API REFERENCE
Beta
List a Workflow’s Findings
Every finding in the workflow, as one flat list — use this when you want all findings without walking categories. Each entry is identical, field for field, to its counterpart in the categorized view (Get a Workflow’s Findings by Category) and to a direct GET of that finding (Get One Finding).
Read-only in the strict sense: no lock is taken, no workflow is resumed, and nothing is written. Safe to poll.
Sample
url="https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings"
curl -X GET "${url}" \
-H "Authorization: Bearer your_access_token_here"
Header Properties
| Property | Value | Required? |
|---|---|---|
| Authorization | Bearer your token | true |
Path Parameters
| Property | Description | Type |
|---|---|---|
| workflowId | The opaque handle identifying the workflow. | string |
workflowId is accepted with or without its wfpop_ prefix — a bare GUID resolves. findingId and attachmentId are not interchangeable this way: either must carry its exact prefix, or the request 404s as if that finding or attachment did not exist. There is no bare form of either that has ever been valid.
Responses
200
| Property | Description | Type |
|---|---|---|
| workflowId | The workflow handle. | string |
| findings | Every finding in the workflow, in no category-specific order. [] when the workflow has none, never null. | array |
Finding
| Property | Description | Type |
|---|---|---|
| findingId | The opaque finding handle (fndg_…). Every href on this finding is built from it. | string |
| code | The stable, machine-readable code for what was checked. Branch on this, not displayName. | string |
| displayName | The human-facing label. Authored for a person and expected to be reworded — never branch on it. | string |
| category | The categories this finding has been classified into, if any. [], never omitted, when it carries none. | array |
| severity | The authored severity — usually one of CLEAR, LOW, MEDIUM, HIGH, ERROR, but not a closed set. A row written under an older configuration can carry a value outside that list. Have a default branch. | string |
| alertState | The outcome to act on. Equal to the check’s own outcome, unless the finding has been reviewed (see reviewStatus), in which case this always reads "Cleared" regardless of the original outcome. Also not a closed set — have a default branch. | string |
| userMessage | The message authored for the person reading this finding. Always an array, [] when empty. | array |
| userSuggestion | Suggested next steps. Routinely [], and legitimately so — a finding that passed has nothing to suggest. | array |
| reviewStatus | NOT_REQUIRED, PENDING, or REVIEWED — see Reviewing a Finding for the full contract. Not a closed enum: have a default branch for a value introduced later. | string |
| reviewer | Who or what is recorded as having reviewed the finding, as a display summary — never an internal identifier. Absent when nobody has reviewed it, or when the reviewer’s identity could not be resolved. | string |
| reviewNote | The current review note, or null when none has been recorded. Set with Set a Finding’s Review Note. | string, nullable |
| updatedAt | When this finding last changed. RFC 3339 UTC, trailing Z, fractional seconds only when nonzero. Omitted when the stored row carries none. | string |
| hasAttachments | Whether this finding has at least one live attachment. Always present. Follow links.attachments for the actual list. | boolean |
| hasHistory | Whether this finding has any recorded audit-trail entries. Always present. Follow links.history for the actual trail. | boolean |
| links | self, history, attachments. | object |
| editStates | Which of this finding’s mutation endpoints you can call right now — see Reviewing a Finding. Each key present is a {href, method} link; a key is omitted, never false or null, when unavailable. | object |
{
"workflowId": "wfpop_0000000000002082611",
"findings": [
{
"findingId": "fndg_0000000000006051384",
"code": "HP.ST",
"displayName": "High-priority stated income mismatch",
"category": ["Income"],
"severity": "HIGH",
"alertState": "Alert",
"userMessage": ["Stated income does not match the verified source document."],
"userSuggestion": ["Confirm the applicant's income against the attached document before proceeding."],
"reviewStatus": "PENDING",
"reviewNote": null,
"hasAttachments": true,
"hasHistory": false,
"links": {
"self": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384" },
"history": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/history" },
"attachments": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/attachments" }
},
"editStates": {
"note": {
"href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051384/note",
"method": "POST"
}
}
},
{
"findingId": "fndg_0000000000006051385",
"code": "AS.CL",
"displayName": "Asset verification cleared",
"category": [],
"severity": "CLEAR",
"alertState": "Cleared",
"userMessage": [],
"userSuggestion": [],
"reviewStatus": "NOT_REQUIRED",
"reviewNote": null,
"hasAttachments": false,
"hasHistory": false,
"links": {
"self": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051385" },
"history": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051385/history" },
"attachments": { "href": "https://api.pointservices.com/riskinsight-services-ws/resources/v1/findings/workflows/wfpop_0000000000002082611/findings/fndg_0000000000006051385/attachments" }
}
}
]
}
editStates keys are independent. The second finding above carries no editStates at all — every mutation is unavailable for the caller who fetched this response. Holding permission for note says nothing about resolve, reset, or attachment; check each key’s presence separately, never infer one from another.
A finding with no configured category still returns "category": [], never a missing key or null — see the second finding above.
403
You are not authorized to read this workflow.
Zero-length body, no Content-Type. Do not attempt to parse a body from this response — there is none. Branch on the status code alone.
This surface uses a bodyless 403 for every authorization failure, which is different from a problem+json 404 on the same operation. Do not assume every non-2xx on this API carries JSON — check the status first.
A 403 is also produced at the edge, before this service is reached, when a request value resembles SQL injection or cross-site scripting, and separately from the per-address rate limit (429). Both of those are also bodyless and carry no Content-Type.
404
Unknown workflowId.
An RFC 9457 problem document, served as application/problem+json.
| Property | Description | Type |
|---|---|---|
| type | An absolute URI identifying the problem type. https://pointservices.com/problems/not-found is the only type this surface emits. This is the stable value to match on. | string |
| title | A short summary, written for a person. | string |
| status | The HTTP status code, repeated in the body. | number |
| detail | An explanation of this occurrence, written for your logs — never a stable code. | string |
| instance | A URI identifying this occurrence, written as urn:pps:request:<id>. Quote it when you raise a support ticket. | string |
{
"type": "https://pointservices.com/problems/not-found",
"title": "No such resource",
"status": 404,
"detail": "No workflow 0000000000002082611 is available to this request.",
"instance": "urn:pps:request:8d3a1f56-6c94-4e20-b7f8-0a5e9c2d4b73"
}
Branch on type, never on the text of detail.