List the Triage queue

curl --request GET \
  --url https://neo.api.projectdiscovery.io/api/v1/triage/findings \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://neo.api.projectdiscovery.io/api/v1/triage/findings', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://neo.api.projectdiscovery.io/api/v1/triage/findings",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://neo.api.projectdiscovery.io/api/v1/triage/findings"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://neo.api.projectdiscovery.io/api/v1/triage/findings")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "count": 123,
  "findings": [
    {
      "context": "<string>",
      "description": "<string>",
      "effective_severity": "none",
      "external_key": "<string>",
      "first_seen_at": "2023-11-07T05:31:56Z",
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "last_seen_at": "2023-11-07T05:31:56Z",
      "reporter": "<string>",
      "revision": 123,
      "severity": "none",
      "source_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "source_kind": "hackerone",
      "source_name": "<string>",
      "source_status": "<string>",
      "stage": "untriaged",
      "title": "<string>",
      "url": "<string>",
      "archived_at": "2023-11-07T05:31:56Z",
      "latest_retest": {
        "created_at": "2023-11-07T05:31:56Z",
        "finding_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "finding_revision": 123,
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "kind": "triage",
        "model": "<string>",
        "status": "queued",
        "completed_at": "2023-11-07T05:31:56Z",
        "error_code": "<string>",
        "internal_summary": "<string>",
        "retest_outcome": "fixed",
        "suggested_response": "<string>",
        "task_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "task_status": "pending",
        "triage_severity": "none",
        "triage_status": "valid"
      },
      "latest_run": {
        "created_at": "2023-11-07T05:31:56Z",
        "finding_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "finding_revision": 123,
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "kind": "triage",
        "model": "<string>",
        "status": "queued",
        "completed_at": "2023-11-07T05:31:56Z",
        "error_code": "<string>",
        "internal_summary": "<string>",
        "retest_outcome": "fixed",
        "suggested_response": "<string>",
        "task_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "task_status": "pending",
        "triage_severity": "none",
        "triage_status": "valid"
      },
      "raw": {},
      "removed_at": "2023-11-07T05:31:56Z",
      "review": {
        "version": 123,
        "decided_at": "2023-11-07T05:31:56Z",
        "decided_by_email": "<string>",
        "decision": "accepted",
        "decline_reason": "false_positive",
        "duplicate_of": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "duplicate_of_title": "<string>",
        "fix": {
          "evidence": "<string>",
          "fixed_at": "2023-11-07T05:31:56Z",
          "note": "<string>",
          "pr_url": "<string>",
          "repository_url": "<string>",
          "retest_run_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
          "status": "in_progress",
          "target_url": "<string>"
        },
        "note": "<string>",
        "severity_override": "none",
        "snoozed_until": "2023-11-07T05:31:56Z",
        "updated_at": "2023-11-07T05:31:56Z"
      },
      "source_created_at": "2023-11-07T05:31:56Z"
    }
  ],
  "counts": {
    "partial": true,
    "severities_open": {
      "critical": 123,
      "high": 123,
      "low": 123,
      "medium": 123,
      "none": 123
    },
    "sla": {
      "due_7d": {
        "critical": 123,
        "high": 123,
        "low": 123,
        "medium": 123,
        "none": 123
      },
      "past": {
        "critical": 123,
        "high": 123,
        "low": 123,
        "medium": 123,
        "none": 123
      }
    },
    "sources": [
      {
        "open": 123,
        "source_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "total": 123
      }
    ],
    "stages": {
      "closed": 123,
      "in_fix": 123,
      "investigating": 123,
      "untriaged": 123,
      "verdict_ready": 123
    },
    "total_open": 123,
    "views": {
      "all": 123,
      "critical_high": 123,
      "in_fix": 123,
      "needs_decision": 123,
      "snoozed": 123,
      "waiting": 123
    }
  },
  "next_cursor": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

Triage

List the Triage queue

List the findings of every active source of your team (HackerOne, GitHub, Security Inbox and custom API sources) that you can see, with filters, views, sorts and cursor pagination. Each finding carries its server-computed stage and effective severity. A cursor is bound to the sort and filters it was issued for: reusing it with other ones returns 400 invalid_cursor. include=counts adds the counts per view, stage, source, severity and SLA, read in the same snapshot as the page. Each facet ignores its own filter and applies the others.

GET

api

triage

findings

List the Triage queue

curl --request GET \
  --url https://neo.api.projectdiscovery.io/api/v1/triage/findings \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://neo.api.projectdiscovery.io/api/v1/triage/findings', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://neo.api.projectdiscovery.io/api/v1/triage/findings",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://neo.api.projectdiscovery.io/api/v1/triage/findings"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://neo.api.projectdiscovery.io/api/v1/triage/findings")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "count": 123,
  "findings": [
    {
      "context": "<string>",
      "description": "<string>",
      "effective_severity": "none",
      "external_key": "<string>",
      "first_seen_at": "2023-11-07T05:31:56Z",
      "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "last_seen_at": "2023-11-07T05:31:56Z",
      "reporter": "<string>",
      "revision": 123,
      "severity": "none",
      "source_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "source_kind": "hackerone",
      "source_name": "<string>",
      "source_status": "<string>",
      "stage": "untriaged",
      "title": "<string>",
      "url": "<string>",
      "archived_at": "2023-11-07T05:31:56Z",
      "latest_retest": {
        "created_at": "2023-11-07T05:31:56Z",
        "finding_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "finding_revision": 123,
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "kind": "triage",
        "model": "<string>",
        "status": "queued",
        "completed_at": "2023-11-07T05:31:56Z",
        "error_code": "<string>",
        "internal_summary": "<string>",
        "retest_outcome": "fixed",
        "suggested_response": "<string>",
        "task_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "task_status": "pending",
        "triage_severity": "none",
        "triage_status": "valid"
      },
      "latest_run": {
        "created_at": "2023-11-07T05:31:56Z",
        "finding_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "finding_revision": 123,
        "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "kind": "triage",
        "model": "<string>",
        "status": "queued",
        "completed_at": "2023-11-07T05:31:56Z",
        "error_code": "<string>",
        "internal_summary": "<string>",
        "retest_outcome": "fixed",
        "suggested_response": "<string>",
        "task_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "task_status": "pending",
        "triage_severity": "none",
        "triage_status": "valid"
      },
      "raw": {},
      "removed_at": "2023-11-07T05:31:56Z",
      "review": {
        "version": 123,
        "decided_at": "2023-11-07T05:31:56Z",
        "decided_by_email": "<string>",
        "decision": "accepted",
        "decline_reason": "false_positive",
        "duplicate_of": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "duplicate_of_title": "<string>",
        "fix": {
          "evidence": "<string>",
          "fixed_at": "2023-11-07T05:31:56Z",
          "note": "<string>",
          "pr_url": "<string>",
          "repository_url": "<string>",
          "retest_run_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
          "status": "in_progress",
          "target_url": "<string>"
        },
        "note": "<string>",
        "severity_override": "none",
        "snoozed_until": "2023-11-07T05:31:56Z",
        "updated_at": "2023-11-07T05:31:56Z"
      },
      "source_created_at": "2023-11-07T05:31:56Z"
    }
  ],
  "counts": {
    "partial": true,
    "severities_open": {
      "critical": 123,
      "high": 123,
      "low": 123,
      "medium": 123,
      "none": 123
    },
    "sla": {
      "due_7d": {
        "critical": 123,
        "high": 123,
        "low": 123,
        "medium": 123,
        "none": 123
      },
      "past": {
        "critical": 123,
        "high": 123,
        "low": 123,
        "medium": 123,
        "none": 123
      }
    },
    "sources": [
      {
        "open": 123,
        "source_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
        "total": 123
      }
    ],
    "stages": {
      "closed": 123,
      "in_fix": 123,
      "investigating": 123,
      "untriaged": 123,
      "verdict_ready": 123
    },
    "total_open": 123,
    "views": {
      "all": 123,
      "critical_high": 123,
      "in_fix": 123,
      "needs_decision": 123,
      "snoozed": 123,
      "waiting": 123
    }
  },
  "next_cursor": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

Authorizations

Authorization

string

header

required

JWT authentication token

Query Parameters

source_id

string<uuid>[]

Only findings of these sources (repeat the parameter for several).

Maximum array length: 50

source_kind

enum<string>[]

Only findings of sources of these kinds.

Maximum array length: 4

hackerone, github and gmail are built-in connections; custom_api is a source you configure.

Available options:

hackerone,

github,

gmail,

custom_api

context

string[]

Only findings of these accounts within a source (a HackerOne program, a GitHub repository, a mailbox), compared without case.

Maximum array length: 50

Maximum string length: 256

view

enum<string>

A saved view of the queue. all: findings that are not closed. needs_decision: untriaged or verdict ready with no decision. critical_high: open findings whose effective severity is critical or high. in_fix: accepted findings being fixed. waiting: open findings older than 7 days. snoozed: findings with an active snooze. Omit to list every stage.

Available options:

all,

needs_decision,

critical_high,

in_fix,

waiting,

snoozed

stage

enum<string>[]

Only findings in these stages.

Maximum array length: 5

Available options:

untriaged,

investigating,

verdict_ready,

in_fix,

closed

severity

enum<string>[]

Only findings whose effective severity (override, then the latest valid run, then the source) is one of these; none also matches an unknown severity.

Maximum array length: 5

Available options:

critical,

high,

medium,

low,

none

state

string[]

Only findings whose status at the source is one of these, compared without case.

Maximum array length: 20

Maximum string length: 128

string

Search in the title and the external key, without case.

Maximum string length: 200

sort

enum<string>

default:updated

updated (default): most recently changed first. priority: effective severity, then the oldest first. newest and oldest: by age, the report date at the source when known, else the first time Neo saw the finding.

Available options:

updated,

priority,

newest,

oldest

include_snoozed

boolean

default:false

Include findings with an active snooze in the other views and filters. The snoozed view always lists them, and needs_decision never does (a snooze is a decision until it expires).

include

enum<string>[]

counts adds the queue counts to the response (computed in the same snapshot as the page).

Maximum array length: 1

Available options:

counts

archived

boolean

True lists only archived findings, false only active ones. Omit to list both.

cursor

string

The next_cursor of the previous page.

Required string length: 1 - 200

limit

integer

default:50

Maximum number of findings. Defaults to 50.

Required range: 1 <= x <= 100

Response

One page of findings

count

integer<int64>

required

Number of findings that match the filters (all pages).

findings

object[]

required

Show child attributes

counts

object

The queue counts, read in the same snapshot as the page. Each facet ignores its own filter and applies the others; open means a stage other than closed.

Show child attributes

next_cursor

string | null

Pass as cursor to read the next page. Null on the last page.