REST pagination does not work for findings/vulnerabilities endpoint

[empwilli]

Current Behavior

In contrast to other REST API endpoints (/v1/project, /v1/vulnerability/project/<uuid>, ...) the results of requests to the /v1/finding/project/<uuid> endpoint are supplied without pagination. For all other endpoints the combination of page and limit query provides paginated results.

Edit: the /v1/vulnerability endpoint is similarly affected.

Steps to Reproduce

curl -X 'GET' \
  'https://dtrack.tld/api/v1/finding/project/<uuid>&page=2&limit=10' \
  -H 'accept: application/json' \
  -H 'X-Api-Key: '

Edit: fixed curl command

Expected Behavior

This endpoint should also provide pagination.

Dependency-Track Version

4.7.1

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[stevespringett]

Not all endpoints are paginated. This is one of them. Adding pagination support can likely not be handled at the database layer due to the complexity of the statement. Realistically, pagination would involve fetching all records and discarding the ones not in the current page.

[empwilli]

Ok, this is understandable. Still, is there the possibility to get this behavior documented sw.? Am I guaranteed to get all results on the unpaginated endpoints? At the moment the situation is unsatisfactory. Performing non-paginated requests on paginated endpoints will not give all results (except one adds the logic to check for the x-total-count result and retries).

[robertlagrant]

I was wondering this based on 209 - it's great that this feature exists, but I think it's impossible to discover based on the docs. The OpenAPI spec doesn't seem to mention page or limit.

[empwilli]

I was wondering this based on 209 - it's great that this feature exists, but I think it's impossible to discover based on the docs. The OpenAPI spec doesn't seem to mention page or limit.

I believe I stumbled upon this response when I first did not retrieve enough results and then searched around for pagination parameters in Dependency Track.

[nscuro]

Related:

• /api/v1/vulnerability/project/<UUID> endpoint does not support pagination #2914
• Support Pagination for v1/finding/project/{uuid} #4677