Retrieve Account's Finding

GET https://api.probely.com/findings/:id/

Query Findings by their compound Id.

Request

Path Parameters

id integerrequired

A unique integer value identifying this finding.

Responses

application/json

Schema
Example (from schema)

Schema

id stringrequired

Global ID in the format: <TARGET_ID>-<FINDING_ID>

target

object

required

id stringrequired

name stringdeprecated

Possible values: <= 255 characters

Name of the target.
The maximum length is 255 characters.

site

object

Core settings of the target.
Includes basic target information (like the name, description, and URL) and scanning information (like the authentication and navigation sequences).

id stringrequired

A unique Base58 value identifying this object.

name string

Possible values: <= 255 characters

Name of the target or extra host.
The maximum length is 255 characters.

desc stringnullable

Description of the target.

url urirequired

URL of the target.

host stringrequired

Hostname of the target.

has_form_login boolean

If true, the target authentication is done through a login form.
Read more about how to set up target authentication (login form).
Defaults to false.

form_login_url uri

URL of the login form of the target.

form_login_check_pattern string

Possible values: <= 255 characters

Pattern to check a successful login.
The maximum length is 255 characters.

form_login

object[]

logout_detection_enabled boolean

If true, detects any undesired logouts that may occur during scans to log back in.
Requires check_session_url and logout_detectors to be defined.
Defaults to false.

has_sequence_login boolean

If true, the target authentication is done through a recorded login sequence.
Read more about how to set up target authentication (login sequence).
Defaults to false.

has_basic_auth boolean

If true, the target authentication is done through username and password credentials.
Defaults to false.

basic_auth

object

headers

object[]

cookies

object[]

whitelist

Additional paths to crawl and scan. For example, "archive/search?query=probely". Only relative paths are allowed. The blacklist takes precedence over the whitelist.

blacklist

URLs to avoid scanning. For example, "https://example.com/pic-delete.php*" or "*.archive.example.com". URLs need to be absolute and wildcards (*) are allowed. The blacklist takes precedence over the whitelist.

changed date-timerequired

Date and time of the last change, in ISO 8601 UTC format.
For example, "2023-08-09T13:27:43.8208302".

changed_by

object

required

auth_enabled boolean

If true, the target has authentication.
Defaults to false.

logout_condition string

Possible values: [any, all]

Type of combination of the logout conditions:

any - Is logged out if any condition is verified.
all - Is logged out only if all condition are verified.

check_session_url string

URL to check session.

has_otp boolean

If true, the target has two-factor authentication (2FA).
Read more about how to set up target two-factor authentication (2FA).
Defaults to false.

otp_secret string

The seed/secret obtained when the QR code is displayed to be scanned by the third-party authenticator (TPA) app installed on the phone (e.g., Google Authenticator, 1Password, Authy, Microsoft Authenticator, etc.).
Read more about how to set up target two-factor authentication (2FA).

otp_algorithm string

Possible values: [SHA1, SHA256, SHA512]

Default value: SHA1

Secure hash algorithm (SHA) to generate the one-time password (OTP):
(Defaults to SHA1)

SHA1 - Sha1
SHA256 - Sha256
SHA512 - Sha512

otp_digits integer

Possible values: >= -2147483648 and <= 2147483647, [6, 7, 8]

Default value: 6

Number of digits of the one-time password (OTP):
(Defaults to 6)

6 - Six
7 - Seven
8 - Eight

otp_field string

CSS selector of the HTML element in the page to enter the one-time password (OTP).
For example, a text input field. Read more about how to obtain a CSS selector.
Defaults to "".

otp_submit string

CSS selector of the HTML element in the page to submit the one-time password (OTP). For example, a button.
Read more about how to obtain a CSS selector.
Defaults to "".

otp_login_sequence_totp_value string

Possible values: >= 6 characters and <= 8 characters

One-time password (OTP) obtained at the time when the login sequence was recorded, i.e., the time-based one-time password (TOTP).
Defaults to "".

otp_type string

otp_url stringrequired

stack

object[]

verified booleanrequired

If true, the domain is verified. Read-only.

verification_token stringrequired

Token used to verify the domain. Read-only.

verification_date date-timerequired

Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only.

verification_method stringrequired

Possible values: [file, back_office, existing_domain, dns_txt, dns, dns_cname, meta_tag, whitelist, email, aws_route53, cloudflare, waved]

Method used in the domain verification:

file - Verifies the domain against a text file in the root directory of the website. Learn more in this article.
back_office - Automatically set if manually verified in the back-office. Read-only.
existing_domain - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only.
dns_txt - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in this article.
dns - Same as dns_txt.
dns_cname - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in this article.
meta_tag - Verifies the domain against a meta tag in the index page of the website. Learn more in this article.
whitelist - Automatically verifies if the domain is in the whitelist
email - Automatically verifies a domain if the user's email is in the same domain as the target
aws_route53 - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone.
cloudflare - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone.
waved - Automatically verifies a domain if there is a waver agreement.

verification_last_error stringrequired

Error of the last verification of the domain. Read-only.

api_scan_settings

object

required

type string

Type of target.
Possible values are "single" for a web application and "api" for an API.
Defaults to "single".

desc stringnullabledeprecated

Description of the target.
Defaults to "".

labels

object[]

has_assets booleanrequired

report_fileformat string

Possible values: [pdf, docx]

Report format for the target:
(Defaults to pdf)

pdf - PDF file format.
docx - DOCX file format.

scanning_agent

object

nullable

teams

object[]

required

blackout_period

object

required

scans string[]

Scans that originated the vulnerability finding.

labels

object[]

required

fix stringrequired

Description of how to fix the vulnerability.

requests

object[]

required

evidence stringrequired

Evidence with proof of the vulnerability finding.

extra stringrequired

Extra details about the vulnerability finding.

definition

object

required

url stringrequired

Possible values: <= 66000 characters

URL of the vulnerability finding. For example, "http://www.example.com/user/show-details". The maximum length is 66000 characters.

path stringrequired

URL path of the vulnerability finding. For example, "user/show-details".

method stringrequired

Possible values: [get, post, trace, options, put, delete]

HTTP method used in the request:

get - GET
post - POST
trace - TRACE
options - OPTIONS
put - PUT
delete - DELETE

insertion_point string

Possible values: [cookie, parameter, arbitrary_url_param, header, url_folder, url_filename, json_parameter, request_body, multipart_parameter, graphql_parameter, non_standard_parameter, ``]

Insertion point of the parameter:

cookie - Cookie
parameter - Parameter
arbitrary_url_param - Parameter
header - Header
url_folder - URL Path
url_filename - URL Path
json_parameter - JSON Parameter
request_body - Request Body
multipart_parameter - Multipart Parameter
graphql_parameter - GraphQL Parameter
non_standard_parameter - Non Standard Parameter

parameter string

Possible values: <= 1024 characters

Name of the inserted parameter.
The maximum length is 1024 characters.

value stringnullablerequired

Value of the inserted parameter.

params stringrequired

Query parameters of the vulnerability finding, in JSON format. For example, "{'name': ['Joe Smith'], 'phone': ['+919999999999', '+628888888888']}"

assignee

object

required

state string

Possible values: [notfixed, invalid, accepted, fixed]

State of the vulnerability finding:
(Read more about the meaning of vulnerability findings states)

notfixed - Not Fixed
invalid - Invalid
accepted - Accepted
fixed - Fixed

severity integer

Possible values: >= -2147483648 and <= 2147483647, [10, 20, 30]

Severity of the vulnerability finding:

10 - low
20 - medium
30 - high

cvss_score doublenullablerequired

Score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).

cvss_vector stringrequired

Vector with the metrics of the score of the vulnerability finding according to the Common Vulnerability Scoring System (CVSS).

last_found date-time

Date and time of when the vulnerability was last found, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302"

retesting booleanrequired

If true, the vulnerability will be retested.
If, after the retest, the vulnerability is no longer found, the vulnerability finding is marked as fixed. Otherwise, it is marked as not fixed.

new booleanrequired

If true, this is a newly found vulnerability. If false, this vulnerability has been found in previous scans.

created_at date-timenullablerequired

Timestamp of the Finding's creation.

changed date-timerequired

Date and time of the last change, in ISO 8601 UTC format.
For example, "2023-08-09T13:27:43.8208302".

changed_by

object

required

comment stringnullable

Comment on the object.

{
  "id": "string",
  "target": {
    "id": "string",
    "site": {
      "id": "string",
      "name": "string",
      "desc": "string",
      "url": "string",
      "host": "string",
      "has_form_login": false,
      "form_login_url": "string",
      "form_login_check_pattern": "string",
      "form_login": [
        {
          "name": "string",
          "value": "string"
        }
      ],
      "logout_detection_enabled": false,
      "has_sequence_login": false,
      "has_basic_auth": false,
      "basic_auth": {
        "username": "string",
        "password": "string"
      },
      "headers": [
        {
          "name": "string",
          "value": "string",
          "allow_testing": false,
          "authentication": false
        }
      ],
      "cookies": [
        {
          "name": "string",
          "value": "string",
          "allow_testing": false,
          "authentication": false
        }
      ],
      "changed": "2024-07-29T15:51:28.071Z",
      "changed_by": {
        "id": "string",
        "email": "user@example.com",
        "name": "string"
      },
      "auth_enabled": false,
      "logout_condition": "any",
      "check_session_url": "string",
      "has_otp": true,
      "otp_secret": "string",
      "otp_algorithm": "SHA1",
      "otp_digits": 6,
      "otp_field": "string",
      "otp_submit": "string",
      "otp_login_sequence_totp_value": "string",
      "otp_type": "string",
      "otp_url": "string",
      "stack": [
        {
          "id": "string",
          "name": "string",
          "desc": "string"
        }
      ],
      "verified": true,
      "verification_token": "string",
      "verification_date": "2024-07-29T15:51:28.071Z",
      "verification_method": "file",
      "verification_last_error": "string",
      "api_scan_settings": {
        "api_schema_type": "openapi",
        "api_schema_url": "string",
        "api_schema_file": "string",
        "custom_api_parameters": [
          {
            "name": "string",
            "value": "string"
          }
        ],
        "media_type": "application/json",
        "api_login_url": "string",
        "api_login_payload": "string",
        "api_login_enabled": true,
        "api_login_token_field": "string",
        "token_prefix": "string",
        "token_parameter_name": "string",
        "token_parameter_location": "cookie"
      }
    },
    "type": "string",
    "labels": [
      {
        "id": "string",
        "name": "string",
        "color": "string",
        "changed_by": {
          "id": "string",
          "email": "user@example.com",
          "name": "string"
        },
        "changed": "2024-07-29T15:51:28.071Z"
      }
    ],
    "has_assets": true,
    "report_fileformat": "pdf",
    "scanning_agent": {
      "id": "string",
      "name": "string",
      "installer_generated": true,
      "online": true,
      "fallback": true,
      "rx_bytes": 0,
      "tx_bytes": 0,
      "latest_handshake": 0
    },
    "teams": [
      {
        "id": "string",
        "name": "string"
      }
    ],
    "blackout_period": {
      "begin": "string",
      "cease": "string",
      "weekdays": [
        0
      ],
      "enabled": true,
      "timezone": "string",
      "changed": "2024-07-29T15:51:28.071Z",
      "changed_by": {
        "id": "string",
        "email": "user@example.com",
        "name": "string"
      }
    }
  },
  "scans": [
    "string"
  ],
  "labels": [
    {
      "id": "string",
      "name": "string",
      "color": "string",
      "changed_by": {
        "id": "string",
        "email": "user@example.com",
        "name": "string"
      },
      "changed": "2024-07-29T15:51:28.071Z"
    }
  ],
  "fix": "string",
  "requests": [
    {
      "request": "string",
      "response": "string"
    }
  ],
  "evidence": "string",
  "extra": "string",
  "definition": {
    "id": "string",
    "name": "string",
    "desc": "string"
  },
  "url": "string",
  "path": "string",
  "method": "get",
  "insertion_point": "cookie",
  "parameter": "string",
  "value": "string",
  "params": "string",
  "assignee": {
    "id": "string",
    "email": "user@example.com",
    "name": "string"
  },
  "state": "notfixed",
  "severity": 10,
  "cvss_score": 0,
  "cvss_vector": "string",
  "last_found": "2024-07-29T15:51:28.071Z",
  "retesting": true,
  "new": true,
  "created_at": "2024-07-29T15:51:28.071Z",
  "changed": "2024-07-29T15:51:28.071Z",
  "changed_by": {
    "id": "string",
    "email": "user@example.com",
    "name": "string"
  },
  "comment": "string"
}

application/json

Schema
Example (from schema)

Schema

<field name> string[]

non_field_errors string[]

{
  "<field name>": [
    "Errors related to field <field name>."
  ],
  "non_field_errors": [
    "Errors not related to any field specific field."
  ]
}

application/json

Schema
Example (from schema)

Schema

detail string

{
  "detail": "Incorrect authentication credentials."
}

application/json

Schema
Example (from schema)

Schema

detail string

{
  "detail": "Not found."
}

application/json

Schema
Example (from schema)

Schema

detail string

{
  "detail": "Unexpected error while handling your request."
}

CURL

curl -L 'https://api.probely.com/findings/:id/' \
-H 'Accept: application/json' \
-H 'Authorization: JWT <YOUR_API_TOKEN>'

ResponseClear

Click the Send API Request button above and see the response here!

Retrieve Account's Finding

https://api.probely.com/findings/:id/

Request​

Path Parameters

Responses​

Request

Responses