> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Stream the dependency's resolved source for a crypto finding

> Reads the file containing a `source: dependency` crypto occurrence's call site from the resolved-source cache crypto-finder populated during the scan, and streams its bytes.

The request carries ONLY the finding id. The module, version and path are read server-side from the finding's own stored evidence, so there is no client-supplied path to traverse with. Content-Type is `text/plain; charset=utf-8`.

Coverage follows crypto-finder's own resolvers: today only Maven and Gradle populate that cache, so a finding from any other ecosystem answers `404 source_not_available`. Only the documented 404 codes `source_not_available` and `not_found` mean absence and allow fallback to the matched line. Successful immutable source bytes may be cached indefinitely.



## OpenAPI

````yaml /api-reference/earnie/triage-openapi.json get /v1/findings/{findingId}/crypto-source
openapi: 3.0.3
info:
  title: Earnie Findings API
  description: List and read findings, triage them, and review resolutions.
  version: 1.0.0
servers:
  - url: https://{tenant}.earnie.dev
    description: Your Earnie deployment
    variables:
      tenant:
        default: your-company
        description: >-
          Your organization's Earnie address, as shown in your browser when you
          sign in.
security:
  - bearerAuth: []
paths:
  /v1/findings/{findingId}/crypto-source:
    get:
      tags:
        - findings
      summary: Stream the dependency's resolved source for a crypto finding
      description: >-
        Reads the file containing a `source: dependency` crypto occurrence's
        call site from the resolved-source cache crypto-finder populated during
        the scan, and streams its bytes.


        The request carries ONLY the finding id. The module, version and path
        are read server-side from the finding's own stored evidence, so there is
        no client-supplied path to traverse with. Content-Type is `text/plain;
        charset=utf-8`.


        Coverage follows crypto-finder's own resolvers: today only Maven and
        Gradle populate that cache, so a finding from any other ecosystem
        answers `404 source_not_available`. Only the documented 404 codes
        `source_not_available` and `not_found` mean absence and allow fallback
        to the matched line. Successful immutable source bytes may be cached
        indefinitely.
      operationId: GetV1FindingCryptoSource
      parameters:
        - name: findingId
          in: path
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: The resolved source file's bytes.
          content:
            text/plain:
              schema:
                type: string
        '401':
          description: Not authenticated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Insufficient permissions (findings:read required)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: >-
            Either the finding does not exist or belongs to another organization
            (`not_found`), or no resolved source is available for it
            (`source_not_available`) — it is not a dependency-sourced crypto
            finding, its evidence carries no module, the deployment has no
            resolved-source cache configured, or the file is not in the cache.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Error:
      type: object
      required:
        - code
        - message
      properties:
        code:
          type: string
        message:
          type: string
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        An Earnie API key, sent as `Authorization: Bearer sk_earnie_...`. Create
        one under Settings > API keys. The key's scopes decide which operations
        it may call.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.