av dast findings

List the DAST findings the server currently holds for a project, each tiered REDYELLOWGREEN.

Synopsis

av dast findings [flags]

Description

av dast findings pulls a project’s DAST findings from the server - the consolidated result of every scan uploaded to the project with av dast scan --project. You must be logged in (av login), and --project is required. The same findings appear on the project’s Dynamic Scan page in the web app.

Three filters narrow the list. --state selects open (the default), fixed, or all findings. --severity keeps one tier: red, yellow, or green. --target keeps findings whose scanned target URL contains the given substring (case-insensitive) - handy when a project has several registered targets.

The default output is a table - SEVERITY, STATE, ENGINE, RULE, METHOD, URL, NAME - headed by a summary of the RED / YELLOW / GREEN counts. The ENGINE column shows the scanner’s generic capability label (web-scanner, template-scanner), never a product name. In the table, the finding name is collapsed to a single line and truncated at 140 characters; --json and --export keep the full, untouched value. --json prints the raw JSON payload instead.

--export writes the result to disk instead of printing a table: a styled, self-contained HTML report, or the raw JSON when combined with --json. Pass a directory to get dast-findings.html (or .json) inside it, or a path with an extension to name the file yourself.

Options

Flag	Default	Description
--project	-	Project ID (required)
--state	open	Finding state: open, all, or fixed
--severity	-	Filter by severity: red, yellow, or green
--target	-	Filter to findings whose target URL contains this substring (case-insensitive)
--json	false	Output raw JSON instead of a table
--export	-	Export to a directory or file (HTML; raw JSON with --json)

Examples

List a project’s open findings:

av dast findings --project <projectId>

Focus on what needs action now - open RED findings only:

av dast findings --project <projectId> --severity red --state open

Pull one target’s findings as JSON, for scripting or piping into jq:

av dast findings --project <projectId> --target staging --json

Tip

--export ./reports writes a self-contained dast-findings.html you can attach to a ticket or share - no CLI required to read it.

Exit codes

Code	Meaning
0	Findings listed (or exported), even when the list is empty
1	Not logged in, missing --project, invalid --state or --severity, or the API request failed

See also

• av dast scan - run a scan locally and upload findings to a project
• av dast targets - list the scan targets registered for a project
• av dast jobs - show a project’s DAST scan-run history