Get a Finding’s History

API REFERENCE

Beta

Get a Finding’s History

The finding’s audit trail, newest first, up to 500 entries. Not paged: if a finding has accumulated more than 500 recorded field changes, entries beyond the cap are not retrievable through this endpoint. In practice findings rarely approach that volume — the cap is a safety bound, not a normal limit you should expect to hit.

Each entry is one field change, not one save — an edit that changed two fields at once produces two entries, sharing the same reviewer and changedAt.

Sample
- Header Properties
- Path Parameters
Responses
- history entry

Sample

url="https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/history"
curl -X GET "${url}" \
  -H "Authorization: Bearer your_access_token_here"

Header Properties

Property	Value	Required?
Authorization	Bearer your token	true

Path Parameters

Property	Description	Type
workflowId	The opaque handle identifying the workflow.	string
findingId	The opaque finding identifier (`fndg_…`).	string

workflowId is accepted with or without its wfpop_ prefix — a bare GUID resolves. findingId and attachmentId are not interchangeable this way: either must carry its exact prefix, or the request 404s as if that finding or attachment did not exist. There is no bare form of either that has ever been valid.

Responses

200

Property	Description	Type
workflowId	The workflow handle.	string
findingId	Echoed even though the URL already names it, so this response stored apart from the request that produced it still says which finding it describes.	string
history	Up to 500 entries, newest first. Never null — `[]` when the finding has no recorded history.	array
links.self	This collection’s own address.	object
links.finding	The parent finding’s address.	object

history entry

Property	Description	Type
field	The name of the field this entry changed. Omitted when the stored event names none.	string
previousValue	The value before the change, rendered as text. Always present, explicitly `null` when there was nothing to report — the only field on this entry that behaves that way. Distinguish “the field was empty” (`""`) from “nothing was recorded” (`null`).	string, nullable
newValue	The value after the change, rendered as text. A stored non-string value arrives as its JSON form — do not assume this always parses as a bare scalar. Omitted when the stored change recorded none.	string
reviewer	Who made the change, as a display summary — never an internal identifier.	string
changedAt	When the change was made. RFC 3339 UTC, trailing `Z`. Omitted when the stored event carries no instant — entries with no `changedAt` sort last.	string

{
  "workflowId": "wfpop_0000000000002082611",
  "findingId": "fndg_0000000000006051384",
  "history": [
    {
      "field": "reviewed",
      "previousValue": "false",
      "newValue": "true",
      "reviewer": "Jane Reviewer",
      "changedAt": "2026-08-07T15:04:09Z"
    },
    {
      "field": "reviewedNotes",
      "previousValue": null,
      "newValue": "Confirmed with borrower via phone on 8/7; income supported by attached paystub.",
      "reviewer": "Jane Reviewer",
      "changedAt": "2026-08-07T15:01:42Z"
    }
  ],
  "links": {
    "self": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/history" },
    "finding": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384" }
  }
}

Note the note-then-resolve sequence above: the note was recorded first (older changedAt), then the finding was resolved (newer changedAt), and both entries share reviewer with the call that produced each — consistent with Set a Finding’s Review Note and Mark a Finding Reviewed.

403

You are not authorized to read this workflow.

Zero-length body, no Content-Type. Do not attempt to parse a body from this response — there is none. Branch on the status code alone.

This surface uses a bodyless 403 for every authorization failure, which is different from a problem+json 404 on the same operation. Do not assume every non-2xx on this API carries JSON — check the status first.

A 403 is also produced at the edge, before this service is reached, when a request value resembles SQL injection or cross-site scripting, and separately from the per-address rate limit (429). Both of those are also bodyless and carry no Content-Type.

404

Unknown workflowId or unknown findingId. A finding with no recorded history is a 200 with an empty history array, never a 404.

An RFC 9457 problem document, served as application/problem+json.

Property	Description	Type
type	An absolute URI identifying the problem type. `https://pointservices.com/problems/not-found` is the only type this surface emits. This is the stable value to match on.	string
title	A short summary, written for a person.	string
status	The HTTP status code, repeated in the body.	number
detail	An explanation of this occurrence, written for your logs — never a stable code.	string
instance	A URI identifying this occurrence, written as `urn:pps:request:<id>`. Quote it when you raise a support ticket.	string

{
  "type": "https://pointservices.com/problems/not-found",
  "title": "No such resource",
  "status": 404,
  "detail": "No finding fndg_0000000000006051384 is available to this request.",
  "instance": "urn:pps:request:8d3a1f56-6c94-4e20-b7f8-0a5e9c2d4b73"
}

Branch on type, never on the text of detail.