> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

<AgentInstructions>

## Submitting Feedback

If you encounter incorrect, outdated, or confusing documentation on this page, submit feedback:

POST https://docs.endorlabs.com/feedback

```json
{
  "path": "/developers-api/rest-api/using-the-rest-api/getting-started/index",
  "feedback": "Description of the issue"
}
```

Only submit feedback when you have something specific and actionable to report.

</AgentInstructions>

# Getting started

> Learn how to use the Endor Labs REST API.

export const YamlTable = ({children, data: propData, content}) => {
  const KV_RE = /^([A-Za-z][A-Za-z0-9_()/#\s-]+?):\s*(.+)$/;
  const INLINE_MD_RE = /(\[([^\]]+)\]\(([^)]+)\))|(`([^`]+)`)|(\*\*([^*]+)\*\*)|(\*([^*]+)\*)/g;
  const YES_RE = /^-yes-$/i;
  const NO_RE = /^-no-$/i;
  const LIMITED_RE = /^-(limited|partial)-$/i;
  const NA_RE = /^-(na|none)-$/i;
  const NA2_RE = /^-na2-$/i;
  const SIMPLE_TAG_RE = /(<br\s*\/?>)|(<p\s*\/?>)|(-note-)|(-warning-)/gi;
  const tryParseKV = trimmed => {
    const m = KV_RE.exec(trimmed);
    return m ? {
      key: m[1],
      value: m[2].trim()
    } : null;
  };
  const registerKey = (key, seenKeys, orderedKeys) => {
    if (!seenKeys.has(key)) {
      orderedKeys.push(key);
      seenKeys.add(key);
    }
  };
  const flushEntry = (currentEntry, entries) => {
    if (Object.keys(currentEntry).length > 0) entries.push(currentEntry);
  };
  const parseDashPrefixed = (lines, entries, orderedKeys, seenKeys) => {
    let currentEntry = {};
    let inEntry = false;
    for (const line of lines) {
      const trimmed = line.trim();
      if (trimmed.startsWith('- ')) {
        if (inEntry) entries.push(currentEntry);
        currentEntry = {};
        inEntry = true;
        const kv = tryParseKV(trimmed.substring(2).trim());
        if (kv) {
          registerKey(kv.key, seenKeys, orderedKeys);
          currentEntry[kv.key] = kv.value;
        }
      } else if (inEntry && trimmed !== '') {
        const kv = tryParseKV(trimmed);
        if (kv) {
          registerKey(kv.key, seenKeys, orderedKeys);
          currentEntry[kv.key] = kv.value;
        }
      }
    }
    flushEntry(currentEntry, entries);
  };
  const parseBlankSeparated = (lines, entries, orderedKeys, seenKeys) => {
    let currentEntry = {};
    let inEntry = false;
    for (const line of lines) {
      const trimmed = line.trim();
      if (trimmed === '') {
        if (inEntry) {
          flushEntry(currentEntry, entries);
          currentEntry = {};
          inEntry = false;
        }
        continue;
      }
      const kv = tryParseKV(trimmed);
      if (!kv) continue;
      const isNewEntry = !line.startsWith(' ') && !line.startsWith('\t');
      if (isNewEntry && inEntry && Object.keys(currentEntry).length > 0) {
        entries.push(currentEntry);
        currentEntry = {};
      }
      registerKey(kv.key, seenKeys, orderedKeys);
      currentEntry[kv.key] = kv.value;
      inEntry = true;
    }
    flushEntry(currentEntry, entries);
  };
  const normalizeEntries = (entries, orderedKeys) => entries.map(entry => {
    const filled = {};
    for (const key of orderedKeys) filled[key] = entry[key] || '';
    return filled;
  });
  const parseYamlTableContent = contentStr => {
    if (!contentStr) return [];
    const entries = [];
    const orderedKeys = [];
    const seenKeys = new Set();
    const lines = contentStr.split('\n');
    if (lines.some(line => line.trim().startsWith('- '))) {
      parseDashPrefixed(lines, entries, orderedKeys, seenKeys);
    } else {
      parseBlankSeparated(lines, entries, orderedKeys, seenKeys);
    }
    return normalizeEntries(entries, orderedKeys);
  };
  const processText = text => {
    if (!text) return text;
    const parts = [];
    let keyIndex = 0;
    let lastIndex = 0;
    let match;
    while ((match = INLINE_MD_RE.exec(text)) !== null) {
      if (match.index > lastIndex) parts.push(text.slice(lastIndex, match.index));
      if (match[1]) {
        parts.push(<a key={keyIndex++} href={match[3]}>{match[2]}</a>);
      } else if (match[4]) {
        parts.push(<code key={keyIndex++}>{match[5]}</code>);
      } else if (match[6]) {
        parts.push(<strong key={keyIndex++}>{match[7]}</strong>);
      } else if (match[8]) {
        parts.push(<em key={keyIndex++}>{match[9]}</em>);
      }
      lastIndex = match.index + match[0].length;
    }
    if (lastIndex < text.length) parts.push(text.slice(lastIndex));
    if (parts.length === 0) return text;
    const keyRef = {
      current: keyIndex
    };
    return expandHtmlTags(parts, keyRef);
  };
  const processBadges = text => {
    if (!text || typeof text !== 'string') return text;
    if (YES_RE.test(text)) return <span className="yt-badge-yes" role="img" aria-label="Supported" title="Supported">✓</span>;
    if (NO_RE.test(text)) return <span className="yt-badge-no" role="img" aria-label="Not supported" title="Not supported">✗</span>;
    if (LIMITED_RE.test(text)) return <span className="yt-badge-limited" role="img" aria-label="Partially supported" title="Partially supported">◐</span>;
    if (NA_RE.test(text) || NA2_RE.test(text)) return <span className="yt-sr-only" title="Not applicable">Not applicable</span>;
    return processText(text);
  };
  const cellClassName = text => {
    if (!text || typeof text !== 'string') return undefined;
    if (NA_RE.test(text)) return 'yt-cell-na';
    if (NA2_RE.test(text)) return 'yt-cell-na2';
    return undefined;
  };
  const expandSimpleTags = (str, keyRef) => {
    const result = [];
    let last = 0;
    SIMPLE_TAG_RE.lastIndex = 0;
    let m;
    while ((m = SIMPLE_TAG_RE.exec(str)) !== null) {
      if (m.index > last) result.push(str.slice(last, m.index));
      if (m[1]) {
        result.push(<br key={keyRef.current++} />);
      } else if (m[2]) {
        result.push(<br key={keyRef.current++} />, <br key={keyRef.current++} />);
      } else if (m[3]) {
        result.push(<span key={keyRef.current++} className="yt-badge-note" style={{
          fontWeight: 600
        }}>Note: </span>);
      } else if (m[4]) {
        result.push(<span key={keyRef.current++} className="yt-badge-warning" style={{
          fontWeight: 600
        }}>Warning: </span>);
      }
      last = m.index + m[0].length;
    }
    if (last < str.length) result.push(str.slice(last));
    return result;
  };
  const expandHtmlTags = (chunks, keyRef) => {
    const out = [];
    for (const chunk of chunks) {
      if (typeof chunk === 'string') {
        out.push(...expandSimpleTags(chunk, keyRef));
      } else {
        out.push(chunk);
      }
    }
    return out;
  };
  const extractText = node => {
    if (node === null || node === undefined) return '';
    if (typeof node === 'string') return node;
    if (typeof node === 'number') return String(node);
    if (typeof node === 'boolean') return '';
    if (Array.isArray(node)) return node.map(extractText).join('');
    if (node && typeof node === 'object' && node.type) {
      const props = node.props || ({});
      if (typeof props.children === 'string') return props.children;
      if (props.children) return extractText(props.children);
      return '';
    }
    return String(node || '');
  };
  const [mounted, setMounted] = useState(false);
  useEffect(() => {
    setMounted(true);
  }, []);
  const data = useMemo(() => {
    if (propData) return propData;
    if (content && typeof content === 'string') return parseYamlTableContent(content);
    if (!children) return [];
    if (typeof children === 'string') return parseYamlTableContent(children);
    const childrenArray = Array.isArray(children) ? children : [children];
    return parseYamlTableContent(childrenArray.map(extractText).join('').trim());
  }, [children, propData, content]);
  const columns = useMemo(() => {
    if (!data || data.length === 0) return [];
    const firstRow = data[0];
    if (!firstRow || typeof firstRow !== 'object') return [];
    return Object.keys(firstRow);
  }, [data]);
  if (!mounted) return null;
  if (!data || data.length === 0) return null;
  const rowKey = row => columns.map(c => row[c] || '').join('|');
  return <table>
      <thead>
        <tr>
          {columns.map(col => <th key={col}>{col.replaceAll('_', ' ')}</th>)}
        </tr>
      </thead>
      <tbody>
        {data.map(row => <tr key={rowKey(row)}>
            {columns.map(col => <td key={col} className={cellClassName(row[col])}>{processBadges(row[col])}</td>)}
          </tr>)}
      </tbody>
    </table>;
};

## Introduction

This article describes how to use the Endor Labs REST API. For a quickstart guide, see [Quickstart for Endor Labs REST API](/developers-api/rest-api/quickstart).

The Endor Labs command line tool `endorctl` wraps the REST API and lets you interact with Endor Labs without managing REST protocol details.
For more information, see [Making a request](#making-a-request) below and the [Endor Labs CLI documentation](/developers-api/cli/commands/api).

For a complete list of Endor Labs REST API endpoints, see the [Endor Labs OpenAPI documentation](/api-reference/).

## About requests to the REST API

This section describes the elements that make up an API request:

* [HTTP method](#http-method)
* [Path](#path)
* [Headers](#headers)
* [Parameters](#parameters)

Every request to the REST API includes an HTTP method and a path. Depending on the REST API endpoint, you might also need to specify request headers, authentication information, list parameters, or body parameters.

The REST API reference documentation describes the HTTP method, path, and parameters for every endpoint. It also displays example requests and responses for each endpoint. For more information, see the [Endor Labs REST API documentation](/developers-api/rest-api/using-the-rest-api/getting-started/..).

## HTTP method

The HTTP method of an endpoint defines the type of action it performs on a given resource. Some common HTTP methods are GET, POST, DELETE, and PATCH. The REST API reference documentation provides the HTTP method for every endpoint.

For example, the HTTP method for the [List Findings](/api-reference/findingservice/listfindings) endpoint is GET.

Where possible, the Endor Labs REST API strives to use an appropriate HTTP method for each action.

<YamlTable>
  {`


    - Action: GET
    Description: Used for retrieving resources.
    - Action: POST
    Description: Used for creating resources.
    - Action: PATCH
    Description: Used for updating properties of resources.
    - Action: DELETE
    Description: Used for deleting resources.

    `}
</YamlTable>

## Path

Each endpoint has a path. The [Endor Labs REST API reference documentation](/api-reference/) gives the path for every endpoint. For example, the path for the [List Findings](/api-reference/findingservice/listfindings) endpoint is `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/findings` and the path for the [Get Finding](/api-reference/findingservice/getfinding) endpoint is `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/findings/{uuid}`.

The curly brackets {} in a path denote path parameters that you need to specify. Path parameters modify the endpoint path, and your request must include them. For example, the path parameter for the [List Findings](/api-reference/findingservice/listfindings) endpoint is `{tenant_meta.namespace}`. To use this path in your API request, replace `{tenant_meta.namespace}` with the name of the namespace where you want to request a list of findings. To get a specific finding object, add the object UUID to the end of the path.

## Headers

Headers provide extra information about the request and the desired response. Following are some examples of headers that you can use in your requests to the Endor Labs REST API. For an example of a request that uses headers, see [Making a request](#making-a-request).

### Authentication

All endpoints require authentication. Use the `endorctl init` command to authenticate with Endor Labs. For more information, see [Authentication](/developers-api/rest-api/authentication). For examples, see [Making a request](#making-a-request).

### Accept-Encoding

You may optionally use the `Accept-Encoding` header to enable compression of HTTP responses for performance optimization. Endor Labs supports the following encodings: `gzip`, `br` (`Brotli`), and `zstd`. If you specify multiple encodings, gzip takes priority. Ensure that the client can correctly handle the specified encoding. You can provide the `Accept-Encoding` header in the following format: `Accept-Encoding: gzip, br, zstd`.

### Content-Type

To improve API performance, set the `Content-Type` header to `application/jsoncompact`. This prevents Endor Labs APIs from returning null or empty values, which is the default behavior.

### Request-timeout

Use the `Request-timeout` header to specify the amount of time, in seconds, that you are willing to wait for a server response. For example: `--header "Request-Timeout: 10"`.

The corresponding option for `endorctl` requests is `-t/--timeout`, for example: `-t 10s`.

## Parameters

Many API methods require or allow you to send additional information in parameters in your request. There are a few different types of parameters: Path parameters, list parameters, and body parameters.

### Path parameters

Path parameters modify the endpoint path. These parameters are required in your request. For more information, see [Path](#path).

### List parameters

List parameters allow you to control what data is returned for a request. In most cases, these parameters are optional. The documentation for each Endor Labs REST API endpoint describes any list parameters that it supports.

For example, all Endor Labs endpoints return one hundred objects by default. You can set `page_size=2` to return two objects instead of 100. You can set `count=true` to just return the number of objects. You can use the `filter` list parameter to only list objects that match a specified list of criteria (see [filters](/developers-api/rest-api/using-the-rest-api/filters)). For examples of requests that use list parameters, see [Making a request](#making-a-request) and [Use cases](/developers-api/rest-api/using-the-rest-api/use-cases).

<YamlTable>
  {`


    - List_Parameter: \`ci_run_uuid\`
    Description: Only list objects from a specific PR scan. Example: \`list_parameters.ci_run_uuid=ee4a914c-8d6d-4b65-8b0e-9755e8a6cb3a\`
    - List_Parameter: \`count\`
    Description: Get the number of items in the list. Example: \`list_parameters.count=true\`
    - List_Parameter: \`filter\`
    Description: Specify the field names and values used to filter results. Example: \`list_parameters.filter=meta.parent_kind==Project\`
    - List_Parameter: \`group.aggregation_paths\`
    Description: Specify one or more fields to group objects by. Example: \`list_parameters.group.aggregation_paths=meta.name\`
    - List_Parameter: \`group.show_aggregation_uuids\`
    Description: Get the UUIDs of the objects in each group as specified by \`group.aggregation_paths\`. Example: \`list_parameters.group.aggregation_paths=meta.name&list_parameters.group.show_aggregation_uuids=true\`
    - List_Parameter: \`group.unique_count_paths\`
    Description: Count the number of unique values, for these fields, in the group. Example: \`list_parameters.group.aggregation_paths=meta.name&list_parameters.group.unique_count_paths=spec.ecosystem\`
    - List_Parameter: \`group.unique_value_paths\`
    Description: Get the unique values, for these fields, in the group. Example: \`list_parameters.group.aggregation_paths=meta.name&list_parameters.group.unique_value_paths=meta.name\`
    - List_Parameter: \`group_by_time.aggregation_paths\`
    Description: Group the list based on this time field. Example: \`list_parameters.group_by_time.aggregation_paths=meta.create_time\`
    - List_Parameter: \`group_by_time.end_time\`
    Description: End of the time period to group objects. Example: \`list_parameters.group_by_time.end_time=2023-12-31T23:59:59Z\`
    - List_Parameter: \`group_by_time.group_size\`
    Description: The time interval size to group the objects by. Example: \`list_parameters.group_by_time.interval=GROUP_BY_TIME_INTERVAL_WEEK&list_parameters.group_by_time.group_size=2\`
    - List_Parameter: \`group_by_time.interval\`
    Description: The time interval to group the objects by. Example: \`list_parameters.group_by_time.interval=GROUP_BY_TIME_INTERVAL_DAY\`
    - List_Parameter: \`group_by_time.show_aggregation_uuids\`
    Description: Get the UUIDs of the objects in each group as specified by \`group_by_time.aggregation_paths\`. Example: \`list_parameters.group_by_time.show_aggregation_uuids=true\`
    - List_Parameter: \`group_by_time.start_time\`
    Description: Beginning of the time period to group objects. Example: \`list_parameters.group_by_time.start_time=2023-01-01T00:00:00Z\`
    - List_Parameter: \`mask\`
    Description: Set the list of fields to return with a request. If no mask is given, all fields are returned by the API. Example: \`list_parameters.mask=uuid,meta.name\`
    - List_Parameter: \`page_id\`
    Description: Set the object UUID to start from. Example: \`list_parameters.page_id=66073889a6cfeb5e24e72abf\`
    - List_Parameter: \`page_size\`
    Description: Set the page size to limit the number of results returned (default \`100\`). Example: \`list_parameters.page_size=10\`
    - List_Parameter: \`page_token\`
    Description: Set the page token to start from (default \`0\`). Example: \`list_parameters.page_token=5\`
    - List_Parameter: \`sort.order\`
    Description: Order of the sort. (default \`SORT_ENTRY_ORDER_ASC\`). Example: \`list_parameters.sort.order=SORT_ENTRY_ORDER_DESC\`
    - List_Parameter: \`sort.path\`
    Description: Field to sort objects by. Example: \`list_parameters.sort.path=meta.name\`
    - List_Parameter: \`traverse\`
    Description: Get data from any child namespaces as well. Example: \`list_parameters.traverse=true\`

    `}
</YamlTable>

### Body parameters

Body parameters allow you to pass additional data to the API. These parameters can be optional or required, depending on the endpoint. The documentation for each Endor Labs REST API endpoint describes the body parameters that it supports. For more information, see the [Endor Labs OpenAPI documentation](/api-reference/).

For example, the [Create Policy](/api-reference/policyservice/createpolicy) endpoint requires that you specify a name, rule, query statement, and resource kinds for the new policy in your request. It also allows you to optionally specify other information, such as a description, actions, or tags to apply to the new policy. For an example of a request that uses body parameters, see [Making a request](#making-a-request).

## Making a request

The following example retrieves all findings for reachable functions. For more examples, see [Use cases](/developers-api/rest-api/using-the-rest-api/use-cases).

<Tabs>
  <Tab title="endorctl">
    1. **Setup**

    Install the Endor Labs CLI on macOS, Windows, or Linux. For more information, see [Install Endor Labs on your local system](/introduction/getting-started#install-endorctl).

    2. **Authenticate**

    Run `endorctl init` and your browser window will open automatically. Select your authentication provider from the available options and complete the authentication process.

    You can also specify your supported authentication provider manually.

    `endorctl init --auth-mode google`

    3. **Make a request**

    `endorctl api list --resource Finding --filter "spec.finding_tags contains FINDING_TAGS_REACHABLE_FUNCTION"`

    Note that you do not have to provide the access token or the namespace when using `endorctl` to access the Endor Labs REST API.
  </Tab>

  <Tab title="curl">
    1. **Setup**

    2. You must have curl installed on your machine. To check if curl is already installed, run `curl --version`-  on the command line.
       * If the output provides information about the version of curl, that means curl is installed.
       * If you get a message similar to command not found: curl, that means curl is not installed. Download and install curl. For more information, see the [curl download page](https://curl.se/download.html).

    3. Install the Endor Labs CLI on macOS, Windows, or Linux. For more information, see [Install Endor Labs on your local system](/introduction/getting-started#install-endorctl).

    4. **Authenticate**

    5. Run `endorctl init` and your browser window will open automatically. Select your authentication provider from the available options and complete the authentication process.

       You can also specify your supported authentication provider manually.

       `endorctl init --auth-mode google`

    6. Store the Endor Labs access token

       Run the following command from your terminal to get the Endor Labs access token.

       `endorctl auth --print-access-token`

    7. **Choose an endpoint for your request**

    Choose an endpoint to make a request to. You can explore the Endor Labs REST API documentation to discover endpoints that you can use to interact with Endor Labs.

    Identify the HTTP method and path of the endpoint. You will send these with your request. For more information, see [HTTP method](#http-method) and [Path](#path).

    For example, the [List Findings](/api-reference/findingservice/listfindings) endpoint uses the HTTP method POST and the path `/v1/namespaces/{tenant_meta.namespace}/findings`.

    Identify any required path parameters. Required path parameters appear in curly brackets {} in the path of the endpoint. Replace each parameter placeholder with the desired value. For more information, see [Path](#path).

    For example, the [List Findings](/api-reference/findingservice/listfindings) endpoint uses the path `/v1/namespaces/{tenant_meta.namespace}/findings`, and the path parameter is `{tenant_meta.namespace}`. To use this path in your API request, replace `{tenant_meta.namespace}` with the name of the namespace where you want to list the findings.

    4. **Choose options for your request**

    Use the curl command to make your request. For more information, see the [curl documentation](https://curl.se/docs/manpage.html).

    Specify the following options and values in your request:

    * `--request` or `-X` followed by the HTTP method as the value. For more information, see [HTTP method](#http-method).

      > Note: You can also use the shorthand curl options `--get` and `--post` for GET and POST requests respectively.

    * `--header` or `-H`:
      * `Authorization`: Pass your authentication token in an Authorization header. You must use `Authorization: Bearer` with the Endor Labs REST API. For more information, see [Authentication](#authentication).
      * `Accept-Encoding`: Provide the `Accept-Encoding` header in the following format: `Accept-Encoding: gzip` to avoid performance bottlenecks. For more information, see [Accept-Encoding](#accept-encoding).
      * `Content-Type`: Set the header as `Content-Type: application/jsoncompact` to prevent Endor Labs APIs from returning null or empty value. For more information, see [Content-Type](#content-type).
      * `Request-timeout`: Specify the amount of time, in seconds, that you are willing to wait for a server response. For more information, see [Request-timeout](#request-timeout).

    * `--url` followed by the full path as the value. The full path is a URL that includes the base URL for the Endor Labs REST API (`https://api.endorlabs.com`) and the path of the endpoint, like this: `https://api.endorlabs.com/{PATH}`. Replace `{PATH}` with the path of the endpoint. For more information, see [Path](#path).

      To use list parameters, add a `?` to the end of the path, then append your list parameter name and value in the form `list_parameter.parameter_name=value`. Separate multiple list parameters with `&`. For example, to count the number of "Outdated Release" findings, use `?list_parameters.filter=meta.name==outdated_release&list_parameters.count=true`. For more information, see [List parameters](#list-parameters).

      > Note: Filters with spaces must be encoded when using curl. Replace spaces with `%20` or use the `--data-urlencode` option for filters containing spaces.

    * `--data` or `-d` followed by any body parameters within a json object. If you do not need to specify any body parameters in your request, omit this option. For more information, see [Body parameters](#body-parameters).

    5. **Make request**

    6. Using `--url`

       ```bash theme={null}
       curl --request GET \
         --header "Authorization: Bearer $ENDOR_TOKEN" \
         --compressed \
         --header "Content-Type: application/jsoncompact" \
         --url "https://api.endorlabs.com/v1/namespaces/$ENDOR_NAMESPACE/findings?list_parameters.filter=spec.finding_tags%20contains%20FINDING_TAGS_REACHABLE_FUNCTION"
       ```

    7. Using `--data-urlencode`

       ```bash theme={null}
       curl --request GET \
         --header "Authorization: Bearer $ENDOR_TOKEN" \
         --compressed \
         --header "Content-Type: application/jsoncompact" \
         --data-urlencode "spec.finding_tags contains FINDING_TAGS_REACHABLE_FUNCTION" \
         "https://api.endorlabs.com/v1/namespaces/$ENDOR_NAMESPACE/findings"
       ```
  </Tab>

  <Tab title="HTTP">
    1. **Setup**

    Install the Endor Labs CLI on macOS, Windows, or Linux. For more information, see [Install Endor Labs on your local system](/introduction/getting-started#install-endorctl).

    2. **Authenticate**

    3. Run `endorctl init` and your browser window will open automatically. Select your authentication provider from the available options and complete the authentication process.

       You can also specify your supported authentication provider manually.

       `endorctl init --auth-mode google`

    4. Store the Endor Labs access token

       Run the following command from your terminal to get the Endor Labs access token.

       `endorctl auth --print-access-token`

    5. **Choose an endpoint for your request**

    Choose an endpoint to make a request to. You can explore the Endor Labs REST API documentation to discover endpoints that you can use to interact with Endor Labs.

    Identify the HTTP method and path of the endpoint. You will send these with your request. For more information, see [HTTP method](#http-method) and [Path](#path).

    For example, the [List Findings](/api-reference/findingservice/listfindings) endpoint uses the HTTP method POST and the path `/v1/namespaces/{tenant_meta.namespace}/findings`.

    Identify any required path parameters. Required path parameters appear in curly brackets {} in the path of the endpoint. Replace each parameter placeholder with the desired value. For more information, see [Path](#path).

    For example, the [List Findings](/api-reference/findingservice/listfindings) endpoint uses the path `/v1/namespaces/{tenant_meta.namespace}/findings`, and the path parameter is `{tenant_meta.namespace}`. To use this path in your API request, replace `{tenant_meta.namespace}` with the name of the namespace where you want to list the findings.

    4. **Make a request**

    ```bash theme={null}
    @baseUrl = https://api.endorlabs.com
    @token = <insert-access-token>
    @namespace = <insert-namespace>

    ###
    GET {{baseUrl}}/v1/namespaces/{{namespace}}/findings?spec.finding_tags contains FINDING_TAGS_REACHABLE_FUNCTION HTTP/1.1
    Authorization: Bearer {{token}}
    ```
  </Tab>
</Tabs>