Get a Workflow’s Findings Summary

API REFERENCE

Beta

Get a Workflow’s Findings Summary

A thin summary for the workflow as a whole: its identifying information and its computed score. It does not include the findings themselves — see List a Workflow’s Findings for the flat list or Get a Workflow’s Findings by Category for the categorized view, so the same finding data isn’t published in two places that could drift out of sync.

Read-only in the strict sense: no lock is taken, no workflow is resumed, and no workflow, package or container row is written. Safe to poll.

Sample
- Header Properties
- Path Parameters
Responses

Sample

url="https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611"
curl -X GET "${url}" \
  -H "Authorization: Bearer your_access_token_here"

Header Properties

Property	Value	Required?
Authorization	Bearer your token	true

Path Parameters

Property	Description	Type
workflowId	The opaque handle identifying the workflow. Accepted with or without its `wfpop_` prefix.	string

workflowId is accepted with or without its wfpop_ prefix — a bare GUID resolves. findingId and attachmentId are not interchangeable this way: either must carry its exact prefix, or the request 404s as if that finding or attachment did not exist. There is no bare form of either that has ever been valid.

Responses

200

Property	Description	Type
workflowId	The workflow handle, echoed so a payload read, stored, or logged in isolation still says which workflow it belongs to.	string
score	0 to 99, and higher is worse — this scale is inverted from what you might expect. 75 and above means there are unreviewed findings of `HIGH` severity. May be absent — see below.	integer
severityCounts	Workflow-wide tally, one entry per distinct `(severity, reviewed)` combination actually present. Omitted under the same condition as `score`.	array

{
  "workflowId": "wfpop_0000000000002082611",
  "score": 82,
  "severityCounts": [
    { "severity": "HIGH", "reviewed": false, "count": 2 },
    { "severity": "MEDIUM", "reviewed": true, "count": 5 },
    { "severity": "CLEAR", "reviewed": true, "count": 11 }
  ]
}

score and severityCounts are omitted together, never emitted as 0 or [], when the workflow’s underlying data can’t be computed into a score right now. Absence means “not computable right now” — never treat a missing score as zero, and never treat it as evidence the workflow has no findings.

A workflow whose score cannot currently be computed:

{
  "workflowId": "wfpop_0000000000002082611"
}

403

You are not authorized to read this workflow.

Zero-length body, no Content-Type. Do not attempt to parse a body from this response — there is none. Branch on the status code alone.

This surface uses a bodyless 403 for every authorization failure, which is different from a problem+json 404 on the same operation. Do not assume every non-2xx on this API carries JSON — check the status first.

A 403 is also produced at the edge, before this service is reached, when a request value resembles SQL injection or cross-site scripting, and separately from the per-address rate limit (429). Both of those are also bodyless and carry no Content-Type.

404

Unknown workflowId.

An RFC 9457 problem document, served as application/problem+json.

Property	Description	Type
type	An absolute URI identifying the problem type. `https://pointservices.com/problems/not-found` is the only type this surface emits. This is the stable value to match on.	string
title	A short summary, written for a person.	string
status	The HTTP status code, repeated in the body.	number
detail	An explanation of this occurrence, written for your logs — never a stable code.	string
instance	A URI identifying this occurrence, written as `urn:pps:request:<id>`. Quote it when you raise a support ticket.	string

{
  "type": "https://pointservices.com/problems/not-found",
  "title": "No such resource",
  "status": 404,
  "detail": "No workflow 0000000000002082611 is available to this request.",
  "instance": "urn:pps:request:8d3a1f56-6c94-4e20-b7f8-0a5e9c2d4b73"
}

Branch on type, never on the text of detail.