Fetch the ordered taint trace for one code finding

GET 
/api/v1/assessments/:assessment_id/codeling/sast-findings/trace

Fetch one ordered source-free taint-trace page for a single finding.

Steps come from the persisted per-match dataflow trace in semantic execution order. Only taint-mode findings own a trace; an unknown match key or a search-mode finding is an invalid query (400), matching the engine's fail-closed contract. trace_available on the finding page tells the caller whether this route will succeed.

Request

Responses

200

Successful Response

400

Invalid cursor or query.

401

Missing, expired, or invalid credentials.

403

Authenticated but not authorized for this resource. Note: cross-organization reads return 404, not 403.

404

Snapshot unavailable.

409

Bounded aggregation incomplete.

422

Semantic validation failure — request shape was valid but contents were not.

429

Too many requests — rate limited. Retry after the window resets.

500

Internal server error — unexpected failure.

502

Snapshot validation failed.

503

Query resource limit exceeded.