Findings

Base path /api/v1/findings on https://ionwarp.com. Authenticate with Authorization: Bearer $DASH_API_KEY and name the project with the Project-ID header. Writes are validated in declared mode; an operation this resource does not declare answers 405 operation_not_supported.

List findings

GET /api/v1/findings

curl "https://ionwarp.com/api/v1/findings?related_pr=141" \
  -H "Authorization: Bearer $DASH_API_KEY" \
  -H "Project-ID: pr_acme"

Show me the open findings on PR 141

data_query {
  "collection": "findings",
  "where": {
    "related_pr": 141
  }
}

Returns a paginated list of finding objects, newest first.

{
  "object": "list",
  "data": [
    {
      "object": "finding",
      "id": "obj_123",
      "related_pr": 141,
      "title": "Unbounded loop over untrusted input",
      "severity": "P1",
      "domain": "security",
      "reviewer": "code-review",
      "status": "open",
      "confidence": 4,
      "consequence": "A client that posts a very large array keeps the worker busy until the request times out.",
      "created_at": "2026-07-25T12:00:00.000Z",
      "updated_at": "2026-07-25T12:00:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

Parameters

Parameter	Type	Kind	Description
`related_pr`	number	filter	The pull request number this finding was raised on.
`severity`	string	filter	P0 \| P1 \| P2 — THE severity vocabulary, wire included (owner 2026-09-02); rows written before the backfill may still carry a legacy word, read through `findingPLevel`. One of `P0`, `P1`, `P2`.
`domain`	string	filter	The finding's domain (security, correctness, performance, …) — the reviewer's PRIMARY domain, not the reporting lens.
`status`	string	filter	open \| fixed \| closed \| wontfix — the OUTCOME (Plan v8 R1-C): fixed = the checker's re-check at head refuted it or a person resolved it; closed = the PR closed over it or its file left the PR (never a fix — resolved_by says which). A row the finding checker REFUTED is not a finding: it is soft-deleted, so no read returns it (plan 2026-09-23 §3 A1). An open row leaves `open` only when the checker's re-check at head refutes it, its file is not at head, or a human dispositions it (plan v4 2026-09-23 §3 B). (This description said `dismissed` until 2026-08-19 — a status no writer ever produced.) One of `open`, `fixed`, `closed`, `wontfix`.
`path`	string	filter	Repo-relative file path the finding anchors to.
`q`	string	search	Free-text search across `title`, `description`, `path`.
`sort`	string	sort	One of `related_pr`, `severity`, `first_seen_sha`; prefix with `-` to reverse.
`limit`	number	page	Rows to return, 1–100. Defaults to 20.
`cursor`	string	page	`next_cursor` from the previous page.

Retrieve a finding

GET /api/v1/findings/learning-tests-run-under-bun

curl "https://ionwarp.com/api/v1/findings/learning-tests-run-under-bun" \
  -H "Authorization: Bearer $DASH_API_KEY" \
  -H "Project-ID: pr_acme"

What is finding {id} about?

data_get {
  "collection": "findings",
  "object_id": "learning-tests-run-under-bun"
}

Returns the finding object.

{
  "object": "finding",
  "id": "obj_123",
  "related_pr": 141,
  "title": "Unbounded loop over untrusted input",
  "severity": "P1",
  "domain": "security",
  "reviewer": "code-review",
  "status": "open",
  "confidence": 4,
  "consequence": "A client that posts a very large array keeps the worker busy until the request times out.",
  "created_at": "2026-07-25T12:00:00.000Z",
  "updated_at": "2026-07-25T12:00:00.000Z"
}

Parameters

Parameter	Type	Kind	Description
`id`	string	path	The finding's id or slug.

What comes back (read-only)

Every finding carries the envelope below. The fields under it are computed or stamped by the platform — they are returned, never sent.

Field	Type	Description
`object`	string	Always `finding`.
`id`	string	Stable object id. Also accepted in place of `slug` on any path.
`slug`	string	URL-safe name, unique within the collection.
`created_at`	string	ISO-8601 timestamp of the first write.
`updated_at`	string	ISO-8601 timestamp of the most recent write. The cursor sorts on this.
`related_pr`	number	The pull request number this finding was raised on.
`title`	string	One-line finding title.
`severity`	string	P0 \| P1 \| P2 — THE severity vocabulary, wire included (owner 2026-09-02); rows written before the backfill may still carry a legacy word, read through `findingPLevel`.
`domain`	string	The finding's domain (security, correctness, performance, …) — the reviewer's PRIMARY domain, not the reporting lens.
`reviewer`	string	The reviewer lens that authored this finding (`code-review`, …), stamped by the writer; absent before 2026-08-27.
`status`	string	open \| fixed \| closed \| wontfix — the OUTCOME (Plan v8 R1-C): fixed = the checker's re-check at head refuted it or a person resolved it; closed = the PR closed over it or its file left the PR (never a fix — resolved_by says which). A row the finding checker REFUTED is not a finding: it is soft-deleted, so no read returns it (plan 2026-09-23 §3 A1). An open row leaves `open` only when the checker's re-check at head refutes it, its file is not at head, or a human dispositions it (plan v4 2026-09-23 §3 B). (This description said `dismissed` until 2026-08-19 — a status no writer ever produced.)
`resolved_by`	string	Why resolved (plan v4 2026-09-23 §3 B): rechecked (the finding checker, re-checking the open row at head, quoted the head line that refutes it) \| file_left_pr (the file is not at head) \| human (a wontfix/resolve reply) \| pr_closed (the PR closed, merged or not, with the row still open — never a fix, no resolved_at). (A refutation of a NEW finding is soft-deleted, never a resolution.) Rows closed before 2026-09-23 may still carry lens_verdict / span_changed / text_absent; the comment renders text_absent as Removed, never Fixed.
`resolved_at`	string	When a person or a re-check settled this finding (ISO 8601): set for `fixed` and for a person's `wontfix`, never for `closed`; the `findings_fixed` tile windows on it for `fixed` rows.
`description`	string	The FULL finding body — never clamped. This is the durable copy the GitHub comment renders a truncated view of.
`suggestion`	string	The committable remediation, when the reviewer provided one.
`path`	string	Repo-relative file path the finding anchors to.
`line`	number	1-indexed line the finding anchors to.
`first_seen_sha`	string	The head sha the finding was first raised at.
`last_seen_sha`	string	The most recent head sha the finding was re-confirmed at.
`review_task_id`	string	The review task that most recently wrote this finding.
`confidence`	number	Delivered confidence 1–5, DERIVED from `reviews` (the latest checker/re-check entry's, else the lane's own): 1 refuted · 2 unverified/unproven · 3 lane evidence read · 4 holds (the checker's verdict line found) · 5 fixed by a person.
`consequence`	string	The checker's one-sentence reason for its verdict — the input and what breaks for whom; the row's severity reason (plan 2026-09-30).
`evidence`	string	`path:line quote` the claim rests on — the lane's own quote (a re-check that finds it still open refreshes it with the head line).
`refuting_evidence`	string	`path:line quote` that makes the claim false (confidence 1).
`lane_severity`	string	The lane's severity hint; `severity` is what is delivered.
`reviews`	array	EVERY opinion on the finding, one entry each, oldest first (plan v5.1 2026-09-23 §3.3): stage lane\|checker\|recheck\|human, reviewer, run_id, sha, model, effort, harness, tools, evidence + trigger_evidence, evidence_found / evidence_read (computed by code), verdict, confidence (1–5, computed by code — agents/ionwarp/lib/finding-reviews.ts), why, cost_usd, duration_ms, at. `confidence` above is derived from it. Rendered as the app's Lane · Checker · Person bubbles; never on the PR comment.
`class_id`	string	The reviewer-example class the lane cited for this finding (`fail-open-veto`, …); absent when none.

Errors

Failures use { error: { type, code, message, param } }. The full code table is generated at Error Codes.