{
  "opencollection": "1.0.0",
  "info": {
    "name": "Datadog Account Findings API",
    "version": "1.0"
  },
  "request": {
    "auth": {
      "type": "apikey",
      "key": "DD-API-KEY",
      "value": "{{DD-API-KEY}}",
      "placement": "header"
    }
  },
  "items": [
    {
      "info": {
        "name": "Findings",
        "type": "folder"
      },
      "items": [
        {
          "info": {
            "name": "Datadog List Findings",
            "type": "http"
          },
          "http": {
            "method": "GET",
            "url": "https://{subdomain}.{site}/api/v2/posture_management/findings",
            "params": [
              {
                "name": "page[limit]",
                "value": "50",
                "type": "query",
                "description": "Limit the number of findings returned. Must be <= 1000."
              },
              {
                "name": "snapshot_timestamp",
                "value": "1678721573794",
                "type": "query",
                "description": "Return findings for a given snapshot of time (Unix ms)."
              },
              {
                "name": "page[cursor]",
                "value": "eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=",
                "type": "query",
                "description": "Return the next page of findings pointed to by the cursor."
              },
              {
                "name": "filter[tags]",
                "value": "filter[tags]=cloud_provider:aws&filter[tags]=aws_account:999999999999",
                "type": "query",
                "description": "Return findings that have these associated tags (repeatable)."
              },
              {
                "name": "filter[evaluation_changed_at]",
                "value": ">=1678721573794",
                "type": "query",
                "description": "Return findings that have changed from pass to fail or vice versa on a specified date (Unix ms) or date range (using comparison operators)."
              },
              {
                "name": "filter[muted]",
                "value": "true",
                "type": "query",
                "description": "Set to `true` to return findings that are muted. Set to `false` to return unmuted findings."
              },
              {
                "name": "filter[rule_id]",
                "value": "abc-123-def",
                "type": "query",
                "description": "Return findings for the specified rule ID."
              },
              {
                "name": "filter[rule_name]",
                "value": "Example Monitor",
                "type": "query",
                "description": "Return findings for the specified rule."
              },
              {
                "name": "filter[resource_type]",
                "value": "metric alert",
                "type": "query",
                "description": "Return only findings for the specified resource type."
              },
              {
                "name": "filter[discovery_timestamp]",
                "value": ">=1678721573794",
                "type": "query",
                "description": "Return findings that were found on a specified date (Unix ms) or date range (using comparison operators)."
              },
              {
                "name": "filter[evaluation]",
                "value": "pass",
                "type": "query",
                "description": "Return only `pass` or `fail` findings."
              },
              {
                "name": "filter[status]",
                "value": "critical",
                "type": "query",
                "description": "Return only findings with the specified status."
              },
              {
                "name": "filter[vulnerability_type]",
                "value": "misconfiguration",
                "type": "query",
                "description": "Return findings that match the selected vulnerability types (repeatable)."
              }
            ],
            "auth": {
              "type": "apikey",
              "key": "DD-API-KEY",
              "value": "{{DD-API-KEY}}",
              "placement": "header"
            }
          },
          "docs": "Get a list of findings. These include both misconfigurations and identity risks.\n\n**Note**: To filter and return only identity risks, add the following query parameter: `?filter[tags]=dd_rule_type:ciem`\n\n### Filtering\n\nFilters can be applied by appending query parameters to the URL.\n\n  - Using a single filter: `?filter[attribute_key]=attribute_value`\n  - Chaining filters: `?filter[attribute_key]=attribute_value&filter[attribute_key]=attribute_value...`\n  - Filtering on tags: `?filter[tags]=tag_k"
        },
        {
          "info": {
            "name": "Datadog Mute or Unmute a Batch of Findings",
            "type": "http"
          },
          "http": {
            "method": "PATCH",
            "url": "https://{subdomain}.{site}/api/v2/posture_management/findings",
            "body": {
              "type": "json",
              "data": "{}"
            },
            "auth": {
              "type": "apikey",
              "key": "DD-API-KEY",
              "value": "{{DD-API-KEY}}",
              "placement": "header"
            }
          },
          "docs": "Mute or unmute findings."
        }
      ]
    }
  ],
  "bundled": true
}