List scan findings | Modular DS

{
  "data": [
    {
      "attributes": {
        "column_name": null,
        "created_at": "2026-09-18T09:12:00.000000Z",
        "path": "wp-content/uploads/2026/09/shell.php",
        "severity": "critical",
        "site_scan_id": 3021,
        "status": "detected",
        "table_name": null,
        "threat_category": "infected",
        "type": "file"
      },
      "id": "9931",
      "type": "site-scan-items"
    },
    {
      "attributes": {
        "column_name": "post_content",
        "created_at": "2026-09-18T09:13:00.000000Z",
        "path": null,
        "severity": "medium",
        "site_scan_id": 3021,
        "status": "detected",
        "table_name": "wp_posts",
        "threat_category": "suspicious",
        "type": "database"
      },
      "id": "9932",
      "type": "site-scan-items"
    }
  ],
  "jsonapi": {
    "version": "1.1"
  },
  "meta": {
    "current_page": 1,
    "per_page": 15,
    "total": 2
  }
}

Lists the findings of the user’s malware scans. Narrow with filter[site_scan][] for one scan’s findings, or filter[site][] for every finding of a website across scans.

Response attributes: type (file, database - which branch the finding came from), status (detected, ignored, failed), severity (low, medium, high, critical), threat_category (infected - cleaned by replacing content; malicious - deleted or truncated; suspicious - needs a human decision), path (file findings), table_name/column_name (database findings), site_scan_id and created_at. The raw file hash or malware signature name is never exposed.

Lists the findings of the user's malware scans. Narrow with `filter[site_scan][]` for one scan's findings, or `filter[site][]` for every finding of a website across scans. Response attributes: `type` (file, database - which branch the finding came from), `status` (detected, ignored, failed), `severity` (low, medium, high, critical), `threat_category` (infected - cleaned by replacing content; malicious - deleted or truncated; suspicious - needs a human decision), `path` (file findings), `table_name`/`column_name` (database findings), `site_scan_id` and `created_at`. The raw file hash or malware signature name is never exposed.

Authentication

AuthorizationBearer

Personal access token created in the Modular DS dashboard; read-only tokens can only call GET endpoints.

Query parameters

filter[id][]stringOptional

Exact finding ids (repeatable)

filter[site_scan][]stringOptional

Exact scan ids, one scan’s findings (repeatable)

filter[site][]stringOptional

Exact website ids, every finding of a website across scans (repeatable)

filter[type][]stringOptional

file | database (repeatable)

filter[severity][]stringOptional

low | medium | high | critical (repeatable)

filter[threat_category][]stringOptional

infected | malicious | suspicious (repeatable)

filter[status][]stringOptional

detected | ignored | failed (repeatable)

sortstringOptional

created_at, severity; prefix with - to invert. Default: -created_at (newest first). sort=-severity lists critical first

page[number]stringOptional

page[size]stringOptional

Max 50

Response

200 - Scan findings list

datalist of objectsOptional

jsonapiobjectOptional

metaobjectOptional