Get a FSPM security finding by ID

GET

security

fspm

findings

{id}

TypeScript

const response: Promise<FireblocksResponse<SecurityFindingDetailed>> = fireblocks.securityPostureManagement.getSecurityFindingById(securityPostureManagementApiGetSecurityFindingByIdRequest);

const options = {method: 'GET'};

fetch('https://api.fireblocks.io/v1/security/fspm/findings/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fireblocks.io/v1/security/fspm/findings/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fireblocks.io/v1/security/fspm/findings/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fireblocks.io/v1/security/fspm/findings/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

{
  "id": "d7ca6101-a65e-4a9c-b6c1-b8bd697e0cd2",
  "type": "API_COSIGNER_WITH_NO_CALLBACK",
  "status": "OPEN",
  "severity": "HIGH",
  "category": "USER_MANAGEMENT",
  "createdAt": "2026-07-28T11:37:05.000Z",
  "title": "The API user 'Security admin api' is paired with a co-signer and has no callback",
  "info": {
    "apiKey": "e7c3f18c-3060-3748-3563-19c3dbb3fa88",
    "apiUserName": "Security admin api",
    "cosignerId": "02f53cfa-34a3-4393-a451-e13dfab3c157",
    "cosignerName": "Production Co-Signer"
  },
  "complianceReqs": [],
  "riskExplanation": "An API user that is paired with a co-signer and does not have a callback implementation is vulnerable to auto-approving, allowing malicious transactions to proceed without review.",
  "mitigationGuidance": "Add a callback implementation to the API user. Alternatively, if the API user is no longer needed, you can delete it. To do so, go to Developer Center > API Users, click the actions button (3 dots) next to the API user, and select Delete. Note that by default this action can only be performed by the workspace owner.",
  "statusUpdatedAt": "2026-08-16T08:52:57.000Z",
  "statusUpdatedByUserId": "00d77437-3e7a-4e39-8482-55115a7a0892",
  "statusUpdatedReason": "False positive, callback is configured via a different mechanism"
}

{
  "message": "<string>",
  "code": 123
}

Path Parameters

string<uuid>

required

Unique identifier of the finding

Response

A single FSPM finding

A single FSPM finding, redacted to the public field set

string<uuid>

required

Unique identifier of the finding

Example:

"d7ca6101-a65e-4a9c-b6c1-b8bd697e0cd2"

type

enum<string>

required

The finding type identifier

Available options:

API_USER_NOT_WHITELISTED,

CONSOLE_IP_ALLOWLIST_DEACTIVATED,

ADMIN_TH_SET_TO_ALL_AND_MORE_THAN_2_ADMINS,

API_USERS_COUNT_PASSES_TH_AND_OWNER_NOT_MANDATORY,

API_COSIGNER_WITH_NO_CALLBACK,

API_USER_DIDNT_APPROVE_CCR_IN_X_DAYS,

NON_VIEWER_DIDNT_INITIATE_APPROVE_OR_SIGN_TX_OR_CCR_LAST_X_DAYS,

TH_SET_TO_1_AND_MORE_THAN_3_APPROVERS,

ADMIN_TH_SET_TO_1_AND_MORE_THAN_3_ADMINS,

NON_EVM_DAPP_CONNECTIONS_ENABLED_BUT_UNUSED,

OTA_ENABLED_BUT_UNUSED,

POLICY_NOT_UPDATED_RECENTLY,

RAW_SIGNING_ENABLED_BUT_UNUSED,

API_USER_UNUSED_FOR_90_DAYS,

UNUSED_UNLIMITED_TOKEN_ALLOWANCES,

UNUSED_WHITELISTED_ADDRESS,

TRANSACTION_REPETITION_ATTACK,

USER_EMAIL_DOMAIN_NON_BUSINESS,

OUTDATED_MOBILE_APP_VERSION,

SINGLE_HOP_DRAIN_ATTACK,

LATERAL_MOVEMENT_DRAIN_ATTACK,

WORKSPACE_USER_DORMANT_FOR_X_DAYS

Example:

"API_COSIGNER_WITH_NO_CALLBACK"

status

enum<string>

required

Current status of the finding

Available options:

OPEN,

ACCEPTED,

RESOLVED

Example:

"OPEN"

severity

enum<string>

required

Severity level of the finding

Available options:

INFO,

LOW,

MEDIUM,

HIGH

Example:

"HIGH"

category

enum<string>

required

Category of the finding

Available options:

USER_MANAGEMENT,

APPROVAL_GROUP_MANAGEMENT,

POLICY_ENGINE_UTILIZATION,

WORKSPACE_CONFIGURATION,

DEFI_ACCESS,

FLEET_MANAGEMENT

Example:

"USER_MANAGEMENT"

createdAt

string<date-time>

required

When the finding was first detected

Example:

"2026-07-28T11:37:05.000Z"

title

string

required

Human-readable title of the finding

Example:

"The API user 'Security admin api' is paired with a co-signer and has no callback"

info

object

required

Additional structured context about the finding. Shape varies by finding type.

Show child attributes

Example:

{
  "apiKey": "e7c3f18c-3060-3748-3563-19c3dbb3fa88",
  "apiUserName": "Security admin api",
  "cosignerId": "02f53cfa-34a3-4393-a451-e13dfab3c157",
  "cosignerName": "Production Co-Signer"
}

complianceReqs

object[]

required

Compliance requirements this finding relates to

Show child attributes

Example:

[]

riskExplanation

string

required

Explanation of the risk this finding represents

Example:

"An API user that is paired with a co-signer and does not have a callback implementation is vulnerable to auto-approving, allowing malicious transactions to proceed without review."

mitigationGuidance

string

required

Guidance on how to mitigate this finding

Example:

"Add a callback implementation to the API user. Alternatively, if the API user is no longer needed, you can delete it. To do so, go to Developer Center > API Users, click the actions button (3 dots) next to the API user, and select Delete. Note that by default this action can only be performed by the workspace owner."

statusUpdatedAt

string<date-time>

When the finding status was last updated, omitted if the status was never updated

Example:

"2026-08-16T08:52:57.000Z"

statusUpdatedByUserId

string<uuid>

The user who last updated the finding status, omitted if the status was never updated

Example:

"00d77437-3e7a-4e39-8482-55115a7a0892"

statusUpdatedReason

string

The reason provided for the last status update, omitted if none was provided

Example:

"False positive, callback is configured via a different mechanism"

⌘I

TypeScript

const response: Promise<FireblocksResponse<SecurityFindingDetailed>> = fireblocks.securityPostureManagement.getSecurityFindingById(securityPostureManagementApiGetSecurityFindingByIdRequest);

const options = {method: 'GET'};

fetch('https://api.fireblocks.io/v1/security/fspm/findings/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fireblocks.io/v1/security/fspm/findings/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fireblocks.io/v1/security/fspm/findings/{id}"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fireblocks.io/v1/security/fspm/findings/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

{
  "id": "d7ca6101-a65e-4a9c-b6c1-b8bd697e0cd2",
  "type": "API_COSIGNER_WITH_NO_CALLBACK",
  "status": "OPEN",
  "severity": "HIGH",
  "category": "USER_MANAGEMENT",
  "createdAt": "2026-07-28T11:37:05.000Z",
  "title": "The API user 'Security admin api' is paired with a co-signer and has no callback",
  "info": {
    "apiKey": "e7c3f18c-3060-3748-3563-19c3dbb3fa88",
    "apiUserName": "Security admin api",
    "cosignerId": "02f53cfa-34a3-4393-a451-e13dfab3c157",
    "cosignerName": "Production Co-Signer"
  },
  "complianceReqs": [],
  "riskExplanation": "An API user that is paired with a co-signer and does not have a callback implementation is vulnerable to auto-approving, allowing malicious transactions to proceed without review.",
  "mitigationGuidance": "Add a callback implementation to the API user. Alternatively, if the API user is no longer needed, you can delete it. To do so, go to Developer Center > API Users, click the actions button (3 dots) next to the API user, and select Delete. Note that by default this action can only be performed by the workspace owner.",
  "statusUpdatedAt": "2026-08-16T08:52:57.000Z",
  "statusUpdatedByUserId": "00d77437-3e7a-4e39-8482-55115a7a0892",
  "statusUpdatedReason": "False positive, callback is configured via a different mechanism"
}

{
  "message": "<string>",
  "code": 123
}

Introduction

Errors & Statuses

Data Objects

API Endpoints

Path Parameters

Response