list-composer-recipe-results

dci list-composer-recipe-results <recipeId> [flags]

Returns the results of one Composer recipe: one finding per affected resource, with the resource's account, region, tags and cost metrics. An unknown recipe, one your customer isn't entitled to, and a dismissed recipe all return 200 with an empty items list and rowCount: 0.

By default (last_scan_only:true) only results reported by the most recent scan of each recently scanned account are returned. A resolved result keeps the ID of the last scan that reported it, so resolved results rarely appear by default; add last_scan_only:false to include them and results from earlier scans. rowCount can therefore be lower than the recipe's totalResultsCount. Results are sorted by detection_time, descending, by default. Ties break by id.

filter is one string of key:value clauses: , separates alternative values for one key (OR) and | separates keys (AND), for example region:us-east-1,us-west-2|status:active. Because , and | are separators, a value itself can't contain them. Supported keys:

account_id: one or more cloud account IDs, matched exactly.
region: one or more cloud regions, matched exactly.
issued_resource_name: one or more names of the affected resource, matched exactly.
related_resource_name: one or more names of related resources (for example an attached IAM policy), each matched as a substring anywhere in the result's related-resource details.
status: exactly one of active (not resolved and not snoozed), snoozed, resolved or all. Omitting it is the same as all. Combine resolved with last_scan_only:false; with the default it usually returns nothing.
last_scan_only: exactly one of true or false. Defaults to true, which returns only results reported by each recently scanned account's most recent scan, and so rarely includes resolved results. false returns results from every scan and account, including resolved ones.
allocation: up to 10 distinct allocation IDs from GET /analytics/v1/allocations. Returns only results on resources in any of those allocations. An allocation you can't view returns 404; if access can't be checked, the request returns 503 rather than unfiltered data.

Requests are always served for the customer your API token belongs to.

recipeId — ID of the Composer recipe whose results to list. Get recipe IDs from GET /insights/v2/recipes.

Flags

Flag	Type	Default	Example	Description
`--max-results`	integer	`50`	`50`	Maximum number of items to return on one page, from 1 to 500. Defaults to 50. A value outside that range returns `400 validation_failed`.
`--page-token`	string			Continuation token from the `pageToken` of the previous response. Omit it on the first request; a response without `pageToken` is the last page. The token records the position, the sort and the `allocation` filter IDs. Changing `sortBy`, `sortOrder` or the allocation IDs while paginating returns `400 pagination_token_invalid`. Keep the other `filter` keys and `maxResults` unchanged while paginating. Tokens expire 5 minutes after they are issued; an expired token returns `400 pagination_token_expired`. In both cases, restart from the first page.
`--sort-by`	string	`"detection_time"`		Field to sort results by. Defaults to `detection_time`. Ties break by `id` (ascending), whatever the `sortOrder`. One of: `"detection_time"`, `"resolved_time"`, `"account_id"`, `"region"`, `"resource_class"`, `"cost_estimation_potential_savings"`, `"cost_estimation_potential_increased_costs"`, `"cost_estimation_potential_freed_commitments"`, `"cost_estimation_potential_increased_commitments_required"`.
`--sort-order`	string	`"desc"`		Sort direction for `sortBy`. Defaults to `desc`. One of: `"asc"`, `"desc"`.
`--filter`	string		`status:active\|region:us-east-1,us-west-2`	Restricts the results returned. One string of `key:value` clauses: `,` separates alternative values for one key (OR) and `\|` separates keys (AND). For example, `region:us-east-1,us-west-2\|status:active` returns active results in either region. Because `,` and `\|` are separators, a value itself can't contain them. Matching is exact unless a key says otherwise. Omit `filter` to list the recipe's results from the most recent scan of each recently scanned account, in every status. Keys: - `account_id`: one or more cloud account IDs, matched exactly. - `region`: one or more cloud regions, matched exactly. - `issued_resource_name`: one or more names of the affected resource, matched exactly. - `related_resource_name`: one or more names of resources related to the result (for example, an attached IAM policy). Each value is matched as a substring anywhere in the result's related-resource details, not only against names. - `status`: exactly one of `active` (not resolved and not snoozed), `snoozed`, `resolved` or `all`. Omitting it is the same as `all`. Combine `resolved` with `last_scan_only:false`; with the default it usually returns nothing. - `last_scan_only`: exactly one of `true` or `false`. Defaults to `true`, which returns only results reported by each recently scanned account's most recent scan. A resolved result keeps the ID of the last scan that reported it, so resolved results rarely appear by default. `false` returns results from every scan and account, including resolved ones. - `allocation`: up to 10 distinct allocation IDs (duplicates are ignored); get allocation IDs from `GET /analytics/v1/allocations`. Matches results on resources in any of those allocations, as resolved by Cloud Analytics; `rowCount` then counts only those results. You must be able to view every listed allocation. Service-account API keys can use public allocations only. If allocation access can't be checked, the request returns `503` with `Retry-After` and never falls back to unfiltered data. Errors: - An unknown key returns `400 filter_key_not_supported` when it's the only problem, otherwise `400 validation_failed`. - A `status` outside the allowed list, a non-boolean `last_scan_only`, more than one `status` or `last_scan_only` value, more than 10 distinct allocation IDs, an invalid allocation ID (blank, longer than 256 characters, or containing `/`, whitespace or control characters), a malformed expression or an unsupported operator returns `400 validation_failed`. - An allocation that doesn't exist or that you can't view returns `404 composer-api.allocation_not_found`.

Every command also accepts the CLI-wide flags for output shaping — see Output formats and Table output options.

Output

OK - A page of the recipe's results matching the request.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

Field	Type	Description
`items`	array of object	Results on this page.
`items[].id`	integer (int64)	Result ID.
`items[].ruleId`	integer (int64)	ID of the recipe the result belongs to. Equal to the `recipeId` path parameter.
`items[].issuedResourceId`	string	Identifier of the affected resource, as stored by Composer.
`items[].providerIdentifier`	string	Canonical cloud-provider identifier of the affected resource. - AWS: the resource's ARN when one is available, otherwise the stored identifier (for example, an EC2 instance ID). - Google Cloud: the API relative resource name (for example, `projects/my-project/zones/us-central1-a/instances/vm-1`), or the bucket name for Cloud Storage; otherwise the stored identifier. - Other providers: the provider-native identifier. `null` when no identifier is stored or it could not be resolved; resolving it never fails the request.
`items[].tags`	map of string	Cloud-provider tags on the affected resource, as key/value pairs. An empty object means the resource has no tags. `null` means the tags could not be resolved; resolving them never fails the request.
`items[].issuedResourceName`	string	Name of the affected resource.
`items[].accountId`	string	Cloud account the affected resource belongs to (for example, an AWS account ID or a Google Cloud project ID).
`items[].region`	string	Cloud region of the affected resource. Absent for global resources.
`items[].provider`	string	Cloud provider or platform, using the Console's provider names. One of: `"aws"`, `"azure"`, `"azure_ad"`, `"gcp"`, `"general"`, `"google_cloud_source"`, `"google_workspace"`, `"k8s"`, `"oci"`, `"vmware"`.
`items[].resourceClass`	string	Type of the affected resource. Absent when unknown.
`items[].detectionTime`	string (date-time)	When the result was first detected (RFC 3339, UTC).
`items[].resolvedTime`	string (date-time)	When the result was resolved (RFC 3339, UTC). Absent while unresolved.
`items[].solved`	boolean	Whether the result is resolved.
`items[].snoozed`	boolean	Whether the result is currently snoozed. Present only when `true`; absent means not snoozed.
`items[].isActive`	boolean	Whether the result's account was scanned recently. It does not say whether the result is resolved or snoozed; use `solved` and `snoozed` for that, or the `status` filter.
`items[].lastFlowId`	string	ID of the most recent Composer scan that reported this result. Absent when unknown.
`items[].firstFlowId`	string	ID of the Composer scan that first reported this result. Absent when unknown.
`items[].costEstimationPotentialSavings`	number (double)	Potential cost savings — the daily amount in US dollars you would stop paying by acting on this result. The Console Cost savings column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated, and always absent on resolved results.
`items[].costEstimationPotentialIncreasedCosts`	number (double)	Cost avoidance — the daily amount in US dollars of a future charge (for example, extended-support fees) you prevent by acting on this result in time. The Console Cost avoidance column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated, and always absent on resolved results.
`items[].costEstimationPotentialFreedCommitments`	number (double)	Freed commitments — the daily amount in US dollars of commitment coverage (Savings Plans, Reserved Instances or CUDs) that acting on this result frees up for other usage. The Console Freed commitments column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated, and always absent on resolved results.
`items[].costEstimationPotentialIncreasedCommitmentsRequired`	number (double)	Avoidable commitments — the daily amount in US dollars of extra commitment or overlapping cost you avoid by timing the action, for example to a Reserved Instance's expiry. The Console Avoidable commitments column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated, and always absent on resolved results.
`pageToken`	string	Token for the next page. Absent on the last page.
`rowCount`	integer (int64)	Total number of results across all pages.

Example response (`--output json`)

{
  "items": [
    {
      "id": 1001,
      "ruleId": 42,
      "issuedResourceId": "arn:aws:s3:::example-public-bucket",
      "providerIdentifier": "arn:aws:s3:::example-public-bucket",
      "tags": {
        "environment": "production",
        "team": "platform"
      },
      "issuedResourceName": "example-public-bucket",
      "accountId": "123456789012",
      "region": "us-east-1",
      "provider": "aws",
      "resourceClass": "s3-bucket",
      "detectionTime": "2026-08-18T09:30:00Z",
      "solved": false,
      "isActive": true,
      "lastFlowId": "example-latest-scan-id",
      "firstFlowId": "example-first-scan-id",
      "costEstimationPotentialSavings": 120
    },
    {
      "id": 1002,
      "ruleId": 42,
      "issuedResourceId": "arn:aws:s3:::example-logs-bucket",
      "providerIdentifier": "arn:aws:s3:::example-logs-bucket",
      "tags": {},
      "issuedResourceName": "example-logs-bucket",
      "accountId": "123456789012",
      "region": "eu-west-1",
      "provider": "aws",
      "resourceClass": "s3-bucket",
      "detectionTime": "2026-08-02T14:12:00Z",
      "solved": false,
      "snoozed": true,
      "isActive": true,
      "lastFlowId": "example-latest-scan-id",
      "firstFlowId": "example-earlier-scan-id"
    }
  ],
  "rowCount": 2
}

Raw JSON schema

{
  "type": "object",
  "description": "One page of a Composer recipe's results.",
  "required": [
    "items",
    "rowCount"
  ],
  "properties": {
    "items": {
      "type": "array",
      "description": "Results on this page.",
      "items": {
        "type": "object",
        "description": "One result of a Composer recipe — a finding on one affected resource.",
        "required": [
          "id",
          "ruleId",
          "issuedResourceId",
          "providerIdentifier",
          "tags",
          "issuedResourceName",
          "accountId",
          "provider",
          "detectionTime",
          "solved",
          "isActive"
        ],
        "properties": {
          "id": {
            "type": "integer",
            "format": "int64",
            "description": "Result ID.",
            "example": 1001
          },
          "ruleId": {
            "type": "integer",
            "format": "int64",
            "description": "ID of the recipe the result belongs to. Equal to the `recipeId` path parameter.",
            "example": 42
          },
          "issuedResourceId": {
            "type": "string",
            "description": "Identifier of the affected resource, as stored by Composer.",
            "example": "arn:aws:s3:::example-public-bucket"
          },
          "providerIdentifier": {
            "type": "string",
            "nullable": true,
            "description": "Canonical cloud-provider identifier of the affected resource.\n- AWS: the resource's ARN when one is available, otherwise the stored identifier (for example, an EC2 instance ID).\n- Google Cloud: the API relative resource name (for example, `projects/my-project/zones/us-central1-a/instances/vm-1`), or the bucket name for Cloud Storage; otherwise the stored identifier.\n- Other providers: the provider-native identifier.\n\n`null` when no identifier is stored or it could not be resolved; resolving it never fails the request.",
            "example": "arn:aws:s3:::example-public-bucket"
          },
          "tags": {
            "type": "object",
            "nullable": true,
            "additionalProperties": {
              "type": "string"
            },
            "description": "Cloud-provider tags on the affected resource, as key/value pairs. An empty object means the resource has no tags. `null` means the tags could not be resolved; resolving them never fails the request.",
            "example": {
              "environment": "production",
              "team": "platform"
            }
          },
          "issuedResourceName": {
            "type": "string",
            "description": "Name of the affected resource.",
            "example": "example-public-bucket"
          },
          "accountId": {
            "type": "string",
            "description": "Cloud account the affected resource belongs to (for example, an AWS account ID or a Google Cloud project ID).",
            "example": "123456789012"
          },
          "region": {
            "type": "string",
            "description": "Cloud region of the affected resource. Absent for global resources.",
            "example": "us-east-1"
          },
          "provider": {
            "type": "string",
            "description": "Cloud provider or platform, using the Console's provider names.",
            "enum": [
              "aws",
              "azure",
              "azure_ad",
              "gcp",
              "general",
              "google_cloud_source",
              "google_workspace",
              "k8s",
              "oci",
              "vmware"
            ],
            "x-enumDescriptions": {
              "aws": "Shown as Amazon Web Services in the Console.",
              "azure": "Shown as Azure in the Console.",
              "azure_ad": "Shown as Azure Active Directory in the Console.",
              "gcp": "Shown as Google Cloud Platform in the Console.",
              "general": "Shown as General in the Console; not tied to one cloud provider.",
              "google_cloud_source": "Shown as Google Cloud Source in the Console.",
              "google_workspace": "Shown as Google Workspace in the Console.",
              "k8s": "Shown as Kubernetes in the Console.",
              "oci": "Shown as Oracle Cloud in the Console.",
              "vmware": "Shown as VMware in the Console."
            },
            "example": "aws"
          },
          "resourceClass": {
            "type": "string",
            "description": "Type of the affected resource. Absent when unknown.",
            "example": "s3-bucket"
          },
          "detectionTime": {
            "type": "string",
            "format": "date-time",
            "description": "When the result was first detected (RFC 3339, UTC).",
            "example": "2026-08-18T09:30:00Z"
          },
          "resolvedTime": {
            "type": "string",
            "format": "date-time",
            "description": "When the result was resolved (RFC 3339, UTC). Absent while unresolved.",
            "example": "2026-08-19T11:05:00Z"
          },
          "solved": {
            "type": "boolean",
            "description": "Whether the result is resolved.",
            "example": false
          },
          "snoozed": {
            "type": "boolean",
            "description": "Whether the result is currently snoozed. Present only when `true`; absent means not snoozed.",
            "example": true
          },
          "isActive": {
            "type": "boolean",
            "description": "Whether the result's account was scanned recently. It does not say whether the result is resolved or snoozed; use `solved` and `snoozed` for that, or the `status` filter.",
            "example": true
          },
          "lastFlowId": {
            "type": "string",
            "description": "ID of the most recent Composer scan that reported this result. Absent when unknown.",
            "example": "example-latest-scan-id"
          },
          "firstFlowId": {
            "type": "string",
            "description": "ID of the Composer scan that first reported this result. Absent when unknown.",
            "example": "example-first-scan-id"
          },
          "costEstimationPotentialSavings": {
            "type": "number",
            "format": "double",
            "description": "Potential cost savings — the daily amount in US dollars you would stop paying by acting on this result. The Console **Cost savings** column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated, and always absent on resolved results.",
            "example": 120
          },
          "costEstimationPotentialIncreasedCosts": {
            "type": "number",
            "format": "double",
            "description": "Cost avoidance — the daily amount in US dollars of a future charge (for example, extended-support fees) you prevent by acting on this result in time. The Console **Cost avoidance** column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated, and always absent on resolved results.",
            "example": 0
          },
          "costEstimationPotentialFreedCommitments": {
            "type": "number",
            "format": "double",
            "description": "Freed commitments — the daily amount in US dollars of commitment coverage (Savings Plans, Reserved Instances or CUDs) that acting on this result frees up for other usage. The Console **Freed commitments** column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated, and always absent on resolved results.",
            "example": 0
          },
          "costEstimationPotentialIncreasedCommitmentsRequired": {
            "type": "number",
            "format": "double",
            "description": "Avoidable commitments — the daily amount in US dollars of extra commitment or overlapping cost you avoid by timing the action, for example to a Reserved Instance's expiry. The Console **Avoidable commitments** column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated, and always absent on resolved results.",
            "example": 0
          }
        }
      }
    },
    "pageToken": {
      "type": "string",
      "description": "Token for the next page. Absent on the last page."
    },
    "rowCount": {
      "type": "integer",
      "format": "int64",
      "minimum": 0,
      "description": "Total number of results across all pages.",
      "example": 5
    }
  }
}

Errors

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping

HTTP status	Exit code	Error code	Meaning
400	30	`VALIDATION_ERROR`	The arguments or request body were rejected. Review the command's flags and payload.
401	10	`AUTHENTICATION_FAILED`	Not signed in, or the API token is invalid. Run `dci login` or check `DCI_API_KEY`.
403	11	`PERMISSION_DENIED`	The DoiT user or the active customer context does not have access.
404	20	`RESOURCE_NOT_FOUND`	The requested resource does not exist. Check the identifier argument.
500, 503	40	`API_SERVER_ERROR`	The API failed to process the request. Retryable; contact DoiT support if it persists.

list-composer-recipes — List Composer recipes
API reference: GET /insights/v2/recipes/{recipeId}/results

Aliases: listcomposerreciperesults

Flags​

Output​

Example response (--output json)​

Errors​

Related​

Flags

Output

Example response (`--output json`)

Errors

Related