> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Run a Drift Scan and Retrieve Findings

> Trigger a drift detection scan via the InfraAudit API, poll for job completion, and list findings filtered by severity using curl.

This example triggers a drift detection scan, polls until the scan job completes, and retrieves findings. Drift detection compares your current infrastructure configuration against the captured baseline and surfaces any changes.

## Prerequisites

* A connected provider with at least one completed sync (see [Connect an AWS account](/api/examples/connect-aws))

```bash theme={null}
export TOKEN="eyJhbGciOi..."
export BASE_URL="https://api.infraaudit.dev"
```

## Step 1: Trigger the scan

```bash theme={null}
JOB=$(curl -s -X POST "$BASE_URL/api/v1/drifts/detect" \
  -H "Authorization: Bearer $TOKEN" | jq .)

echo $JOB
# { "job_id": 42, "status": "running", "message": "Drift detection scan started" }

JOB_ID=$(echo $JOB | jq -r '.job_id')
```

## Step 2: Poll for completion

```bash theme={null}
while true; do
  EXEC=$(curl -s "$BASE_URL/api/v1/jobs/1/executions/$JOB_ID" \
    -H "Authorization: Bearer $TOKEN")
  STATUS=$(echo $EXEC | jq -r '.status')
  echo "Job status: $STATUS"
  if [ "$STATUS" = "succeeded" ] || [ "$STATUS" = "failed" ]; then break; fi
  sleep 3
done
```

## Step 3: Get the findings summary

```bash theme={null}
curl -s "$BASE_URL/api/v1/drifts/summary" \
  -H "Authorization: Bearer $TOKEN" | jq .
```

Output:

```json theme={null}
{
  "total": 5,
  "by_severity": {
    "critical": 1,
    "high": 2,
    "medium": 1,
    "low": 1
  }
}
```

## Step 4: List critical findings

```bash theme={null}
curl -s "$BASE_URL/api/v1/drifts?severity=critical" \
  -H "Authorization: Bearer $TOKEN" | jq '.data[] | {id, summary, resource_name}'
```

Output:

```json theme={null}
{
  "id": 1,
  "summary": "BlockPublicAcls changed from true to false",
  "resource_name": "data-lake-bucket"
}
```

## Step 5: Get finding detail

```bash theme={null}
curl -s "$BASE_URL/api/v1/drifts/1" \
  -H "Authorization: Bearer $TOKEN" | jq '{summary, baseline_value, current_value}'
```

## Step 6: Resolve a finding

After fixing the issue in your cloud account, sync the provider and resolve the drift:

```bash theme={null}
# Re-sync the provider to pull current state
curl -s -X POST "$BASE_URL/api/v1/providers/1/sync" \
  -H "Authorization: Bearer $TOKEN"

# Resolve the drift finding
curl -s -X POST "$BASE_URL/api/v1/drifts/1/resolve" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"capture_baseline": true}'
```