Struct GetCodeFindingOutput 

#[non_exhaustive]
pub struct GetCodeFindingOutput {

    pub type: FindingType,
    pub title: String,
    pub severity: FindingSeverityId,
    pub summary: Option<String>,
    pub detailed_description: Option<String>,
    pub category: Option<String>,
    pub sub_category: Option<String>,
    pub cwe_ids: Option<Vec<String>>,
    pub owasp_category: Option<String>,
    pub mitigation: Option<String>,
    pub file_path: Option<String>,
    pub line_number: Option<i32>,
    pub cve_id: Option<String>,
    pub cvss_base_score: Option<f64>,
    pub affected_packages: Option<Vec<AffectedPackage>>,
    pub vulnerable_code: Option<String>,
    pub relevant_inputs: Option<Vec<String>>,
    pub steps_to_reproduce: Option<Vec<String>>,
    pub validation: Option<FindingValidation>,
    pub end_line: Option<i32>,
    pub mitre_techniques: Option<Vec<String>>,
    pub remediation_references: Option<Vec<String>>,
    pub ocsf_class: Option<FindingOcsfClass>,
    pub ocsf_schema_version: Option<String>,
    pub product_name: Option<String>,
    pub product_vendor_name: Option<String>,
    pub product_version: Option<String>,
    pub source_status: Option<String>,
    pub source_status_id: Option<i32>,
    pub first_seen_at: Option<DateTime>,
    pub finding_types: Option<Vec<String>>,
    pub vulnerabilities: Option<Vec<FindingVulnerability>>,
    pub resources: Option<Vec<FindingResource>>,
    pub posture: Option<FindingPosture>,
    pub finding_id: String,
    pub finding_arn: String,
    pub environment_id: String,
    pub source: String,
    pub source_finding_id: String,
    pub reported_at: DateTime,
    pub status: FindingStatus,
    pub status_updated_at: DateTime,
    pub created_at: DateTime,
    pub scan_run_id: Option<String>,
    pub status_message: Option<String>,
    pub discard_reason: Option<FindingDiscardReason>,
    pub discard_reasoning: Option<String>,
    pub duplicate_of_issue_id: Option<String>,
    pub created_issue_id: Option<String>,
    pub completed_at: Option<DateTime>,
    /* private fields */
}

Contains the current state and details of the requested finding. Which type-specific members are populated depends on type.

Fields (Non-exhaustive)

Non-exhaustive structs could have additional fields added in future. Therefore, non-exhaustive structs cannot be constructed in external crates using the traditional Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.

type: FindingType

What kind of finding this is. Determines which of the type-specific members below are populated.

title: String

The producer’s title for the finding.

severity: FindingSeverityId

The finding’s severity.

summary: Option<String>

A one-paragraph description.

detailed_description: Option<String>

The full analysis.

category: Option<String>

The producer’s vulnerability category. Not a stable filter key across finding types – see FindingCategory.

sub_category: Option<String>

A more specific classification within category.

cwe_ids: Option<Vec<String>>

CWE identifiers classifying the finding.

owasp_category: Option<String>

The OWASP Top 10 category, when the producer supplies one.

mitigation: Option<String>

How to fix the finding.

file_path: Option<String>

The file the finding is about.

line_number: Option<i32>

The 1-indexed line the finding is about. Bounds are enforced server-side rather than by a constraint trait: a numeric constraint generates a distinct newtype per enclosing structure, so the same concept would not share a type across the create input and the read output.

cve_id: Option<String>

The CVE this finding reports, for software-composition findings. Both code types can carry one: a customer document supplies it under vulnerabilities[].cve, and Continuum’s scanner reports CVEs for dependency-manifest findings.

cvss_base_score: Option<f64>

The CVSS base score accompanying cveId, when the producer supplies one, from 0.0 to 10.0. Not computed by Continuum. The range is enforced server-side, not by a @range trait – the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).

affected_packages: Option<Vec<AffectedPackage>>

Packages implicated by the finding.

vulnerable_code: Option<String>

The vulnerable code fragment.

relevant_inputs: Option<Vec<String>>

User-controlled inputs that reach the vulnerability.

steps_to_reproduce: Option<Vec<String>>

Steps to reproduce or exploit the finding.

validation: Option<FindingValidation>

The validator’s assessment. Absent when no validation ran.

end_line: Option<i32>

The last line of the affected range, from the document’s affected_code[].end_line.

mitre_techniques: Option<Vec<String>>

MITRE ATT&CK technique identifiers, from the document’s finding_info.attacks[].technique.uid.

remediation_references: Option<Vec<String>>

Remediation references, from the document’s vulnerabilities[].remediation.references.

ocsf_class: Option<FindingOcsfClass>

The OCSF class the document declared. Determines whether posture is populated.

ocsf_schema_version: Option<String>

The OCSF schema version the producer wrote against (metadata.version).

product_name: Option<String>

The producing product and vendor (metadata.product).

product_vendor_name: Option<String>

A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

product_version: Option<String>

A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

source_status: Option<String>

The producer’s own status for the finding, and the enum value behind it. Distinct from status, which is Continuum’s lifecycle state – a producer may call a finding “New” while Continuum has it SUBMITTED.

source_status_id: Option<i32>

The producer’s numeric enum value for sourceStatus.

first_seen_at: Option<DateTime>

When the producer first observed the finding (finding_info.first_seen_time). The producer’s own clock, not Continuum’s.

finding_types: Option<Vec<String>>

The producer’s own classification of the finding (finding_info.types).

vulnerabilities: Option<Vec<FindingVulnerability>>

Every vulnerability the document reported. A document may report several; the flat cveId/cvssBaseScore/filePath/lineNumber members above carry the first one’s identity so a caller that only needs “what and where” does not have to walk this list.

resources: Option<Vec<FindingResource>>

Resources the document named (resources[]).

posture: Option<FindingPosture>

The compliance posture, for an Application Security Posture Finding. Absent for a vulnerability finding.

finding_id: String

The unique identifier of the finding.

finding_arn: String

The ARN of the finding.

environment_id: String

The environment that owns the finding.

source: String

The system that produced the finding.

source_finding_id: String

The producer’s own identifier for the finding.

reported_at: DateTime

When the producer reported the finding – its own clock, which is not Continuum’s ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one. For CreateCodeFinding, this is the submitted OCSF document’s own top-level time. For findings Continuum’s scanner produces, it is the finding’s own creation time. Continuum does not validate it for plausibility: a producer’s value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.

status: FindingStatus

The current lifecycle status of the finding.

status_updated_at: DateTime

The timestamp when the status last transitioned.

created_at: DateTime

The timestamp when the finding was ingested.

scan_run_id: Option<String>

The scan that produced the finding, when it came from one. For a finding Continuum’s scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document’s metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.

status_message: Option<String>

Human-readable context about the current status.

discard_reason: Option<FindingDiscardReason>

Why the finding was not escalated. Present only when status is DISCARDED.

discard_reasoning: Option<String>

Customer-facing explanation accompanying discardReason.

duplicate_of_issue_id: Option<String>

The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.

created_issue_id: Option<String>

The issue Continuum created from this finding.

completed_at: Option<DateTime>

When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.

Implementations

impl GetCodeFindingOutput

pub fn type(&self) -> &FindingType

What kind of finding this is. Determines which of the type-specific members below are populated.

pub fn title(&self) -> &str

The producer’s title for the finding.

pub fn severity(&self) -> &FindingSeverityId

The finding’s severity.

pub fn summary(&self) -> Option<&str>

A one-paragraph description.

pub fn detailed_description(&self) -> Option<&str>

The full analysis.

pub fn category(&self) -> Option<&str>

The producer’s vulnerability category. Not a stable filter key across finding types – see FindingCategory.

pub fn sub_category(&self) -> Option<&str>

A more specific classification within category.

pub fn cwe_ids(&self) -> &[String]

CWE identifiers classifying the finding.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .cwe_ids.is_none().

pub fn owasp_category(&self) -> Option<&str>

The OWASP Top 10 category, when the producer supplies one.

pub fn mitigation(&self) -> Option<&str>

How to fix the finding.

pub fn file_path(&self) -> Option<&str>

The file the finding is about.

pub fn line_number(&self) -> Option<i32>

The 1-indexed line the finding is about. Bounds are enforced server-side rather than by a constraint trait: a numeric constraint generates a distinct newtype per enclosing structure, so the same concept would not share a type across the create input and the read output.

pub fn cve_id(&self) -> Option<&str>

The CVE this finding reports, for software-composition findings. Both code types can carry one: a customer document supplies it under vulnerabilities[].cve, and Continuum’s scanner reports CVEs for dependency-manifest findings.

pub fn cvss_base_score(&self) -> Option<f64>

The CVSS base score accompanying cveId, when the producer supplies one, from 0.0 to 10.0. Not computed by Continuum. The range is enforced server-side, not by a @range trait – the smithy-rs server SDK does not support range constraints on double shapes (smithy-rs#2007).

pub fn affected_packages(&self) -> &[AffectedPackage]

Packages implicated by the finding.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .affected_packages.is_none().

pub fn vulnerable_code(&self) -> Option<&str>

The vulnerable code fragment.

pub fn relevant_inputs(&self) -> &[String]

User-controlled inputs that reach the vulnerability.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .relevant_inputs.is_none().

pub fn steps_to_reproduce(&self) -> &[String]

Steps to reproduce or exploit the finding.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .steps_to_reproduce.is_none().

pub fn validation(&self) -> Option<&FindingValidation>

The validator’s assessment. Absent when no validation ran.

pub fn end_line(&self) -> Option<i32>

The last line of the affected range, from the document’s affected_code[].end_line.

pub fn mitre_techniques(&self) -> &[String]

MITRE ATT&CK technique identifiers, from the document’s finding_info.attacks[].technique.uid.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .mitre_techniques.is_none().

pub fn remediation_references(&self) -> &[String]

Remediation references, from the document’s vulnerabilities[].remediation.references.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .remediation_references.is_none().

pub fn ocsf_class(&self) -> Option<&FindingOcsfClass>

The OCSF class the document declared. Determines whether posture is populated.

pub fn ocsf_schema_version(&self) -> Option<&str>

The OCSF schema version the producer wrote against (metadata.version).

pub fn product_name(&self) -> Option<&str>

The producing product and vendor (metadata.product).

pub fn product_vendor_name(&self) -> Option<&str>

A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

pub fn product_version(&self) -> Option<&str>

A vulnerability-taxonomy label: the producer’s category, sub-category, or OWASP category. Deliberately unconstrained beyond length – producers do not share a taxonomy, so this is NOT a stable filter key across finding types. Use cweIds when a stable classification is needed.

pub fn source_status(&self) -> Option<&str>

The producer’s own status for the finding, and the enum value behind it. Distinct from status, which is Continuum’s lifecycle state – a producer may call a finding “New” while Continuum has it SUBMITTED.

pub fn source_status_id(&self) -> Option<i32>

The producer’s numeric enum value for sourceStatus.

pub fn first_seen_at(&self) -> Option<&DateTime>

When the producer first observed the finding (finding_info.first_seen_time). The producer’s own clock, not Continuum’s.

pub fn finding_types(&self) -> &[String]

The producer’s own classification of the finding (finding_info.types).

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .finding_types.is_none().

pub fn vulnerabilities(&self) -> &[FindingVulnerability]

Every vulnerability the document reported. A document may report several; the flat cveId/cvssBaseScore/filePath/lineNumber members above carry the first one’s identity so a caller that only needs “what and where” does not have to walk this list.

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .vulnerabilities.is_none().

pub fn resources(&self) -> &[FindingResource]

Resources the document named (resources[]).

If no value was sent for this field, a default will be set. If you want to determine if no value was sent, use .resources.is_none().

pub fn posture(&self) -> Option<&FindingPosture>

The compliance posture, for an Application Security Posture Finding. Absent for a vulnerability finding.

pub fn finding_id(&self) -> &str

The unique identifier of the finding.

pub fn finding_arn(&self) -> &str

The ARN of the finding.

pub fn environment_id(&self) -> &str

The environment that owns the finding.

pub fn source(&self) -> &str

The system that produced the finding.

pub fn source_finding_id(&self) -> &str

The producer’s own identifier for the finding.

pub fn reported_at(&self) -> &DateTime

When the producer reported the finding – its own clock, which is not Continuum’s ingestion time. createdAt is when Continuum accepted it; these are genuinely different instants and a reader usually wants this one. For CreateCodeFinding, this is the submitted OCSF document’s own top-level time. For findings Continuum’s scanner produces, it is the finding’s own creation time. Continuum does not validate it for plausibility: a producer’s value is echoed as given, so a timestamp here asserts the unit and format, not that the instant is genuine.

pub fn status(&self) -> &FindingStatus

The current lifecycle status of the finding.

pub fn status_updated_at(&self) -> &DateTime

The timestamp when the status last transitioned.

pub fn created_at(&self) -> &DateTime

The timestamp when the finding was ingested.

pub fn scan_run_id(&self) -> Option<&str>

The scan that produced the finding, when it came from one. For a finding Continuum’s scanner produced, this is the Continuum scan run (see GetCodeScan). For a finding submitted with CreateCodeFinding, it is the OCSF document’s metadata.correlation_uid, when that value is a valid ScanRunId. Absent when the finding did not come from a scan.

pub fn status_message(&self) -> Option<&str>

Human-readable context about the current status.

pub fn discard_reason(&self) -> Option<&FindingDiscardReason>

Why the finding was not escalated. Present only when status is DISCARDED.

pub fn discard_reasoning(&self) -> Option<&str>

Customer-facing explanation accompanying discardReason.

pub fn duplicate_of_issue_id(&self) -> Option<&str>

The existing issue this finding duplicates. Present only for the DUPLICATE_OF_* discard reasons.

pub fn created_issue_id(&self) -> Option<&str>

The issue Continuum created from this finding.

pub fn completed_at(&self) -> Option<&DateTime>

When processing finished, whether by creating an issue or discarding. Absent while the finding is still in flight.

impl GetCodeFindingOutput

pub fn builder() -> GetCodeFindingOutputBuilder

Creates a new builder-style object to manufacture GetCodeFindingOutput.

Trait Implementations

impl Clone for GetCodeFindingOutput

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for GetCodeFindingOutput

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for GetCodeFindingOutput

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl RequestId for GetCodeFindingOutput

fn request_id(&self) -> Option<&str>

Returns the request ID, or None if the service could not be reached.

impl StructuralPartialEq for GetCodeFindingOutput