API › Issues

List issues

A project's issues, worst first, with how sure Rustine is. Filter by status, severity or site.

GEThttps://api.rustine.io/v1/projects/{project_id}/issues

OAuth permission: scans:read · an API key has them all

Issues of a site not proved yet stay hidden: the site only gives how many there are (targets[].hidden_issues in Get a project), until you prove it is yours.

Path parameters

project_idstringrequired
Project id.

Query parameters

limitintegeroptional
How many objects to return, 1 to 100 (default 20).
starting_afterstringoptional
Cursor: the id of the last object of the previous page.
statusstringoptional
Only issues in this status.
openfixedfalse_positiveaccepted_risk
severitystringoptional
Only issues of this severity.
criticalhighmediumlowinfo
target_idstringoptional
Only the issues of this target.

Response

objectstring
dataarray of object
- idstring
  Issue id; it keeps its identity from one scan to the next.
- objectstring
- project_idstring
  Project of the issue.
- target_idstring
  Target where it was found.
- addressstring
  Hostname of the site or owner/repo.
- control_idstring
  The check that found it (stable identifier).
- familystring
  Family of the check.
  databasesecretsexposedFilespersonalDatavulnerableVersionsconfigurationcomplianceservercode
- severitystring
  criticalhighmediumlowinfo
- confidencestring
  How sure the finding is.
  confirmedlikelyestimated
- statusstring
  open; fixed (a later scan or recheck no longer finds it); false_positive (left out of the score); accepted_risk (kept in the score).
  openfixedfalse_positiveaccepted_risk
- titlestring
  One line, in the language of the key's owner.
- explanationstring
  The risk in plain words, in the key owner's language.
- detailstring
  Technical detail, in the key owner's language.
- locationstring
  Where: a path, a table, or file:line@commit in a repository.
- filestring | null
  Repository issue: the file.
- lineinteger | null
  Repository issue: the line.
- commitstring | null
  Repository issue: the commit analysed.
- evidencestring
  What the check observed, secrets masked.
- fix_unlockedboolean
  Whether its fix is unlocked (readable for free).
- status_reasonstring | null
  Why it was marked a false positive or an accepted risk.
- marked_bystring | null
  Who marked it: an agent, an API key's name, or app.
- first_seen_atstring
  First scan that found it.
- last_seen_atstring
  Last scan that found it.
- fixed_atstring | null
  When it was found fixed.
has_moreboolean
Whether more objects follow: pass the last id as starting_after.

Errors

Status	error.code	What happens
400	parameter_invalid	A parameter is missing or invalid; `param` names it.
400	cursor_invalid	`starting_after` is not the id of an item of this list.
401	authentication_required	No key in the request. Pass it in the `Authorization: Bearer rst_…` header, never in the address.
401	invalid_api_key	The key or OAuth token is wrong, revoked or expired. Check it is copied in full, or create a new key.
402	api_plan_required	The workspace is on the Free plan. The API comes with Pro, or on a 14-day trial with Solo.
402	api_trial_ended	Solo's 14-day trial is over. Move to Pro: your keys work again at once.
403	scope_missing	The OAuth token lacks the permission this route needs (shown on its page). Reconnect the agent to grant it. An API key has every permission.
404	resource_not_found	Nothing with this id in the key's workspace. An object of another workspace answers the same: its existence is never revealed.
429	rate_limited	Too many requests for this key (120 per minute). Wait `Retry-After` seconds.
500	internal_error	An error on our side, reported automatically. Retry later; give the `Request-Id` to support if it comes back.
503	service_unavailable	Rustine is unavailable for a moment. Retry with the same `Idempotency-Key`.