# Method: projects.findings.search

- [HTTP request](https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings/search#body.HTTP_TEMPLATE)
- [Path parameters](https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings/search#body.PATH_PARAMETERS)
- [Query parameters](https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings/search#body.QUERY_PARAMETERS)
- [Request body](https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings/search#body.request_body)
- [Response body](https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings/search#body.response_body)
  - [JSON representation](https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings/search#body.SearchFindingsResponse.SCHEMA_REPRESENTATION)
- [Authorization scopes](https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings/search#body.aspect)
- [IAM Permissions](https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings/search#body.aspect_1)

findings.search is a more powerful version of findings.list that supports complex queries like "findings for alerts" using functions such as `has_alert` in the query string. The `parent` field in SearchFindingsRequest should have the format: projects/{project} Example to search for findings for a specific issue: `has_alert("name=\"projects/gti-12345/alerts/alert-12345\"")`

### HTTP request

`GET https://threatintelligence.googleapis.com/v1beta/{parent=projects/*}/findings:search`

The URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.

### Path parameters

| Parameters ||
|---|---|
| `parent` | `string` Required. Parent of the findings. Format: vaults/{vault} |

### Query parameters

| Parameters ||
|---|---|
| `query` | `string` Optional. Query on what findings will be returned. This supports the same filter criteria as FindingService.ListFindings as well as the following relationship query `has_alert`. Example: - `has_alert("name=\"projects/gti-12345/alerts/alert-12345\"")` |
| `orderBy` | `string` Optional. Order by criteria in the csv format: "field1,field2 desc" or "field1,field2" or "field1 asc, field2". |
| `pageToken` | `string` Optional. Page token. |
| `pageSize` | `integer` Optional. Page size. |

### Request body

The request body must be empty.

### Response body

Response message for findings.search.

If successful, the response body contains data with the following structure:

| JSON representation |
|---|
| ``` { "findings": [ { object (`https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings#Finding`) } ], "nextPageToken": string } ``` |

| Fields ||
|---|---|
| `findings[]` | ``object (`https://docs.cloud.google.com/threat-intelligence/reference/rest/v1beta/projects.findings#Finding`)`` List of findings. |
| `nextPageToken` | `string` Page token. |

### Authorization scopes

Requires the following OAuth scope:

- `https://www.googleapis.com/auth/cloud-platform`

For more information, see the [Authentication Overview](https://docs.cloud.google.com/docs/authentication#authorization-gcp).

### IAM Permissions

Requires the following [IAM](https://cloud.google.com/iam/docs) permission on the `parent` resource:

- `threatintelligence.findings.list`

For more information, see the [IAM documentation](https://cloud.google.com/iam/docs).