[76,966,967],{},[22,968,969],{},"413",[76,971,972],{},[22,973,974],{},"export_too_large",[76,976,977],{},"More than 20,000 findings match.",[58,979,980,985,990],{},[76,981,982],{},[22,983,984],{},"429",[76,986,987],{},[22,988,989],{},"rate_limited",[76,991,992],{},"Request budget exhausted.",[32,994,995,996,1001,1002,1006],{},"Use the ",[997,998,1000],"a",{"href":999},"\u002Fdocs\u002Fguide\u002Ftriage","triage guide"," for finding lifecycle behavior and the ",[997,1003,1005],{"href":1004},"\u002Fdocs\u002Freference\u002Fconcepts","concepts glossary"," for keeper, merge, and sighting definitions.",[1008,1009,1010],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}",{"title":20,"searchDepth":208,"depth":208,"links":1012},[1013,1014,1015,1016,1017,1018],{"id":12,"depth":208,"text":13},{"id":49,"depth":208,"text":50},{"id":191,"depth":208,"text":192},{"id":862,"depth":208,"text":863},{"id":879,"depth":208,"text":880},{"id":901,"depth":208,"text":902},"Download filtered project findings with report, CWE, and file provenance","md",null,{},{"icon":1024},"i-lucide-download","\u002Fdocs\u002Freference\u002Ffindings-export",{"title":5,"description":1019},"docs\u002F4.reference\u002F4.findings-export","Yv7H2HoW9rtGFnhWZQ99yCLInjfA5ldHYWsKiJY5RlI",[1030,1021],{"title":1031,"path":1032,"stem":1033,"description":1034,"icon":1035,"children":-1},"Runner contract","\u002Fdocs\u002Freference\u002Frunner-contract","docs\u002F4.reference\u002F3.runner-contract","Exact process, marker, output, timeout, and result-submission behavior for model runners","i-lucide-file-json-2",1784724165141]