Get a Workflow’s Category Counts

API REFERENCE

Beta

Get a Workflow’s Category Counts

Each of the workflow’s configured categories, with review and severity tallies only — never the findings themselves. Use this when you only need counts (for example, a summary dashboard) and want to avoid the cost of fetching and authorizing every individual finding; use Get a Workflow’s Findings by Category when you need the findings themselves.

No workflow-wide totals here. The workflow-wide score/severityCounts are already published on Get a Workflow’s Findings Summary — call both if you need both the workflow-wide tally and the per-category breakdown.

This call has no side effects — no lock is taken and nothing is written. Safe to poll.

Sample
- Header Properties
- Path Parameters
Responses
- categories entry

Sample

url="https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/categories"
curl -X GET "${url}" \
  -H "Authorization: Bearer your_access_token_here"

Header Properties

Property	Value	Required?
Authorization	Bearer your token	true

Path Parameters

Property	Description	Type
workflowId	The opaque handle identifying the workflow.	string

workflowId is accepted with or without its wfpop_ prefix — a bare GUID resolves. findingId and attachmentId are not interchangeable this way: either must carry its exact prefix, or the request 404s as if that finding or attachment did not exist. There is no bare form of either that has ever been valid.

Responses

200

Property	Description	Type
workflowId	The workflow handle.	string
categories	The workflow owner’s configured categories, in configured presentation order, with counts only. Always an array, `[]` when nothing is configured.	array
links.self	This resource’s own address.	object
links.workflowState	The workflow-state read address for this workflow.	object

categories entry

Property	Description	Type
category	The display name, exactly as configured. Not a closed set of values — two workflows can legitimately use different category names. Treat this as a label for a person, never a key to switch on.	string
orderIndex	The category’s configured presentation order.	integer
reviewedCount	How many of this category’s matched findings have been reviewed.	integer
reviewOutstandingCount	How many of this category’s matched findings still require review and have not yet been reviewed.	integer
reviewRequiredCount	How many of this category’s matched findings require review at all, reviewed or not.	integer
severityCounts	This category’s matched findings, tallied by `(severity, reviewed)`. Always an array, `[]` when none matched.	array

{
  "workflowId": "wfpop_0000000000002082611",
  "categories": [
    {
      "category": "Income",
      "orderIndex": 0,
      "reviewedCount": 3,
      "reviewOutstandingCount": 1,
      "reviewRequiredCount": 4,
      "severityCounts": [
        { "severity": "HIGH", "reviewed": false, "count": 1 },
        { "severity": "MEDIUM", "reviewed": true, "count": 3 }
      ]
    },
    {
      "category": "Assets",
      "orderIndex": 1,
      "reviewedCount": 2,
      "reviewOutstandingCount": 0,
      "reviewRequiredCount": 2,
      "severityCounts": [
        { "severity": "CLEAR", "reviewed": true, "count": 2 }
      ]
    }
  ],
  "links": {
    "self": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/categories" },
    "workflowState": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611" }
  }
}

An empty categories array does not mean “nothing to review” — it means the workflow owner configured no categories. A client that must distinguish “reviewed clean” from “nothing configured to review” cannot do so from this response alone; check Get a Workflow’s Findings Summary’s severityCounts for that.

403

You are not authorized to read this workflow.

Zero-length body, no Content-Type. Do not attempt to parse a body from this response — there is none. Branch on the status code alone.

This surface uses a bodyless 403 for every authorization failure, which is different from a problem+json 404 on the same operation. Do not assume every non-2xx on this API carries JSON — check the status first.

A 403 is also produced at the edge, before this service is reached, when a request value resembles SQL injection or cross-site scripting, and separately from the per-address rate limit (429). Both of those are also bodyless and carry no Content-Type.

404

Unknown workflowId.

An RFC 9457 problem document, served as application/problem+json.

Property	Description	Type
type	An absolute URI identifying the problem type. `https://pointservices.com/problems/not-found` is the only type this surface emits. This is the stable value to match on.	string
title	A short summary, written for a person.	string
status	The HTTP status code, repeated in the body.	number
detail	An explanation of this occurrence, written for your logs — never a stable code.	string
instance	A URI identifying this occurrence, written as `urn:pps:request:<id>`. Quote it when you raise a support ticket.	string

{
  "type": "https://pointservices.com/problems/not-found",
  "title": "No such resource",
  "status": 404,
  "detail": "No workflow 0000000000002082611 is available to this request.",
  "instance": "urn:pps:request:8d3a1f56-6c94-4e20-b7f8-0a5e9c2d4b73"
}

Branch on type, never on the text of detail.