Vetrix Docs

Exporting findings

Two formats, one endpoint.

Endpoint

GET /api/v1/repos/{owner}/{repo}/security/findings/export
    ?format=sarif|csv
    &severity=critical,high
    &category=sast,sca
    &state=detected

Every filter the /security/findings dashboard accepts is honoured on the export — copying a dashboard URL and swapping the path segment produces the export of exactly what you are looking at.

Formats

SARIF 2.1.0

  • format=sarif (default when the query is omitted).
  • MIME: application/sarif+json.
  • Validates against the official SARIF 2.1.0 schema — downstream SIEMs, GitHub Advanced Security, GitLab security widgets, and the CodeQL viewer import it without conversion.
  • One Result per fingerprint; occurrences folded in properties.
  • Dismissed findings carry kind=informational so rule-based filters can drop them.

CSV

  • format=csv.
  • MIME: text/csv; charset=utf-8.
  • Fixed column order: fingerprint, severity, category, rule_id, file, line, detected_at, state, dismissed_reason. This is a breaking change when modified — saved sheets key off it.
  • Quoting follows RFC 4180. Commas, quotes, and embedded newlines in dismissal reasons round-trip cleanly through Excel and Google Sheets.

Rate limit

10 exports per hour per (user, repo). Exceeding returns HTTP 429.

Scale

Response bodies stream directly from the pgx row iterator — there is no intermediate slice. A 100k-finding repo exports without a memory spike on the server side. Clients should stream the body to disk rather than buffering in memory.

ACL

PermSecurityRead. No write grant is needed — export is strictly a read of already-dashboard-visible data.

UI

The findings page ships Export SARIF and Export CSV buttons that append the active filter state to the URL. Copy the button's href for deep links.