---
updatedAt: 2026-08-12T16:50:41.000Z
agentTools:
  projectIndex: https://docs.stairwell.com/llms.txt
---

# GetResult

GetResult returns a finished investigation's verdict and machine-readable
 artifacts. The report and recommendations export are serialized JSON, so
 their schemas can evolve without breaking this contract. Errors:
 NotFound (unknown id or no access — deliberately indistinguishable),
 FailedPrecondition (not finished yet).

# OpenAPI definition

```json
{
  "openapi": "3.0.3",
  "info": {
    "title": "Stairwell Backstory (Beta)",
    "description": "APIs for driving Backstory background investigations: submit an IOC (file hash, hostname, or IP), poll the job to completion, and fetch the verdict, incident report, remediation recommendations, and raw graph state. The base URL for this API is https://app.stairwell.com/backstory/v1beta1. BETA: this surface carries no compatibility promise — routes and response shapes may change; breaking changes are announced in the changelog. Requires the Backstory (Constellation) entitlement.",
    "contact": {
      "name": "Stairwell",
      "email": "support@stairwell.com"
    },
    "version": "0.1.0"
  },
  "servers": [
    {
      "url": "https://app.stairwell.com/backstory"
    }
  ],
  "paths": {
    "/v1beta1/investigations/{investigationId}/result": {
      "get": {
        "tags": [
          "Backstory"
        ],
        "summary": "GetResult",
        "description": "GetResult returns a finished investigation's verdict and machine-readable\n artifacts. The report and recommendations export are serialized JSON, so\n their schemas can evolve without breaking this contract. Errors:\n NotFound (unknown id or no access — deliberately indistinguishable),\n FailedPrecondition (not finished yet).",
        "operationId": "Backstory_GetResult",
        "parameters": [
          {
            "name": "investigationId",
            "in": "path",
            "description": "The investigation's UUID, from Submit, the app's URL, or SearchIocs.",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/InvestigationResults"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "InvestigationResults": {
        "type": "object",
        "properties": {
          "investigationId": {
            "type": "string"
          },
          "seed": {
            "$ref": "#/components/schemas/Ioc"
          },
          "verdict": {
            "type": "string"
          },
          "summary": {
            "type": "string"
          },
          "immediateActions": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "description": "The report's immediate actions: the shared bucket followed by every\n per-campaign bucket, so a multi-campaign verdict is never under-reported."
          },
          "reportJson": {
            "type": "string",
            "description": "The full incident report, serialized JSON. As a bytes field it arrives\n base64-encoded over REST JSON; decode to get the JSON document.",
            "format": "bytes"
          },
          "recommendationsExportJson": {
            "type": "string",
            "description": "The classified remediation export (schema_version'd), serialized JSON.\n Arrives base64-encoded over REST JSON.",
            "format": "bytes"
          },
          "finishTime": {
            "type": "string",
            "format": "date-time"
          }
        }
      },
      "Ioc": {
        "type": "object",
        "properties": {
          "iocType": {
            "enum": [
              "IOC_TYPE_UNSPECIFIED",
              "IOC_TYPE_FILE",
              "IOC_TYPE_HOSTNAME",
              "IOC_TYPE_IP"
            ],
            "type": "string",
            "format": "enum"
          },
          "iocValue": {
            "type": "string",
            "description": "The indicator in natural form (lowercase hex hash, FQDN, or IP)."
          }
        },
        "description": "Ioc is an indicator: a SHA256 file hash, a hostname, or an IP address."
      }
    },
    "securitySchemes": {
      "AuthToken": {
        "type": "apiKey",
        "name": "Authorization",
        "in": "header"
      }
    }
  },
  "security": [
    {
      "AuthToken": []
    }
  ],
  "tags": [
    {
      "name": "Backstory"
    }
  ]
}
```

# Sibling pages

* [Submit](https://docs.stairwell.com/reference/backstory_submit.md)
* [GetJob](https://docs.stairwell.com/reference/backstory_getjob.md)
* [GetRecommendations](https://docs.stairwell.com/reference/backstory_getrecommendations.md)
* [GetGraphState](https://docs.stairwell.com/reference/backstory_getgraphstate.md)
* [ListInvestigations](https://docs.stairwell.com/reference/backstory_listinvestigations.md)
* [SearchIocs](https://docs.stairwell.com/reference/backstory_searchiocs.md)
* [Cancel](https://docs.stairwell.com/reference/backstory_cancel.md)
* [Pause](https://docs.stairwell.com/reference/backstory_pause.md)
* [Resume](https://docs.stairwell.com/reference/backstory_resume.md)