Contract
- shape
- collection
- authority
- read
- evidence
- none
- subscription
- false
- permission
- any one of: staff.read (the staff role staff_read held in the Internal org, tradehq_role.staff_role); org.admin (carried by the caller's role template in the org `org_id`); account.owner (account role owner or higher in the account of the org `org_id`); a deactivated caller is refused first
- idempotency
- safe
- emits
- none
- MCP tool
- list_identity_findings
- REST
- POST https://api.containertradehq.com/v1/cap/list_identity_findings
Idempotency: a read: calling again changes nothing
Inputs
| name | type | required | validation |
|---|---|---|---|
| org_id | org_id | required | tradehq-org-id; 1 to 20 characters The org whose findings to list. |
| state | one_of | optional | one of open, resolved, all; default "open" open (the default), resolved, or all. |
Paginated: next next_after · page_max 500 · walk_max 500 · ceiling declared
Response
items· object[]next_after· stringnull · Pass as `after` for the next page; null on the last one.
Full JSON Schema
{
"type": "object",
"properties": {
"items": {
"type": "array",
"items": {
"type": "object",
"properties": {
"finding_id": {
"type": "string",
"pattern": "^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$",
"format": "uuid",
"description": "The finding.",
"x-data-class": "operational"
},
"org_id": {
"type": "string",
"minLength": 1,
"maxLength": 20,
"pattern": "^[A-Za-z0-9_-]{1,20}$",
"format": "tradehq-org-id",
"description": "The org.",
"x-data-class": "operational"
},
"kind": {
"type": "string",
"enum": [
"membership_unexpected",
"role_mismatch",
"membership_missing"
],
"description": "membership_unexpected: Clerk holds a membership Trade HQ did not decide. role_mismatch: Clerk's role is not the member's role template's. membership_missing: an active member Clerk holds no membership for.",
"x-data-class": "operational"
},
"source": {
"type": "string",
"enum": [
"webhook",
"reconcile"
],
"description": "What saw it: Clerk's event, or the reconcile.",
"x-data-class": "operational"
},
"user_id": {
"type": [
"string",
"null"
],
"minLength": 1,
"maxLength": 20,
"pattern": "^[A-Za-z0-9_-]{1,20}$",
"format": "tradehq-user-id",
"description": "The Trade HQ user, when the Clerk user is one.",
"x-data-class": "operational"
},
"name": {
"type": [
"string",
"null"
],
"description": "The Trade HQ user's profile name, when they have one.",
"x-data-class": "operational"
},
"clerk_user_id": {
"type": [
"string",
"null"
],
"description": "The Clerk user.",
"x-data-class": "operational"
},
"email_domain": {
"type": [
"string",
"null"
],
"description": "The domain of the Clerk member's address; never the address.",
"x-data-class": "operational"
},
"observed_role": {
"type": [
"string",
"null"
],
"description": "The Clerk role Clerk holds.",
"x-data-class": "operational"
},
"expected_role": {
"type": [
"string",
"null"
],
"description": "The Clerk role the member's role template carries.",
"x-data-class": "operational"
},
"role_template_id": {
"type": [
"string",
"null"
],
"description": "The member's role template when the finding was raised.",
"x-data-class": "operational"
},
"action_taken": {
"type": "string",
"enum": [
"quarantined",
"restored",
"alerted",
"fused",
"none"
],
"description": "quarantined: refused here and queued for removal from Clerk; restored: the template's role queued back to Clerk; alerted: the org's drift setting is alert only; fused: the run found more than it may act on at once; none: nothing to do but decide.",
"x-data-class": "operational"
},
"command_outcome": {
"type": [
"string",
"null"
],
"description": "What Clerk answered the finding's last command (applied, no_clerk_membership, withdrawn); null while it waits or when there is none.",
"x-data-class": "operational"
},
"raised_at": {
"type": "string",
"format": "date-time",
"description": "When.",
"x-data-class": "operational"
},
"decisions": {
"type": "array",
"items": {
"type": "string"
},
"description": "What resolve_identity_finding offers on it while it is open: remove, admit, ignore. Empty once resolved. Staff may only remove.",
"x-data-class": "operational"
},
"resolution": {
"type": [
"string",
"null"
],
"enum": [
"removed",
"admitted",
"ignored",
null
],
"description": "How it was resolved; null while open.",
"x-data-class": "operational"
},
"admitted_role_template_id": {
"type": [
"string",
"null"
],
"description": "The role template an Admit gave.",
"x-data-class": "operational"
},
"resolved_by": {
"type": [
"string",
"null"
],
"minLength": 1,
"maxLength": 20,
"pattern": "^[A-Za-z0-9_-]{1,20}$",
"format": "tradehq-user-id",
"description": "Who resolved it.",
"x-data-class": "operational"
},
"resolved_at": {
"type": [
"string",
"null"
],
"format": "date-time",
"description": "When it was resolved.",
"x-data-class": "operational"
}
},
"required": [
"finding_id",
"org_id",
"kind",
"source",
"user_id",
"name",
"clerk_user_id",
"email_domain",
"observed_role",
"expected_role",
"role_template_id",
"action_taken",
"command_outcome",
"raised_at",
"decisions",
"resolution",
"admitted_role_template_id",
"resolved_by",
"resolved_at"
],
"additionalProperties": false
},
"maxItems": 500
},
"next_after": {
"type": [
"string",
"null"
],
"description": "Pass as `after` for the next page; null on the last one."
}
},
"required": [
"items",
"next_after"
],
"additionalProperties": false
} Refusals
The platform refusals apply to every call: version, authentication, authority, validation and rate limits, each in the same envelope.
Surfaces
DesktopF
MobileF
APIF
MCPF
VoiceD4
PushN
OneBoxN
OutboundN
- Voice: degraded: visualization
- Push: emits nothing
- OneBox: no document originates a drift finding
- Outbound: crosses to no counterparty
Events
None emitted.
Related
None.