API REFERENCE
Beta
Get a Workflow’s Findings by Category
The workflow’s findings grouped into categories, in the order they were configured — use this when you want findings grouped the way the workflow owner set up, rather than the flat list from List a Workflow’s Findings. Each finding here is identical, field for field, to its counterpart in the flat list and in a direct single-finding GET.
If you only need counts and severity breakdowns per category — without fetching every finding — use Get a Workflow’s Category Counts instead.
This call has no side effects — no lock is taken and nothing is written. Safe to poll.
Sample
url="https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/bycategories"
curl -X GET "${url}" \
-H "Authorization: Bearer your_access_token_here"
Header Properties
| Property | Value | Required? |
|---|---|---|
| Authorization | Bearer your token | true |
Path Parameters
| Property | Description | Type |
|---|---|---|
| workflowId | The opaque handle identifying the workflow. | string |
workflowId is accepted with or without its wfpop_ prefix — a bare GUID resolves. findingId and attachmentId are not interchangeable this way: either must carry its exact prefix, or the request 404s as if that finding or attachment did not exist. There is no bare form of either that has ever been valid.
Responses
200
| Property | Description | Type |
|---|---|---|
| workflowId | The workflow handle. | string |
| categories | The workflow owner’s configured categories, in configured order — the order is presentation-meaningful, not incidental. Always an array; [] when none configured. | array |
| links.self | This resource’s own address. | object |
| links.workflowState | The workflow-state read address for this workflow. | object |
categories entry
| Property | Description | Type |
|---|---|---|
| category | The display name, exactly as configured — not a closed set of values. | string |
| status | Rollup review state for this category: IN_PROGRESS when any matched finding still needs review, else RESOLVED. | string |
| findings | The findings in this category — see List a Workflow’s Findings for the Finding shape. [] when none matched, never null. | array |
{
"workflowId": "wfpop_0000000000002082611",
"categories": [
{
"category": "Income",
"status": "IN_PROGRESS",
"findings": [
{
"findingId": "fndg_0000000000006051384",
"code": "HP.ST",
"displayName": "High-priority stated income mismatch",
"category": ["Income"],
"severity": "HIGH",
"alertState": "Alert",
"userMessage": ["Stated income does not match the verified source document."],
"userSuggestion": ["Confirm the applicant's income against the attached document before proceeding."],
"reviewStatus": "PENDING",
"reviewNote": null,
"hasAttachments": true,
"hasHistory": false,
"links": {
"self": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384" },
"history": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/history" },
"attachments": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/attachments" }
},
"editStates": {
"note": {
"href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/note",
"method": "POST"
}
}
}
]
}
],
"links": {
"self": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/bycategories" },
"workflowState": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611" }
}
}
An empty categories array does not mean “nothing to review” — an owner with no categories configured produces an empty list.
A finding classified into more than one category appears once per category it belongs to — its own category field lists every category it carries, so you can tell it’s the same finding wherever you see it.
403
You are not authorized to read this workflow.
Zero-length body, no Content-Type. Do not attempt to parse a body from this response — there is none. Branch on the status code alone.
This surface uses a bodyless 403 for every authorization failure, which is different from a problem+json 404 on the same operation. Do not assume every non-2xx on this API carries JSON — check the status first.
A 403 is also produced at the edge, before this service is reached, when a request value resembles SQL injection or cross-site scripting, and separately from the per-address rate limit (429). Both of those are also bodyless and carry no Content-Type.
404
Unknown workflowId.
An RFC 9457 problem document, served as application/problem+json.
| Property | Description | Type |
|---|---|---|
| type | An absolute URI identifying the problem type. https://pointservices.com/problems/not-found is the only type this surface emits. This is the stable value to match on. | string |
| title | A short summary, written for a person. | string |
| status | The HTTP status code, repeated in the body. | number |
| detail | An explanation of this occurrence, written for your logs — never a stable code. | string |
| instance | A URI identifying this occurrence, written as urn:pps:request:<id>. Quote it when you raise a support ticket. | string |
{
"type": "https://pointservices.com/problems/not-found",
"title": "No such resource",
"status": 404,
"detail": "No workflow 0000000000002082611 is available to this request.",
"instance": "urn:pps:request:8d3a1f56-6c94-4e20-b7f8-0a5e9c2d4b73"
}
Branch on type, never on the text of detail.