Get issue evidence

{
  "issueId": "string",
  "poc": {
    "fileName": "string",
    "contents": "string",
    "language": "string"
  },
  "pocOutput": {
    "stdout": "string",
    "stderr": "string",
    "exitCode": 1,
    "executedAt": "2024-01-15T09:30:00Z",
    "truncated": true
  },
  "steps": [
    {
      "artifactIds": [
        "string"
      ],
      "description": "string",
      "title": "string"
    }
  ],
  "artifacts": [
    {
      "id": "string",
      "kind": "http-exchange",
      "provenance": {
        "capturedAt": "string",
        "messageId": "string",
        "partId": "string",
        "sessionId": "string",
        "toolCallId": "string"
      },
      "redaction": {
        "applied": true,
        "fields": [
          "string"
        ]
      },
      "request": {
        "body": "string",
        "headers": {},
        "method": "string",
        "url": "string"
      },
      "response": {
        "body": "string",
        "headers": {},
        "status": 1,
        "statusText": "string"
      },
      "truncated": true
    }
  ],
  "evidenceStatus": "string",
  "attackPath": [
    {
      "application": {
        "id": "string",
        "name": "string"
      },
      "host": "string",
      "relationship": "string",
      "notes": "string"
    }
  ],
  "codeSnippet": {
    "repositoryId": "string",
    "path": "string",
    "startLine": 1,
    "endLine": 1,
    "commit": "string",
    "content": "string",
    "truncated": true
  },
  "codeSnippetReason": "no_repository"
}

Each kind of evidence is null when unavailable. stdout, stderr and snippet content are each capped at 65,536 UTF-8 bytes, and truncated is true when a field in that object was shortened. Credentials are redacted before the cap is applied. Treat evidence as sensitive even after redaction.

Requires the issues:read API key scope.

Authentication

AuthorizationBearer

A workspace API key, sent as Authorization: Bearer.

x-api-keystring

A workspace API key, sent as x-api-key.

Path parameters

issueIdstringRequired

Issue UUID or label, e.g. VULN-000123.

Response

The issue’s evidence.

issueIdstringformat: "uuid"

pocobject or null

pocOutputobject or null

stepslist of objects or null

Recorded evidence steps, in order. Null when no completed evidence summary exists. Findings summarized before artifacts were introduced carry the older step shape, with artifacts inline.

artifactslist of objects or null

evidenceStatusstring or null

Status of the recorded evidence summary, e.g. ready. Reading evidence does not generate one.

attackPathlist of objects or null

Ordered hops of a multi-application finding.

codeSnippetobject or null

Read at the finding's recorded commit, never the current branch tip.

codeSnippetReasonenum or null

Why codeSnippet is null. Null when a snippet is returned.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error