# List findings for a specific campaign

Returns findings for the campaign, newest first by execution order. Filter with `type` (failed, passed, or errors); use `lastN` to keep only the N newest findings.

Endpoint: GET /api/v3.0/redteaming/orgs/{orgUuid}/applications/{applicationUuid}/projects/{projectUuid}/targets/{targetId}/campaigns/{campaignId}/findings
Version: 3.0
Security: bearer-key

## Security:

  - `bearer-key` (unknown)
    http bearer JWT

## Path parameters:

  - `orgUuid` (string, required)

  - `applicationUuid` (string, required)

  - `projectUuid` (string, required)

  - `targetId` (string, required)

  - `campaignId` (string, required)

## Query parameters:

  - `pretty` (boolean)
    When `true`, indent the JSON body (2 spaces) and render multiline string
fields (e.g. YAML `config`) with literal newlines for human readability.
Default off (compact JSON). Intended for interactive use; omit for clients
that parse the body as strict JSON.

  - `cursor` (integer)

  - `limit` (integer)

  - `type` (string)

  - `lastN` (integer)
    Return only the N newest findings (after the other filters). `totalItems` is capped at N and `cursor` / `limit` page within those N findings. Must be sent once.

## Header parameters:

  - `X-Correlation-ID` (string)
    Optional caller-supplied correlation id. Must be a UUID when present.
When omitted or blank, the API generates a UUID. A non-UUID value
returns 400 `CORRELATION.INVALID`. If a write fails because a UUID is already in use, the API returns 409
`UUID.DUPLICATE`. The value used (caller or generated) is echoed as
`supportToken` and in the `X-Correlation-ID` response header.

## Response 200:

  - `200` (unknown)
    Finding collection. `probeId` and `strategyId` are human-readable probe and strategy names. `gradingResult` includes pass, score (finding risk score), and reason. Failed findings expose the explanation only under `gradingResult.reason`; top-level `error` appears only when `type=errors`. `_links.suppress` is present when the finding is not suppressed; `_links.unsuppress` when it is suppressed.

## Response 200 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `additionalData` (object, required)

  - `additionalData.totalItems` (string, required)
    Total number of items, encoded as a string.

  - `additionalData.cursor` (integer)

  - `additionalData.next` (string)
    URL of the next page, or null when this page is the last.

  - `response` (array, required)

  - `response.id` (string, required)

  - `response.campaignId` (string, required)

  - `response.targetId` (string, required)

  - `response.probeId` (string, required)
    Human-readable probe name.

  - `response.strategyId` (string)
    Optional. Human-readable strategy name. Omitted when the finding has no strategy.

  - `response.prompt` (string, required)
    Original test question (probe goal) for this finding.

  - `response.output` (string, required)

  - `response.error` (string)
    Optional. Present only for runtime-error findings (`type=errors` listings, or get-finding when the result is a runtime error). Omitted for failed and passed findings; use `gradingResult.reason` for grading explanations. Filtered like the UI Errors tab (stack stripped; noisy transport strings may be returned as `ERROR`).

  - `response.gradingResult` (object, required)

  - `response.gradingResult.pass` (boolean, required)

  - `response.gradingResult.score` (number, required)
    Finding risk score.

  - `response.gradingResult.reason` (string, required)

  - `response.suppression` (object)
    Only these fields are returned; other stored suppression data is not exposed.

  - `response.suppression.is_suppressed` (boolean, required)

  - `response.suppression.changed_by` (string, required)

  - `response.suppression.changed_from` (string, required)
    Enum: "failure", "pass", "error"

  - `response.suppression.reason` (object, required)

  - `response.suppression.reason.kind` (string, required)

  - `response.suppression.reason.text` (string, required)

  - `response.suppression.created_at` (integer, required)

  - `response.suppression.updated_at` (integer, required)

  - `response.multiInputPrompts` (array)
    Optional. Present when the finding has multiple input prompts.

  - `response.multiInputPrompts.name` (string, required)

  - `response.multiInputPrompts.value` (string, required)

  - `response.variant` (string)
    Optional. Present when the strategy used a different attack text than `prompt` (for example an encoded or rewritten attempt). Applies to failed and passed findings whenever a rewrite is available.

  - `response.variantTurns` (array)
    Optional. Present for multi-turn strategies when intermediate attack texts are available (failed or passed). At most the last 20 turns are returned; each turn may be truncated.

  - `response._links` (object, required)

## Response 200 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 400:

  - `400` (unknown)
    X-Correlation-ID is not a UUID (CORRELATION.INVALID), cursor is invalid (PAGE.CURSOR), or limit or lastN is out of range, not a whole number, or repeated (PARAM.INT_RANGE, PARAM.REPEATED).

## Response 400 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.SCANNER_OUTDATED", "CONFIG.NO_ACTIVE_SCANNER", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 400 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 401:

  - `401` (unknown)
    Authentication failed. The job report returns this JSON envelope and never a PDF or CSV attachment. Codes: AUTH.REQUIRED, AUTH.FAILED, AUTH.USER_HEADER_MISMATCH, JWT.EXPIRED, JWT.SIGNATURE, JWT.STRUCTURE, JWT.MISSING_CLAIMS, JWT.UNAVAILABLE, JWT.CLAIM_INVALID, JWT.VERIFICATION_FAILED.

## Response 401 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.SCANNER_OUTDATED", "CONFIG.NO_ACTIVE_SCANNER", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 401 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 403:

  - `403` (unknown)
    Authentication succeeded but the call is not allowed. AUTH.SERVICE_BOT: a service-to-service token cannot call this API. AUTH.ORG_MISMATCH: the organization in the URL does not match the access token. AUTH.INSUFFICIENT_PERMISSIONS: the token lacks permission for this action. Template update and delete also return AUTH.INSUFFICIENT_PERMISSIONS when the caller is not the template owner and does not have manage-settings access. TEMPLATE.ORG_SCOPE_DENIED: a template write whose scope is organization without organization-level manage-targets permission.

## Response 403 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.SCANNER_OUTDATED", "CONFIG.NO_ACTIVE_SCANNER", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 403 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 404:

  - `404` (unknown)
    No campaign exists with this id for the target, or a campaign id in the filter is not on the target (CAMPAIGN.NOT_FOUND).

## Response 404 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.SCANNER_OUTDATED", "CONFIG.NO_ACTIVE_SCANNER", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 404 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 409:

  - `409` (unknown)
    Remediations are still being generated (JOB.RESULTS_NOT_READY). Retry this request shortly.

## Response 409 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.SCANNER_OUTDATED", "CONFIG.NO_ACTIVE_SCANNER", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 409 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 429:

  - `429` (unknown)
    The caller exceeded the per-user request rate (RATE.LIMITED). The default is 600 requests per minute per user. Retry after the number of seconds in Retry-After.

## Response 429 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.SCANNER_OUTDATED", "CONFIG.NO_ACTIVE_SCANNER", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 429 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

  - `Retry-After` (integer)
    Seconds to wait before retrying.

## Response 500:

  - `500` (unknown)
    INTERNAL.ERROR: an unexpected failure. Retry and include supportToken if it continues. AUTH.PERMISSIONS_UNRESOLVED: permissions could not be resolved.

## Response 500 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.SCANNER_OUTDATED", "CONFIG.NO_ACTIVE_SCANNER", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 500 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 503:

  - `503` (unknown)
    The API is temporarily unavailable and is not accepting this request. This body is not the error envelope.

## Response 503 fields (application/json):

  - `status` (string, required)
    Enum: "not-ready"

  - `reason` (string, required)
    Why the API is not accepting the request.

## Response 400 examples:

  - `PATH.INVALID_UUID` (unknown)
    {name} is the path parameter that is not a UUID, for example targetId.

  - `CORRELATION.INVALID` (unknown)

  - `PAGE.CURSOR` (unknown)

  - `PARAM.INT_RANGE` (unknown)
    Sample is limit from 1 to 200. Campaign lastN is 1 to 200. Findings lastN is 1 to 10000. The live message substitutes {name} and {max}.

  - `PARAM.REPEATED` (unknown)
    Sample uses the limit parameter. The live message substitutes {name}.

## Response 401 examples:

  - `AUTH.REQUIRED` (unknown)

  - `AUTH.FAILED` (unknown)

  - `AUTH.USER_HEADER_MISMATCH` (unknown)

  - `JWT.EXPIRED` (unknown)

  - `JWT.SIGNATURE` (unknown)

  - `JWT.STRUCTURE` (unknown)

  - `JWT.MISSING_CLAIMS` (unknown)

  - `JWT.UNAVAILABLE` (unknown)

  - `JWT.CLAIM_INVALID` (unknown)

  - `JWT.VERIFICATION_FAILED` (unknown)

## Response 403 examples:

  - `TEMPLATE.ORG_SCOPE_DENIED` (unknown)

  - `AUTH.SERVICE_BOT` (unknown)

  - `AUTH.ORG_MISMATCH` (unknown)

  - `AUTH.INSUFFICIENT_PERMISSIONS` (unknown)

## Response 404 examples:

  - `CAMPAIGN.NOT_FOUND` (unknown)

## Response 409 examples:

  - `JOB.RESULTS_NOT_READY` (unknown)

## Response 429 examples:

  - `RATE.LIMITED` (unknown)

## Response 500 examples:

  - `INTERNAL.ERROR` (unknown)

  - `AUTH.PERMISSIONS_UNRESOLVED` (unknown)