{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/google-cloud-security-command-center/json-schema/google-cloud-security-command-center-list-findings-response-schema.json",
  "title": "ListFindingsResponse",
  "description": "Response for the `ListFindings` method.",
  "x-generated": "2026-11-11",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/google-cloud-security-command-center-websecurityscanner-projects-api-openapi.yml#/components/schemas/ListFindingsResponse",
  "properties": {
    "findings": {
      "description": "The list of Findings returned.",
      "type": "array",
      "items": {
        "$ref": "#/$defs/Finding"
      }
    },
    "nextPageToken": {
      "type": "string",
      "description": "Token to retrieve the next page of results, or empty if there are no more results in the list."
    }
  },
  "type": "object",
  "$defs": {
    "Finding": {
      "type": "object",
      "properties": {
        "name": {
          "type": "string",
          "description": "Output only. The resource name of the Finding. The name follows the format of 'projects/{projectId}/scanConfigs/{scanConfigId}/scanruns/{scanRunId}/findings/{findingId}'. The finding IDs are generated by the system."
        },
        "xss": {
          "$ref": "#/$defs/Xss",
          "description": "Output only. An addon containing information reported for an XSS, if any."
        },
        "frameUrl": {
          "description": "Output only. If the vulnerability was originated from nested IFrame, the immediate parent IFrame is reported.",
          "type": "string"
        },
        "trackingId": {
          "type": "string",
          "description": "Output only. The tracking ID uniquely identifies a vulnerability instance across multiple ScanRuns."
        },
        "violatingResource": {
          "$ref": "#/$defs/ViolatingResource",
          "description": "Output only. An addon containing detailed information regarding any resource causing the vulnerability such as JavaScript sources, image, audio files, etc."
        },
        "fuzzedUrl": {
          "description": "Output only. The URL produced by the server-side fuzzer and used in the request that triggered the vulnerability.",
          "type": "string"
        },
        "reproductionUrl": {
          "type": "string",
          "description": "Output only. The URL containing human-readable payload that user can leverage to reproduce the vulnerability."
        },
        "form": {
          "$ref": "#/$defs/Form",
          "description": "Output only. An addon containing information reported for a vulnerability with an HTML form, if any."
        },
        "httpMethod": {
          "type": "string",
          "description": "Output only. The http method of the request that triggered the vulnerability, in uppercase."
        },
        "findingType": {
          "description": "Output only. The type of the Finding. Detailed and up-to-date information on findings can be found here: https://cloud.google.com/security-command-center/docs/how-to-remediate-web-security-scanner-findings",
          "type": "string"
        },
        "outdatedLibrary": {
          "$ref": "#/$defs/OutdatedLibrary",
          "description": "Output only. An addon containing information about outdated libraries."
        },
        "severity": {
          "readOnly": true,
          "description": "Output only. The severity level of the reported vulnerability.",
          "type": "string",
          "enum": [
            "SEVERITY_UNSPECIFIED",
            "CRITICAL",
            "HIGH",
            "MEDIUM",
            "LOW"
          ]
        },
        "description": {
          "type": "string",
          "description": "Output only. The description of the vulnerability."
        },
        "finalUrl": {
          "description": "Output only. The URL where the browser lands when the vulnerability is detected.",
          "type": "string"
        },
        "xxe": {
          "$ref": "#/$defs/Xxe",
          "description": "Output only. An addon containing information reported for an XXE, if any."
        },
        "vulnerableHeaders": {
          "$ref": "#/$defs/VulnerableHeaders",
          "description": "Output only. An addon containing information about vulnerable or missing HTTP headers."
        },
        "body": {
          "description": "Output only. The body of the request that triggered the vulnerability.",
          "type": "string"
        },
        "vulnerableParameters": {
          "$ref": "#/$defs/VulnerableParameters",
          "description": "Output only. An addon containing information about request parameters which were found to be vulnerable."
        }
      },
      "description": "A Finding resource represents a vulnerability instance identified during a ScanRun."
    },
    "Form": {
      "type": "object",
      "properties": {
        "fields": {
          "items": {
            "type": "string"
          },
          "description": "! The names of form fields related to the vulnerability.",
          "type": "array"
        },
        "actionUri": {
          "description": "! The URI where to send the form when it's submitted.",
          "type": "string"
        }
      },
      "description": "! Information about a vulnerability with an HTML."
    },
    "Header": {
      "type": "object",
      "description": "Describes a HTTP Header.",
      "properties": {
        "value": {
          "description": "Header value.",
          "type": "string"
        },
        "name": {
          "description": "Header name.",
          "type": "string"
        }
      }
    },
    "OutdatedLibrary": {
      "properties": {
        "libraryName": {
          "description": "The name of the outdated library.",
          "type": "string"
        },
        "version": {
          "description": "The version number.",
          "type": "string"
        },
        "learnMoreUrls": {
          "description": "URLs to learn more information about the vulnerabilities in the library.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "type": "object",
      "description": "Information reported for an outdated library."
    },
    "ViolatingResource": {
      "type": "object",
      "properties": {
        "contentType": {
          "type": "string",
          "description": "The MIME type of this resource."
        },
        "resourceUrl": {
          "description": "URL of this violating resource.",
          "type": "string"
        }
      },
      "description": "Information regarding any resource causing the vulnerability such as JavaScript sources, image, audio files, etc."
    },
    "VulnerableHeaders": {
      "description": "Information about vulnerable or missing HTTP Headers.",
      "properties": {
        "headers": {
          "items": {
            "$ref": "#/$defs/Header"
          },
          "description": "List of vulnerable headers.",
          "type": "array"
        },
        "missingHeaders": {
          "description": "List of missing headers.",
          "type": "array",
          "items": {
            "$ref": "#/$defs/Header"
          }
        }
      },
      "type": "object"
    },
    "VulnerableParameters": {
      "properties": {
        "parameterNames": {
          "description": "The vulnerable parameter names.",
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      },
      "type": "object",
      "description": "Information about vulnerable request parameters."
    },
    "Xss": {
      "description": "Information reported for an XSS.",
      "type": "object",
      "properties": {
        "stackTraces": {
          "items": {
            "type": "string"
          },
          "description": "Stack traces leading to the point where the XSS occurred.",
          "type": "array"
        },
        "errorMessage": {
          "description": "An error message generated by a javascript breakage.",
          "type": "string"
        },
        "attackVector": {
          "description": "The attack vector of the payload triggering this XSS.",
          "type": "string",
          "enum": [
            "ATTACK_VECTOR_UNSPECIFIED",
            "LOCAL_STORAGE",
            "SESSION_STORAGE",
            "WINDOW_NAME",
            "REFERRER",
            "FORM_INPUT",
            "COOKIE",
            "POST_MESSAGE",
            "GET_PARAMETERS",
            "URL_FRAGMENT",
            "HTML_COMMENT",
            "POST_PARAMETERS",
            "PROTOCOL",
            "STORED_XSS",
            "SAME_ORIGIN",
            "USER_CONTROLLABLE_URL"
          ]
        },
        "storedXssSeedingUrl": {
          "description": "The reproduction url for the seeding POST request of a Stored XSS.",
          "type": "string"
        }
      }
    },
    "Xxe": {
      "properties": {
        "payloadValue": {
          "type": "string",
          "description": "The XML string that triggered the XXE vulnerability. Non-payload values might be redacted."
        },
        "payloadLocation": {
          "description": "Location within the request where the payload was placed.",
          "type": "string",
          "enum": [
            "LOCATION_UNSPECIFIED",
            "COMPLETE_REQUEST_BODY"
          ]
        }
      },
      "description": "Information reported for an XXE.",
      "type": "object"
    }
  }
}