> ## Documentation Index > Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt > Use this file to discover all available pages before exploring further. # List Hotlist Findings > Returns the organization's ranked security Hotlist — the same prioritized list shown on the CodeAnt Hotlist page. Every SCA, SAST, secrets, IaC, cloud (CSPM) and AI-exploitation finding across the organization is deduplicated and scored on severity, EPSS/CVSS, CISA KEV membership, confirmed exploitability, dependency reachability, secret validation and production context, then returned highest priority first alongside `summary` rollups, `facets` for filter discovery, and cursor pagination. Ticket, assignee and SLA state is synced live from the linked Jira, Linear, GitHub, Azure DevOps or GitLab issue. The Hotlist is served from a materialized snapshot: the first call after a rebuild returns `202` while it is built — retry after `retry_after_seconds`. ## OpenAPI ````yaml /openapi.json post /api/security/hotlist/findings openapi: 3.0.3 info: title: CodeAnt AI API description: >- API for code analysis (SAST, SCA, secrets, IaC) and developer productivity metrics. Supports GitHub, GitLab, Bitbucket, and Azure DevOps. version: 1.0.0 servers: - url: https://api.codeant.ai description: Production server security: [] tags: - name: Analysis description: Code analysis operations - name: Agent Analysis description: >- AI-powered agent analysis operations. Uses LLM-based code exploration agents to perform deep security threat hunting, bug finding, and custom analysis with reflection-based false positive filtering. - name: Developer Metrics - Teams description: >- Manage developer teams: create, update, delete teams and manage team membership. Teams are used to organize developers and scope metrics. - name: Developer Metrics description: >- Developer productivity and activity metrics: active developers, PR throughput, individual comparisons, and AI-generated summaries. All endpoints support GitHub, GitLab, Bitbucket, and Azure DevOps. - name: Audit Logs description: >- Read-only access to your organization's audit trail for compliance, ETL and SIEM ingestion. Events are immutable, retained for 180 days, and cover security-relevant actions: user management, access control, credentials, scan triggers, configuration changes and data exports. Secrets and tokens are redacted and never appear in any response format. - name: Container Scanning description: >- Container image vulnerability scanning across AWS ECR, Azure ACR, and GCP GAR registries. List tracked containers with their latest scan, then fetch the full vulnerability findings of a scan — the same data shown on the Cloud Security → Container Scanning page. Authenticate with a CodeAnt API token (requires the `view_cloud_security: read` permission when token scoping is configured). - name: Security Hotlist description: >- The organization-wide security Hotlist: every SCA, SAST, secrets, IaC, cloud (CSPM) and AI-exploitation finding, deduplicated and priority-scored into one ranked list with live ticket, assignee and SLA state. Query it with filters, facets and cursor pagination, or export the full filtered list as an Excel workbook. Authenticate with a CodeAnt API token (requires the `view_code_security: read` permission when token scoping is configured). paths: /api/security/hotlist/findings: post: tags: - Security Hotlist summary: List Hotlist Findings description: >- Returns the organization's ranked security Hotlist — the same prioritized list shown on the CodeAnt Hotlist page. Every SCA, SAST, secrets, IaC, cloud (CSPM) and AI-exploitation finding across the organization is deduplicated and scored on severity, EPSS/CVSS, CISA KEV membership, confirmed exploitability, dependency reachability, secret validation and production context, then returned highest priority first alongside `summary` rollups, `facets` for filter discovery, and cursor pagination. Ticket, assignee and SLA state is synced live from the linked Jira, Linear, GitHub, Azure DevOps or GitLab issue. The Hotlist is served from a materialized snapshot: the first call after a rebuild returns `202` while it is built — retry after `retry_after_seconds`. operationId: listHotlistFindings requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/HotlistFindingsRequest' example: platform: github org: Example-Org filters: severities: - critical - high types: - SCA - Secrets limit: 50 responses: '200': description: Ranked findings returned content: application/json: schema: type: object properties: state: type: string example: ready snapshot_revision: type: string description: Revision of the snapshot this page was served from. scoring_version: type: string example: hotlist-v2 updated_at: type: string format: date-time source_freshness: type: object description: >- Last time each scanner's data was folded into the snapshot. summary: $ref: '#/components/schemas/HotlistSummary' facets: type: object description: >- Available filter values with their counts, keyed by the dimensions of `HotlistFilters`. sla_config: type: object description: >- SLA in days configured per severity; `null` means no SLA for that severity. total_filtered: type: integer description: Findings matching the request across all pages. items: type: array description: One page of findings, highest priority first. items: $ref: '#/components/schemas/HotlistFinding' next_cursor: type: string nullable: true description: >- Pass back as `cursor` to fetch the next page; `null` on the last page. has_more: type: boolean '202': description: The Hotlist snapshot is still building; retry shortly content: application/json: schema: $ref: '#/components/schemas/HotlistBuildingResponse' '400': description: Invalid filter, limit or cursor content: application/json: schema: $ref: '#/components/schemas/HotlistErrorResponse' '401': description: Missing or invalid access token content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '409': description: >- The cursor no longer matches the snapshot or the filters it was issued for; restart pagination content: application/json: schema: $ref: '#/components/schemas/HotlistErrorResponse' example: error: code: HOTLIST_CURSOR_STALE message: The Hotlist changed; restart pagination. security: - BearerAuth: [] components: schemas: HotlistFindingsRequest: type: object description: Ranked Hotlist page request. required: - platform - org properties: platform: type: string enum: - github - gitlab - bitbucket - azure_devops description: Git platform of the organization org: type: string description: Organization / workspace slug github_base_url: type: string description: >- Self-hosted instance URL (also gitlab_base_url / bitbucket_base_url / azure_devops_base_url). Defaults to the cloud host. example: https://github.com filters: $ref: '#/components/schemas/HotlistFilters' search: type: string description: >- Case-insensitive substring match over the finding title, identifier, location and file path. limit: type: integer minimum: 1 maximum: 100 default: 30 description: Findings per page. cursor: type: string description: >- Opaque `next_cursor` from the previous page. A cursor is bound to the snapshot revision and to the exact `filters` + `search` it was issued for; changing either, or a rebuild of the Hotlist, returns 409 `HOTLIST_CURSOR_STALE` and pagination must restart. HotlistSummary: type: object description: Headline counts for exactly the findings the request matched. properties: total: type: integer severity: type: object description: Count per severity. additionalProperties: type: integer exploitConfirmed: type: integer ticketed: type: integer HotlistFinding: type: object description: >- One deduplicated, priority-scored Hotlist finding. Fields that do not apply to a finding's `type` are absent or null. properties: id: type: string description: Stable 32-character identifier for this finding across snapshots. example: 9f2c1d7a4b6e0f3c8a5d2e1b7c4f6a09 type: type: string enum: - SCA - SAST - Secrets - IaC - Infrastructure - AI Exploitation title: type: string description: CVE id, rule message, secret type or cloud check title. example: CVE-2024-21538 subtitle: type: string description: Supporting identifier, e.g. `package @ version` for SCA. example: cross-spawn @ 7.0.3 repo: type: string description: Repository full name; empty for cloud findings. account: type: string description: Cloud account identifier for Infrastructure findings. maxSeverity: type: string enum: - critical - high - medium - low - unknown filePath: type: string lineNumber: description: Line number, or the region / resource locator for cloud findings. oneOf: - type: integer - type: string priorityScore: type: number description: Ranking score. Findings are returned in descending priority order. example: 82.5 priorityBoosts: type: array description: Signals that raised the score above the severity baseline. items: type: object properties: key: type: string example: kev label: type: string example: CISA KEV value: type: number exploitConfirmed: type: boolean description: >- CodeAnt proved this finding exploitable — a validated live secret, a confirmed cloud exploit path, or a malware package. kev: type: boolean description: Listed in the CISA Known Exploited Vulnerabilities catalog. fixable: type: boolean description: A fixed version or remediation is available. direct: type: boolean description: SCA only — a direct rather than transitive dependency. reachabilityStatus: type: string description: >- SCA only — whether the vulnerable code is reachable from your application. enum: - reachable - not_reachable - unknown cveId: type: string package: type: string version: type: string complianceFrameworks: type: array description: Frameworks this finding maps to. items: type: string example: soc2 nonProd: type: boolean description: The repository is marked non-production in its risk settings. ticketStatus: type: string enum: - created - not_created ticketProvider: type: string description: Tracker holding the ticket. example: Jira ticketUrl: type: string assignee: type: object nullable: true description: Assignee on the linked ticket. properties: id: type: string name: type: string email: type: string providerStatus: type: object nullable: true description: Native workflow state of the linked ticket. properties: id: type: string name: type: string example: In Progress type: type: string example: started slaDays: type: integer nullable: true description: SLA applied to this finding, in days. slaDueDate: type: string format: date nullable: true slaStatus: type: string enum: - breached - on_track - met - no_sla raw: type: object description: >- Scanner fields kept for deep-linking and detail rendering. Code blocks, autofix payloads and plaintext secret material are never included. rank: type: integer description: 1-based position in the ranked list. source: type: string description: Scanner the finding came from, before IaC/cloud types are merged. score: type: number description: >- Severity/CVSS/EPSS base score before the priority boosts are applied. epss: type: number description: >- EPSS exploit-probability, 0-1. Always 0 for organization-level SCA rows. validationStatus: type: string description: >- Secrets only — result of validating the credential against its provider. enum: - live - revoked - pending - unknown ticketCreatedAt: type: string format: date-time nullable: true providerIssueKey: type: string nullable: true description: Human-readable key of the linked ticket. example: COD-1110 providerSyncError: type: string nullable: true description: Why the last sync with the ticket provider failed, if it did. HotlistBuildingResponse: type: object description: >- The Hotlist snapshot is being materialized. Retry after `retry_after_seconds`. properties: state: type: string example: building started_at: type: string format: date-time retry_after_seconds: type: integer example: 3 HotlistErrorResponse: type: object properties: error: type: object properties: code: type: string example: HOTLIST_CURSOR_STALE message: type: string ErrorResponse: type: object properties: error: type: string description: Error message HotlistFilters: type: object description: >- Values within one dimension are ORed; dimensions are ANDed together. Omit a dimension, or send an empty list, to leave it unfiltered. Use the `facets` of a previous response to discover the values available in your organization. properties: types: type: array description: Scanner that produced the finding. items: type: string enum: - SCA - SAST - Secrets - IaC - Infrastructure - AI Exploitation severities: type: array items: type: string enum: - critical - high - medium - low - unknown locations: type: array description: >- Repository full names, or cloud account identifiers for Infrastructure findings. items: type: string ticket_statuses: type: array items: type: string enum: - created - not_created assignees: type: array description: >- Assignee email (lowercased) or provider user id, as returned in each finding's `assignee`. items: type: string provider_statuses: type: array description: >- Native workflow state names from the linked ticket provider, e.g. `In Progress`. items: type: string sla_statuses: type: array items: type: string enum: - breached - on_track - met - no_sla compliance: type: array items: type: string enum: - soc2 validation: type: array description: Restrict to findings CodeAnt has actively proven exploitable. items: type: string enum: - exploit_confirmed securitySchemes: BearerAuth: type: http scheme: bearer description: >- CodeAnt API token (`cdt_...`), created on the Settings → API Tokens page. Pass via `Authorization: Bearer ` header. ````