> ## Documentation Index > Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt > Use this file to discover all available pages before exploring further. # Get the AI finding an AI tools ticket was opened for > Start here when working an AI tools ticket: it answers what the ticket is about. Return as JSON the device and its owner, the rule (code, title, description, severity), the one finding the ticket tracks as the device still reports it, with what it is on, its `evidence` (what fleetd saw behind it: `runtimeFlags` null when the agent's command line was not seen, `fromWebstore: true` a store extension a policy or another program installed), its path (the home folder written `~`) and the tool's policy, and the ticket itself: who opened it (`policy`, `admin`, `agent`) and, once Primo closed it, when and why. Its comments and status are `getTicket`. A 404 is final: the ticket is not an AI tools ticket, or the device no longer reports its finding (Primo then closes the ticket on the next sync); a retry returns the same 404. For the whole inventory of the device, `getAiToolsDevice`. AI tools are what Primo finds on Macs (assistant apps, coding agents, IDE plugins, browser extensions, MCP servers, AI connections, agent instruction files), as of the last sync (`lastSyncedAt` of `getAiToolsOverview`), with Primo's severities, less the findings the company's AI tools settings ignore. They are not the software catalog (`getSoftwares`, `getDeviceSoftware`), the company's own AI agents (`listAgents`) nor AI credits (`getAiUsage`). A company without AI tools monitoring gets a 403, final. Key: ReadScope: Company ## OpenAPI ````yaml https://api.getprimo.com/openapi.json get /ai-tools/tickets/{ticketId}/details openapi: 3.1.1 info: title: Public API - BETA description: Read docs on https://docs.getprimo.com/ version: '1.0' contact: {} servers: - url: https://api.getprimo.com security: - apikey: [] tags: [] paths: /ai-tools/tickets/{ticketId}/details: get: tags: - AiTools summary: Get the AI finding an AI tools ticket was opened for description: >- Start here when working an AI tools ticket: it answers what the ticket is about. Return as JSON the device and its owner, the rule (code, title, description, severity), the one finding the ticket tracks as the device still reports it, with what it is on, its `evidence` (what fleetd saw behind it: `runtimeFlags` null when the agent's command line was not seen, `fromWebstore: true` a store extension a policy or another program installed), its path (the home folder written `~`) and the tool's policy, and the ticket itself: who opened it (`policy`, `admin`, `agent`) and, once Primo closed it, when and why. Its comments and status are `getTicket`. A 404 is final: the ticket is not an AI tools ticket, or the device no longer reports its finding (Primo then closes the ticket on the next sync); a retry returns the same 404. For the whole inventory of the device, `getAiToolsDevice`. AI tools are what Primo finds on Macs (assistant apps, coding agents, IDE plugins, browser extensions, MCP servers, AI connections, agent instruction files), as of the last sync (`lastSyncedAt` of `getAiToolsOverview`), with Primo's severities, less the findings the company's AI tools settings ignore. They are not the software catalog (`getSoftwares`, `getDeviceSoftware`), the company's own AI agents (`listAgents`) nor AI credits (`getAiUsage`). A company without AI tools monitoring gets a 403, final. operationId: getAiToolsTicketDetails parameters: - name: ticketId required: true in: path schema: type: string responses: default: description: '' content: application/json: schema: $ref: '#/components/schemas/GetAiToolsTicketDetailsResponse_Output' components: schemas: GetAiToolsTicketDetailsResponse_Output: type: object properties: rule: description: Primo's code of the risk, e.g. `plaintext_secret` type: string severity: description: Primo's severity of the rule type: string enum: - critical - high - medium - low severityLabel: description: The severity in words, e.g. `Critical` type: string title: description: >- What the rule means in a few words; the code itself for a rule Primo has not rated yet type: string description: description: One line on what the rule detects anyOf: - type: string - type: 'null' ticket: type: object properties: ticketId: description: Ticket id, to pass to `getTicket` or `getAiToolsTicketDetails` type: string ticketReference: type: string deviceId: type: string rule: type: string description: The rule's code findingKey: type: string description: 'The finding the ticket tracks: each finding has its own ticket' openedBy: type: string description: >- `policy`: opened by Create tickets automatically, closed by Primo when the finding is gone or the settings no longer cover it; `admin` (a person), `agent` (Primo AI) or `api` (an API key): opened by hand, closed by Primo once the finding is gone enum: - policy - admin - agent - api openedAt: type: string description: ISO 8601 closedAt: description: When Primo closed it (ISO 8601); null while it is open anyOf: - type: string - type: 'null' closeReason: description: >- Why Primo closed it: `finding_resolved`, `device_gone`, `auto_tickets_off`, `device_excluded`, `rule_ignored`, `severity_ignored`, `ticket_completed` or `ticket_cancelled` when someone finished the ticket, or `ticket_deleted` when the ticket was deleted anyOf: - type: string - type: 'null' required: - ticketId - ticketReference - deviceId - rule - findingKey - openedBy - openedAt - closedAt - closeReason additionalProperties: false device: type: object properties: deviceId: description: Primo device id, to pass to `getAiToolsDevice` or `getDevice` type: string deviceName: anyOf: - type: string - type: 'null' serialNumber: anyOf: - type: string - type: 'null' platform: anyOf: - type: string enum: - ANDROID - IOS - IPADOS - MACOS - WINDOWS - LINUX - CHROME_OS - UNKNOWN - type: 'null' ownerId: description: Employee id of the device owner anyOf: - type: string - type: 'null' ownerName: anyOf: - type: string - type: 'null' required: - deviceId - deviceName - serialNumber - platform - ownerId - ownerName additionalProperties: false finding: type: object description: >- The finding the ticket tracks, as the device still reports it, with its path (the home folder written `~`) properties: rule: description: Primo's code of the risk, e.g. `plaintext_secret` type: string severity: description: Primo's severity of the rule type: string enum: - critical - high - medium - low severityLabel: description: The severity in words, e.g. `Critical` type: string title: description: >- What the rule means in a few words; the code itself for a rule Primo has not rated yet type: string description: description: One line on what the rule detects anyOf: - type: string - type: 'null' findingKey: description: Stable identifier of the finding type: string reportedAt: description: When the device reported the item to Primo (ISO 8601) type: string subjectType: type: string enum: - tool - instruction_file subjectName: description: Name of the tool, or file name of the instruction file type: string toolKey: description: The tool the finding is on; null for an instruction file anyOf: - type: string - type: 'null' toolKind: anyOf: - description: >- assistant_app (Claude, ChatGPT desktop), coding_agent (Claude Code, Codex), ide_plugin, browser_extension or mcp_server type: string enum: - assistant_app - coding_agent - ide_plugin - browser_extension - mcp_server - type: 'null' evidence: description: >- What fleetd saw behind the finding, in fleetd's own words: the fields its rule reads, null for a rule that reads none anyOf: - type: object properties: secretEnvKeys: description: >- `plaintext_secret`: the environment or header names holding a secret word; fleetd reads no value type: array items: type: string runtimeFlags: description: >- `skip_permissions_runtime`: the auto-approve flags on the agent's command line; null when it was not seen anyOf: - type: array items: type: string - type: 'null' permissionMode: description: >- `bypass_permissions`, `auto_accept_edits`: Claude Code's `permissions.defaultMode` anyOf: - type: string - type: 'null' markers: description: >- `injection_markers`: the phrases fleetd matched in the file type: array items: type: string capabilities: description: >- `mcp_shell_exec`, `mcp_fs_write`: what the known MCP server can do, e.g. `shell-exec`, `fs-write` type: array items: type: string fromWebstore: description: >- `sideloaded_unverified`: whether the browser says the extension came from its store; `true` is a store extension a policy or another program installed anyOf: - type: boolean - type: 'null' signedState: description: >- `sideloaded_unverified`: a Firefox add-on's signature (`signed`, `missing`, `broken`…) anyOf: - type: string - type: 'null' additionalProperties: false - type: 'null' path: description: Path of the configuration or file, the home folder written `~` anyOf: - type: string - type: 'null' policy: description: The company's policy for the tool; null for an instruction file anyOf: - type: object properties: status: description: >- The company's decision on the tool: not_reviewed, approved or blocked type: string enum: - not_reviewed - approved - blocked source: description: >- default: the policy the settings gave the tool when a device first reported it; admin: a decision type: string enum: - default - admin decidedAt: description: >- When the policy was set (ISO 8601); null before the first sync stamps it anyOf: - type: string - type: 'null' required: - status - source - decidedAt additionalProperties: false - type: 'null' required: - rule - severity - severityLabel - title - description - findingKey - reportedAt - subjectType - subjectName - toolKey - toolKind - evidence - path - policy additionalProperties: false required: - rule - severity - severityLabel - title - description - ticket - device - finding additionalProperties: false securitySchemes: apikey: scheme: bearer bearerFormat: API key type: http description: >- Use your Primo API key in the Authorization header as `Bearer `. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.