List Hotlist Findings
Returns the organization’s ranked security Hotlist — the same prioritized list shown on the CodeAnt Hotlist page. Every SCA, SAST, secrets, IaC, cloud (CSPM) and AI-exploitation finding across the organization is deduplicated and scored on severity, EPSS/CVSS, CISA KEV membership, confirmed exploitability, dependency reachability, secret validation and production context, then returned highest priority first alongside summary rollups, facets for filter discovery, and cursor pagination. Ticket, assignee and SLA state is synced live from the linked Jira, Linear, GitHub, Azure DevOps or GitLab issue.
The Hotlist is served from a materialized snapshot: the first call after a rebuild returns 202 while it is built — retry after retry_after_seconds.
Authorizations
CodeAnt API token (cdt_...), created on the Settings → API Tokens page. Pass via Authorization: Bearer <token> header.
Body
Ranked Hotlist page request.
Git platform of the organization
github, gitlab, bitbucket, azure_devops Organization / workspace slug
Self-hosted instance URL (also gitlab_base_url / bitbucket_base_url / azure_devops_base_url). Defaults to the cloud host.
"https://github.com"
Values within one dimension are ORed; dimensions are ANDed together. Omit a dimension, or send an empty list, to leave it unfiltered. Use the facets of a previous response to discover the values available in your organization.
Case-insensitive substring match over the finding title, identifier, location and file path.
Findings per page.
1 <= x <= 100Opaque next_cursor from the previous page. A cursor is bound to the snapshot revision and to the exact filters + search it was issued for; changing either, or a rebuild of the Hotlist, returns 409 HOTLIST_CURSOR_STALE and pagination must restart.
Response
Ranked findings returned
"ready"
Revision of the snapshot this page was served from.
"hotlist-v2"
Last time each scanner's data was folded into the snapshot.
Headline counts for exactly the findings the request matched.
Available filter values with their counts, keyed by the dimensions of HotlistFilters.
SLA in days configured per severity; null means no SLA for that severity.
Findings matching the request across all pages.
One page of findings, highest priority first.
Pass back as cursor to fetch the next page; null on the last page.