API › Issues

Get an issue

One issue with its severity, what Rustine observed and where it saw it. The fix is asked for separately, with Unlock the fix.

GEThttps://api.rustine.io/v1/issues/{issue_id}

OAuth permission: scans:read · an API key has them all

Open in Claude Open in ChatGPT

Path parameters

issue_idstringrequired
Issue id.

Response

idstring
Issue id; it keeps its identity from one scan to the next.
objectstring
project_idstring
Project of the issue.
target_idstring
Target where it was found.
addressstring
Hostname of the site or owner/repo.
control_idstring
The check that found it (stable identifier).
familystring
Family of the check.
databasesecretsexposedFilespersonalDatavulnerableVersionsconfigurationcomplianceservercode
severitystring
criticalhighmediumlowinfo
confidencestring
How sure the finding is.
confirmedlikelyestimated
statusstring
open; fixed (a later scan or recheck no longer finds it); false_positive (left out of the score); accepted_risk (kept in the score).
openfixedfalse_positiveaccepted_risk
titlestring
One line, in the language of the key's owner.
explanationstring
The risk in plain words, in the key owner's language.
detailstring
Technical detail, in the key owner's language.
locationstring
Where: a path, a table, or file:line@commit in a repository.
filestring | null
Repository issue: the file.
lineinteger | null
Repository issue: the line.
commitstring | null
Repository issue: the commit analysed.
evidencestring
What the check observed, secrets masked.
fix_unlockedboolean
Whether its fix is unlocked (readable for free).
status_reasonstring | null
Why it was marked a false positive or an accepted risk.
marked_bystring | null
Who marked it: an agent, an API key's name, or app.
first_seen_atstring
First scan that found it.
last_seen_atstring
Last scan that found it.
fixed_atstring | null
When it was found fixed.

Errors

Status	error.code	What happens
401	authentication_required	No key in the request. Pass it in the `Authorization: Bearer rst_…` header, never in the address.
401	invalid_api_key	The key or OAuth token is wrong, revoked or expired. Check it is copied in full, or create a new key.
402	api_plan_required	The workspace is on the Free plan. The API comes with Pro, or on a 14-day trial with Solo.
402	api_trial_ended	Solo's 14-day trial is over. Move to Pro: your keys work again at once.
403	scope_missing	The OAuth token lacks the permission this route needs (shown on its page). Reconnect the agent to grant it. An API key has every permission.
404	resource_not_found	Nothing with this id in the key's workspace. An object of another workspace answers the same: its existence is never revealed.
429	rate_limited	Too many requests for this key (120 per minute). Wait `Retry-After` seconds.
500	internal_error	An error on our side, reported automatically. Retry later; give the `Request-Id` to support if it comes back.
503	service_unavailable	Rustine is unavailable for a moment. Retry with the same `Idempotency-Key`.