API REFERENCE
Beta
Get One Finding
Fetch a single finding by id. Field for field identical to the same finding as it appears nested in a list or category response — pulling a finding out of a collection and later re-fetching it here returns the same JSON for it.
There is no links wrapper at this response’s root. The finding’s own navigation already travels inside finding.links, so a second copy of the same three hrefs one level up would only be a second place for them to drift.
Sample
url="https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384"
curl -X GET "${url}" \
-H "Authorization: Bearer your_access_token_here"
Header Properties
| Property | Value | Required? |
|---|---|---|
| Authorization | Bearer your token | true |
Path Parameters
| Property | Description | Type |
|---|---|---|
| workflowId | The opaque handle identifying the workflow this finding belongs to. | string |
| findingId | The opaque finding identifier, as published in findingId (fndg_…). Must carry its exact fndg_ prefix. | string |
workflowId is accepted with or without its wfpop_ prefix — a bare GUID resolves. findingId and attachmentId are not interchangeable this way: either must carry its exact prefix, or the request 404s as if that finding or attachment did not exist. There is no bare form of either that has ever been valid.
A findingId only resolves within the workflowId it was issued under. The same findingId under a different workflowId is always a 404 — this endpoint never tells you “that finding exists, just not here.”
Responses
200
The one finding, with its own navigation links. See List a Workflow’s Findings for the full Finding field table — every field there applies here identically.
| Property | Description | Type |
|---|---|---|
| workflowId | The workflow handle. | string |
| finding | The finding — see List a Workflow’s Findings for its shape. | object |
{
"workflowId": "wfpop_0000000000002082611",
"finding": {
"findingId": "fndg_0000000000006051384",
"code": "HP.ST",
"displayName": "High-priority stated income mismatch",
"category": ["Income"],
"severity": "HIGH",
"alertState": "Alert",
"userMessage": ["Stated income does not match the verified source document."],
"userSuggestion": ["Confirm the applicant's income against the attached document before proceeding."],
"reviewStatus": "PENDING",
"reviewNote": null,
"updatedAt": "2026-08-07T15:01:42Z",
"hasAttachments": true,
"hasHistory": false,
"links": {
"self": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384" },
"history": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/history" },
"attachments": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/attachments" }
},
"editStates": {
"note": {
"href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/note",
"method": "POST"
}
}
}
}
403
You are not authorized to read this workflow.
Zero-length body, no Content-Type. Do not attempt to parse a body from this response — there is none. Branch on the status code alone.
This surface uses a bodyless 403 for every authorization failure, which is different from a problem+json 404 on the same operation. Do not assume every non-2xx on this API carries JSON — check the status first.
A 403 is also produced at the edge, before this service is reached, when a request value resembles SQL injection or cross-site scripting, and separately from the per-address rate limit (429). Both of those are also bodyless and carry no Content-Type.
404
Unknown workflowId or unknown findingId — both are reported as this one status, with one problem body, and you do not need to tell them apart.
An RFC 9457 problem document, served as application/problem+json.
| Property | Description | Type |
|---|---|---|
| type | An absolute URI identifying the problem type. https://pointservices.com/problems/not-found is the only type this surface emits. This is the stable value to match on. | string |
| title | A short summary, written for a person. | string |
| status | The HTTP status code, repeated in the body. | number |
| detail | An explanation of this occurrence, written for your logs — never a stable code. | string |
| instance | A URI identifying this occurrence, written as urn:pps:request:<id>. Quote it when you raise a support ticket. | string |
{
"type": "https://pointservices.com/problems/not-found",
"title": "No such resource",
"status": 404,
"detail": "No finding fndg_0000000000006051384 is available to this request.",
"instance": "urn:pps:request:8d3a1f56-6c94-4e20-b7f8-0a5e9c2d4b73"
}
Branch on type, never on the text of detail.