Get a finding type

client.ZeroTrust.Casb.Posture.Findings.Get(ctx, findingID, query) (*CasbPostureFindingGetResponse, error)

GET/accounts/{account_id}/data-security/posture/findings/{finding_id}

Gets a security Finding that has been identified as being problematic.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Zero Trust ReadZero Trust Write

ParametersExpand Collapse

findingID string

formatbyte

query CasbPostureFindingGetParams

AccountID param.Field[string]

Cloudflare account ID for the user making the request.

ReturnsExpand Collapse

type CasbPostureFindingGetResponse struct{…}

Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

ID string

Base64 encoded identifier of the security finding.

formatbyte

ActiveCount int64

Number of active problematic instances identified in the security finding.

ArchivedCount int64

Number of archived instances identified in the security finding.

Finding CasbPostureFindingGetResponseFinding

Basic finding type information.

ID string

The unique identifier of the finding.

formatuuid

Category CasbPostureFindingGetResponseFindingCategory

Category information for a finding.

Observation CasbPostureFindingGetResponseFindingCategoryObservation

The type of the observation.

One of the following:

const CasbPostureFindingGetResponseFindingCategoryObservationIssue CasbPostureFindingGetResponseFindingCategoryObservation = "Issue"

const CasbPostureFindingGetResponseFindingCategoryObservationInsight CasbPostureFindingGetResponseFindingCategoryObservation = "Insight"

const CasbPostureFindingGetResponseFindingCategoryObservationActivity CasbPostureFindingGetResponseFindingCategoryObservation = "Activity"

Product CasbPostureFindingGetResponseFindingCategoryProduct

The product category.

One of the following:

const CasbPostureFindingGetResponseFindingCategoryProductSaaS CasbPostureFindingGetResponseFindingCategoryProduct = "SaaS"

const CasbPostureFindingGetResponseFindingCategoryProductCloud CasbPostureFindingGetResponseFindingCategoryProduct = "Cloud"

Type CasbPostureFindingGetResponseFindingCategoryType

The type of the finding category.

One of the following:

const CasbPostureFindingGetResponseFindingCategoryTypeContent CasbPostureFindingGetResponseFindingCategoryType = "Content"

const CasbPostureFindingGetResponseFindingCategoryTypePosture CasbPostureFindingGetResponseFindingCategoryType = "Posture"

Name string

The name of the finding.

Severity CasbPostureFindingGetResponseFindingSeverity

The severity level of a finding.

One of the following:

const CasbPostureFindingGetResponseFindingSeverityCritical CasbPostureFindingGetResponseFindingSeverity = "Critical"

const CasbPostureFindingGetResponseFindingSeverityHigh CasbPostureFindingGetResponseFindingSeverity = "High"

const CasbPostureFindingGetResponseFindingSeverityMedium CasbPostureFindingGetResponseFindingSeverity = "Medium"

const CasbPostureFindingGetResponseFindingSeverityLow CasbPostureFindingGetResponseFindingSeverity = "Low"

Vendor string

The SaaS/Cloud vendor of the platform with which the finding is associated.

Description stringOptional

Detailed description of the finding.

Remediation CasbPostureFindingGetResponseFindingRemediationOptional

Remediation guide information for a finding.

ID string

Remediation Id.

formatuuid

Frameworks []string

Relevant Compliance Frameworks.

Guide string

Remediation guide text.

Impact string

Description of the potential impact.

Locale string

I18N Locale.

Threat string

Description of the threat.

Ignored bool

Determines if finding is currently ignored.

InstanceCount int64

Number of total (Active or archived) problematic instances identified in the security finding.

Integration CasbPostureFindingGetResponseIntegration

Summary information about an integration.

Created Time

When entity was created.

formatdate-time

LastHydrated Time

When were the integration credentials last updated.

formatdate-time

Name string

Name of the integration.

maxLength256

Permissions []string

The vendor-specific permissions associated with the integration.

Policy CasbPostureFindingGetResponseIntegrationPolicy

Policy configuration for an integration.

ID stringOptional

Policy identifier.

formatuuid

ClientID stringOptional

OAuth client ID for the policy.

ComplianceLevel stringOptional

Compliance level for the policy.

DLPEnabled boolOptional

Whether DLP is enabled for this policy.

Link stringOptional

Link to policy documentation.

formaturi

Name stringOptional

Policy name.

Permissions []stringOptional

List of permissions included in the policy.

Status string

Current status of the integration.

Updated Time

Last entity was updated.

formatdate-time

Upgradable bool

Whether the integrations permissions can be updated.

Vendor CasbPostureFindingGetResponseIntegrationVendor

Information about a vendor/service provider.

ID string

The id of the vendor.

Description string

Detailed information about what kinds of issues are detected for this vendor.

DisplayName string

The display name of the vendor.

Logo string

Logo URL for the vendor.

formaturi

Name string

The name of the vendor.

StaticLogo string

Static logo URL for the vendor.

formaturi

ZtEnrollments []string

The vendor’s compatible Zero Trust products.

Policies []map[string, unknown]Optional

The policies related to the vendor.

ZtEnrollments []CasbPostureFindingGetResponseIntegrationZtEnrollment

Zero Trust products associated with this integration.

ID stringOptional

The internal identifier of the Zero Trust Product.

Description stringOptional

Brief description of the Zero Trust Product.

DisplayName stringOptional

The verbose name of the Zero Trust Product.

Enabled boolOptional

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

ID stringOptional

Integration ID.

formatuuid

CredentialHealthStatus CasbPostureFindingGetResponseIntegrationCredentialHealthStatusOptional

Health status of integration credentials.

One of the following:

const CasbPostureFindingGetResponseIntegrationCredentialHealthStatusInitializing CasbPostureFindingGetResponseIntegrationCredentialHealthStatus = "Initializing"

const CasbPostureFindingGetResponseIntegrationCredentialHealthStatusHealthy CasbPostureFindingGetResponseIntegrationCredentialHealthStatus = "Healthy"

const CasbPostureFindingGetResponseIntegrationCredentialHealthStatusUnhealthy CasbPostureFindingGetResponseIntegrationCredentialHealthStatus = "Unhealthy"

CredentialsExpiry TimeOptional

The date and time when the integration credentials will expire.

formatdate-time

IsPaused boolOptional

Whether the given integration is paused by the user.

UpgradeDismissed boolOptional

UI State as to whether a potential permissions upgrade has been dismissed.

LatestAfflictionDate Time

Timestamp of the latest affliction date of an active finding.

formatdate-time

SeverityOverride CasbPostureFindingGetResponseSeverityOverrideOptional

Override information for finding severity.

CreatedBy string

User ID who created the override.

Severity CasbPostureFindingGetResponseSeverityOverrideSeverity

The severity level of a finding.

One of the following:

const CasbPostureFindingGetResponseSeverityOverrideSeverityCritical CasbPostureFindingGetResponseSeverityOverrideSeverity = "Critical"

const CasbPostureFindingGetResponseSeverityOverrideSeverityHigh CasbPostureFindingGetResponseSeverityOverrideSeverity = "High"

const CasbPostureFindingGetResponseSeverityOverrideSeverityMedium CasbPostureFindingGetResponseSeverityOverrideSeverity = "Medium"

const CasbPostureFindingGetResponseSeverityOverrideSeverityLow CasbPostureFindingGetResponseSeverityOverrideSeverity = "Low"

Get a finding type

package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/option"
  "github.com/cloudflare/cloudflare-go/zero_trust"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  finding, err := client.ZeroTrust.Casb.Posture.Findings.Get(
    context.TODO(),
    "U3RhaW5sZXNzIHJvY2tz",
    zero_trust.CasbPostureFindingGetParams{
      AccountID: cloudflare.F("46148281d8a93d002ef242d8b0d5f9f6"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", finding.ID)
}

{
  "errors": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=",
    "active_count": 5,
    "archived_count": 2,
    "finding": {
      "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94",
      "category": {
        "observation": "Issue",
        "product": "SaaS",
        "type": "Posture"
      },
      "name": "Slack File Publicly Accessible",
      "severity": "High",
      "vendor": "Google Workspace",
      "description": "This finding indicates that a file in your Slack workspace is publicly accessible.",
      "remediation": {
        "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94",
        "frameworks": [
          "SOC2",
          "ISO27001"
        ],
        "guide": "To fix this issue, update the file permissions to remove public access.",
        "impact": "Publicly accessible files may expose sensitive information.",
        "locale": "en-US",
        "threat": "Data exposure and potential compliance violations."
      }
    },
    "ignored": false,
    "instance_count": 7,
    "integration": {
      "created": "2021-08-10T20:16:11.851451Z",
      "last_hydrated": "2025-03-18T17:25:38.697894Z",
      "name": "Example integration",
      "permissions": [
        "GroupMember.Read.All",
        "Group.Read.All"
      ],
      "policy": {
        "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c",
        "client_id": "client_id",
        "compliance_level": "standard",
        "dlp_enabled": true,
        "link": "https://example.com",
        "name": "Google Workspace Standard Policy",
        "permissions": [
          "https://www.googleapis.com/auth/admin.directory.domain.readonly",
          "https://www.googleapis.com/auth/admin.directory.user.readonly"
        ]
      },
      "status": "Healthy",
      "updated": "2021-08-10T20:16:11.851451Z",
      "upgradable": false,
      "vendor": {
        "id": "R09PR0xFX1dPUktTUEFDRQ==",
        "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.",
        "display_name": "Google Workspace",
        "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png",
        "name": "GOOGLE_WORKSPACE",
        "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png",
        "zt_enrollments": [
          "casb"
        ],
        "policies": [
          {
            "foo": "bar"
          }
        ]
      },
      "zt_enrollments": [
        {
          "id": "casb",
          "description": "example",
          "display_name": "Cloud Access Security Broker",
          "enabled": true
        }
      ],
      "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f",
      "credential_health_status": "Healthy",
      "credentials_expiry": "2025-03-18T17:25:38.697902Z",
      "is_paused": false,
      "upgrade_dismissed": false
    },
    "latest_affliction_date": "2025-03-18T17:25:38.700131Z",
    "severity_override": {
      "created_by": "1234",
      "severity": "Critical"
    }
  }
}

Returns Examples

{
  "errors": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "Request processed successfully",
      "documentation_url": "https://developers.cloudflare.com/api/operations/list-findings",
      "source": {
        "pointer": "/data/attributes/name"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "MDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAxOjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMgo=",
    "active_count": 5,
    "archived_count": 2,
    "finding": {
      "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94",
      "category": {
        "observation": "Issue",
        "product": "SaaS",
        "type": "Posture"
      },
      "name": "Slack File Publicly Accessible",
      "severity": "High",
      "vendor": "Google Workspace",
      "description": "This finding indicates that a file in your Slack workspace is publicly accessible.",
      "remediation": {
        "id": "a20895dd-9c3b-43bd-a608-71c98c6c2d94",
        "frameworks": [
          "SOC2",
          "ISO27001"
        ],
        "guide": "To fix this issue, update the file permissions to remove public access.",
        "impact": "Publicly accessible files may expose sensitive information.",
        "locale": "en-US",
        "threat": "Data exposure and potential compliance violations."
      }
    },
    "ignored": false,
    "instance_count": 7,
    "integration": {
      "created": "2021-08-10T20:16:11.851451Z",
      "last_hydrated": "2025-03-18T17:25:38.697894Z",
      "name": "Example integration",
      "permissions": [
        "GroupMember.Read.All",
        "Group.Read.All"
      ],
      "policy": {
        "id": "d647642e-09ac-4b34-8acc-ac30f57adc2c",
        "client_id": "client_id",
        "compliance_level": "standard",
        "dlp_enabled": true,
        "link": "https://example.com",
        "name": "Google Workspace Standard Policy",
        "permissions": [
          "https://www.googleapis.com/auth/admin.directory.domain.readonly",
          "https://www.googleapis.com/auth/admin.directory.user.readonly"
        ]
      },
      "status": "Healthy",
      "updated": "2021-08-10T20:16:11.851451Z",
      "upgradable": false,
      "vendor": {
        "id": "R09PR0xFX1dPUktTUEFDRQ==",
        "description": "Identify important security issues across your Google Workspace account ranging from shadow IT, misconfigurations, user access, and more.",
        "display_name": "Google Workspace",
        "logo": "https://cdn.vectrix-infra.com/DetectionPack_Logos/GoogleWorkspace/g.png",
        "name": "GOOGLE_WORKSPACE",
        "static_logo": "https://onprem.cloudflare.come/DetectionPack_Logos/GoogleWorkspace/g.png",
        "zt_enrollments": [
          "casb"
        ],
        "policies": [
          {
            "foo": "bar"
          }
        ]
      },
      "zt_enrollments": [
        {
          "id": "casb",
          "description": "example",
          "display_name": "Cloud Access Security Broker",
          "enabled": true
        }
      ],
      "id": "c416bc38-75dc-425f-ae25-c37b5df5c37f",
      "credential_health_status": "Healthy",
      "credentials_expiry": "2025-03-18T17:25:38.697902Z",
      "is_paused": false,
      "upgrade_dismissed": false
    },
    "latest_affliction_date": "2025-03-18T17:25:38.700131Z",
    "severity_override": {
      "created_by": "1234",
      "severity": "Critical"
    }
  }
}