list-composer-recipes

dci list-composer-recipes [flags]

Returns the Composer recipes that have results in your recently scanned cloud accounts, with counts of those results by status and their estimated savings. Recipes with no such results are not listed. Dismissed recipes are listed with status: dismissed and every count set to 0.

Recipes are sorted by severity, descending, by default. Ties break by title (case-insensitive), then by id.

filter is one string of key:value clauses: , separates alternative values for one key (OR) and | separates keys (AND), for example severity:critical,high|provider:aws,gcp. Because , and | are separators, a value itself can't contain them. Supported keys:

provider: one or more of aws, azure, azure_ad, gcp, general, google_cloud_source, google_workspace, k8s, oci, vmware.
severity: one or more of critical, high, medium, low.
pillar: one or more of cost, operations, performance, security, compliance. compliance matches recipes tagged with at least one compliance standard.
has_active_results: exactly one of true or false.
allocation: up to 10 distinct allocation IDs from GET /analytics/v1/allocations. Lists only recipes with results on resources in any of those allocations; counts, savings and rowCount then cover only those resources. An allocation you can't view returns 404; if access can't be checked, the request returns 503 rather than unfiltered data.

Requests are always served for the customer your API token belongs to. To list the results of one recipe, use its id with GET /insights/v2/recipes/\{recipeId\}/results.

Flags

Flag	Type	Default	Example	Description
`--max-results`	integer	`50`	`50`	Maximum number of items to return on one page, from 1 to 500. Defaults to 50. A value outside that range returns `400 validation_failed`.
`--page-token`	string			Continuation token from the `pageToken` of the previous response. Omit it on the first request; a response without `pageToken` is the last page. The token records the position, the sort and the `allocation` filter IDs. Changing `sortBy`, `sortOrder` or the allocation IDs while paginating returns `400 pagination_token_invalid`. Keep the other `filter` keys and `maxResults` unchanged while paginating. Tokens expire 5 minutes after they are issued; an expired token returns `400 pagination_token_expired`. In both cases, restart from the first page.
`--sort-by`	string	`"severity"`		Field to sort recipes by. Defaults to `severity`. Ties break by title (case-insensitive, ascending), then by `id` (ascending), whatever the `sortOrder`. One of: `"severity"`, `"title"`, `"detection_time"`, `"active_results_count"`, `"total_results_count"`.
`--sort-order`	string	`"desc"`		Sort direction for `sortBy`. Defaults to `desc`. One of: `"asc"`, `"desc"`.
`--filter`	string		`severity:critical,high\|provider:aws,gcp`	Restricts the recipes returned. One string of `key:value` clauses: `,` separates alternative values for one key (OR) and `\|` separates keys (AND). For example, `severity:critical,high\|provider:aws,gcp` returns recipes whose severity is critical or high and whose provider is Amazon Web Services or Google Cloud Platform. Because `,` and `\|` are separators, a value itself can't contain them. Only equality matching is supported. Omit `filter` to list every recipe that has results in your recently scanned accounts, including dismissed recipes. Keys: - `provider`: one or more of `aws`, `azure`, `azure_ad`, `gcp`, `general`, `google_cloud_source`, `google_workspace`, `k8s`, `oci`, `vmware`. - `severity`: one or more of `critical`, `high`, `medium`, `low`. - `pillar`: one or more of `cost`, `operations`, `performance`, `security`, `compliance`. Matches recipes tagged with that pillar; `compliance` matches recipes tagged with at least one compliance standard (such as SOC2 or HIPAA). - `has_active_results`: exactly one of `true` or `false`. - `allocation`: up to 10 distinct allocation IDs (duplicates are ignored); get allocation IDs from `GET /analytics/v1/allocations`. Matches recipes with results on resources in any of those allocations, as resolved by Cloud Analytics; counts, savings and `rowCount` then cover only those resources. You must be able to view every listed allocation. Service-account API keys can use public allocations only. If allocation access can't be checked, the request returns `503` with `Retry-After` and never falls back to unfiltered data. Errors: - An unknown key returns `400 filter_key_not_supported` when it's the only problem, otherwise `400 validation_failed`. - A value outside the allowed list, a non-boolean `has_active_results`, more than one `has_active_results` value, more than 10 distinct allocation IDs, an invalid allocation ID (blank, longer than 256 characters, or containing `/`, whitespace or control characters), a malformed expression or an unsupported operator returns `400 validation_failed`. - An allocation that doesn't exist or that you can't view returns `404 composer-api.allocation_not_found`.

Every command also accepts the CLI-wide flags for output shaping — see Output formats and Table output options.

Output

OK - A page of recipes matching the request.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

Field	Type	Description
`items`	array of object	Recipes on this page.
`items[].id`	integer (int64)	Recipe ID. Use it as `recipeId` to list the recipe's results.
`items[].title`	string	Recipe title, as shown in the Console.
`items[].description`	string	Longer explanation of what the recipe detects. Fetched on a best-effort basis, so it can be absent even when the recipe has one.
`items[].provider`	string	Cloud provider or platform, using the Console's provider names. One of: `"aws"`, `"azure"`, `"azure_ad"`, `"gcp"`, `"general"`, `"google_cloud_source"`, `"google_workspace"`, `"k8s"`, `"oci"`, `"vmware"`.
`items[].severity`	string	Severity of the recipe's results, set by the recipe's author. One of: `"critical"`, `"high"`, `"medium"`, `"low"`.
`items[].affectedResourceType`	string	Type of cloud resource the recipe's findings are on. Absent when unknown.
`items[].activeResultsCount`	integer	Number of active results (not resolved and not snoozed). 0 when the recipe is dismissed.
`items[].totalResultsCount`	integer	Number of results in any status. 0 when the recipe is dismissed.
`items[].resolvedResultsCount`	integer	Number of resolved results. 0 when the recipe is dismissed.
`items[].snoozedResultsCount`	integer	Number of snoozed results. 0 when the recipe is dismissed.
`items[].status`	string	Recipe status, derived from its results and whether it is dismissed. Absent when unavailable. One of: `"active"`, `"resolved"`, `"dismissed"`.
`items[].isDismissed`	boolean	Whether the recipe has been dismissed for your customer.
`items[].detectionTime`	string (date-time)	When the earliest of the recipe's results was first detected (RFC 3339, UTC). Absent when unavailable.
`items[].estimatedFixTimeMinutes`	integer	Estimated time to fix one finding, in minutes. Absent when not estimated.
`items[].totalPotentialSavings`	string	Potential cost savings across the recipe's active results, as a daily amount in US dollars. A decimal string with 2 decimal places (8 for amounts below 0.01), unlike the numeric per-result `costEstimationPotentialSavings`. When no active result has an estimate, it is the total recorded on the recipe's resolved results instead. The Console Cost savings column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated.
`items[].metadata`	object	Remediation guidance for the recipe. Always present; an empty object means no guidance is available. Each field is present only when the recipe has that content.
`items[].metadata.impacts`	string	Possible impact of applying the remediation.
`items[].metadata.importantPoints`	array of string	Points to consider before remediating.
`items[].metadata.reference`	string (uri)	Documentation URL for the finding.
`items[].metadata.manualRemediation`	string	HTML describing how to remediate the finding manually.
`pageToken`	string	Token for the next page. Absent on the last page.
`rowCount`	integer (int64)	Total number of recipes across all pages.

Example response (`--output json`)

{
  "items": [
    {
      "id": 42,
      "title": "Publicly readable S3 bucket",
      "description": "S3 buckets should not grant public read access.",
      "provider": "aws",
      "severity": "critical",
      "affectedResourceType": "s3-bucket",
      "activeResultsCount": 3,
      "totalResultsCount": 5,
      "resolvedResultsCount": 2,
      "snoozedResultsCount": 0,
      "status": "active",
      "isDismissed": false,
      "detectionTime": "2026-08-18T09:30:00Z",
      "estimatedFixTimeMinutes": 15,
      "totalPotentialSavings": "120.00",
      "metadata": {
        "impacts": "Blocking public access may break static-site hosting.",
        "importantPoints": [
          "Check bucket policies too."
        ],
        "reference": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html",
        "manualRemediation": "<ol><li>Open the S3 console.</li></ol>"
      }
    }
  ],
  "pageToken": "example-next-page-token",
  "rowCount": 137
}

Raw JSON schema

{
  "type": "object",
  "description": "One page of Composer recipes.",
  "required": [
    "items",
    "rowCount"
  ],
  "properties": {
    "items": {
      "type": "array",
      "description": "Recipes on this page.",
      "items": {
        "type": "object",
        "description": "A Composer recipe with findings in your cloud accounts. Counts and savings cover results from recently scanned accounts only.",
        "required": [
          "id",
          "title",
          "provider",
          "severity",
          "activeResultsCount",
          "totalResultsCount",
          "resolvedResultsCount",
          "snoozedResultsCount",
          "isDismissed",
          "metadata"
        ],
        "properties": {
          "id": {
            "type": "integer",
            "format": "int64",
            "description": "Recipe ID. Use it as `recipeId` to list the recipe's results.",
            "example": 42
          },
          "title": {
            "type": "string",
            "description": "Recipe title, as shown in the Console.",
            "example": "Publicly readable S3 bucket"
          },
          "description": {
            "type": "string",
            "description": "Longer explanation of what the recipe detects. Fetched on a best-effort basis, so it can be absent even when the recipe has one.",
            "example": "S3 buckets should not grant public read access."
          },
          "provider": {
            "type": "string",
            "description": "Cloud provider or platform, using the Console's provider names.",
            "enum": [
              "aws",
              "azure",
              "azure_ad",
              "gcp",
              "general",
              "google_cloud_source",
              "google_workspace",
              "k8s",
              "oci",
              "vmware"
            ],
            "x-enumDescriptions": {
              "aws": "Shown as Amazon Web Services in the Console.",
              "azure": "Shown as Azure in the Console.",
              "azure_ad": "Shown as Azure Active Directory in the Console.",
              "gcp": "Shown as Google Cloud Platform in the Console.",
              "general": "Shown as General in the Console; not tied to one cloud provider.",
              "google_cloud_source": "Shown as Google Cloud Source in the Console.",
              "google_workspace": "Shown as Google Workspace in the Console.",
              "k8s": "Shown as Kubernetes in the Console.",
              "oci": "Shown as Oracle Cloud in the Console.",
              "vmware": "Shown as VMware in the Console."
            },
            "example": "aws"
          },
          "severity": {
            "type": "string",
            "description": "Severity of the recipe's results, set by the recipe's author.",
            "enum": [
              "critical",
              "high",
              "medium",
              "low"
            ],
            "x-enumDescriptions": {
              "critical": "Shown as Critical in the Console; the highest level.",
              "high": "Shown as High in the Console.",
              "medium": "Shown as Medium in the Console.",
              "low": "Shown as Low in the Console; the lowest level."
            },
            "example": "critical"
          },
          "affectedResourceType": {
            "type": "string",
            "description": "Type of cloud resource the recipe's findings are on. Absent when unknown.",
            "example": "s3-bucket"
          },
          "activeResultsCount": {
            "type": "integer",
            "minimum": 0,
            "description": "Number of active results (not resolved and not snoozed). 0 when the recipe is dismissed.",
            "example": 3
          },
          "totalResultsCount": {
            "type": "integer",
            "minimum": 0,
            "description": "Number of results in any status. 0 when the recipe is dismissed.",
            "example": 5
          },
          "resolvedResultsCount": {
            "type": "integer",
            "minimum": 0,
            "description": "Number of resolved results. 0 when the recipe is dismissed.",
            "example": 2
          },
          "snoozedResultsCount": {
            "type": "integer",
            "minimum": 0,
            "description": "Number of snoozed results. 0 when the recipe is dismissed.",
            "example": 0
          },
          "status": {
            "type": "string",
            "description": "Recipe status, derived from its results and whether it is dismissed. Absent when unavailable.",
            "enum": [
              "active",
              "resolved",
              "dismissed"
            ],
            "x-enumDescriptions": {
              "active": "The recipe has at least one active result.",
              "resolved": "The recipe has no active results; every result is resolved or snoozed.",
              "dismissed": "The recipe has been dismissed for your customer."
            },
            "example": "active"
          },
          "isDismissed": {
            "type": "boolean",
            "description": "Whether the recipe has been dismissed for your customer.",
            "example": false
          },
          "detectionTime": {
            "type": "string",
            "format": "date-time",
            "description": "When the earliest of the recipe's results was first detected (RFC 3339, UTC). Absent when unavailable.",
            "example": "2026-08-18T09:30:00Z"
          },
          "estimatedFixTimeMinutes": {
            "type": "integer",
            "minimum": 0,
            "description": "Estimated time to fix one finding, in minutes. Absent when not estimated.",
            "example": 15
          },
          "totalPotentialSavings": {
            "type": "string",
            "description": "Potential cost savings across the recipe's active results, as a daily amount in US dollars. A decimal string with 2 decimal places (8 for amounts below 0.01), unlike the numeric per-result `costEstimationPotentialSavings`. When no active result has an estimate, it is the total recorded on the recipe's resolved results instead. The Console **Cost savings** column is this daily US-dollar amount × 365, converted to your organization's currency. Absent when not estimated.",
            "example": "120.00"
          },
          "metadata": {
            "type": "object",
            "description": "Remediation guidance for the recipe. Always present; an empty object means no guidance is available. Each field is present only when the recipe has that content.",
            "properties": {
              "impacts": {
                "type": "string",
                "description": "Possible impact of applying the remediation.",
                "example": "Blocking public access may break static-site hosting."
              },
              "importantPoints": {
                "type": "array",
                "description": "Points to consider before remediating.",
                "items": {
                  "type": "string"
                },
                "example": [
                  "Check bucket policies too."
                ]
              },
              "reference": {
                "type": "string",
                "format": "uri",
                "description": "Documentation URL for the finding.",
                "example": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html"
              },
              "manualRemediation": {
                "type": "string",
                "description": "HTML describing how to remediate the finding manually.",
                "example": "<ol><li>Open the S3 console.</li></ol>"
              }
            }
          }
        }
      }
    },
    "pageToken": {
      "type": "string",
      "description": "Token for the next page. Absent on the last page."
    },
    "rowCount": {
      "type": "integer",
      "format": "int64",
      "minimum": 0,
      "description": "Total number of recipes across all pages.",
      "example": 137
    }
  }
}

Errors

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping

HTTP status	Exit code	Error code	Meaning
400	30	`VALIDATION_ERROR`	The arguments or request body were rejected. Review the command's flags and payload.
401	10	`AUTHENTICATION_FAILED`	Not signed in, or the API token is invalid. Run `dci login` or check `DCI_API_KEY`.
403	11	`PERMISSION_DENIED`	The DoiT user or the active customer context does not have access.
404	20	`RESOURCE_NOT_FOUND`	The requested resource does not exist. Check the identifier argument.
500, 503	40	`API_SERVER_ERROR`	The API failed to process the request. Retryable; contact DoiT support if it persists.

list-composer-recipe-results — List Composer recipe results
API reference: GET /insights/v2/recipes

Aliases: listcomposerrecipes

Flags​

Output​

Example response (--output json)​

Errors​

Related​

Flags

Output

Example response (`--output json`)

Errors

Related