---
title: "Dismiss header recommendation"
method: DELETE
path: "/api/apps/{app_id}/security/scan/header-recommendations/{flag}"
---

# Dismiss header recommendation

`DELETE /api/apps/{app_id}/security/scan/header-recommendations/{flag}`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/security/scan/header-recommendations/{flag}`
- Auth: HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Removes one security header [recommendation](/developers/references/apps-api/sections/security#scan-findings) from the app's security scan result without changing the app's headers. Get the `flag` from `header_recommendations` in [Get security scan](/api-reference/get-security-scan).

The recommendation stays out of the scan result until the next call to [Run security scan](/api-reference/run-security-scan). That call judges the app's headers again, even when it returns the existing scan result, so the recommendation comes back if it still applies.

To act on the recommendation instead, turn the setting on with [Update security headers](/api-reference/update-security-headers).

## Path parameters

- `flag` string, required: The recommendation to dismiss, as returned in `header_recommendations[].flag` by [Get security scan](/api-reference/get-security-scan). Either `prevent_iframe_embedding` or `restrict_browser_features`.
- `app_id` string, required: ID of the app.

## Response `200`

The recommendation is dismissed, or there was nothing to dismiss.

- SecurityHeaderRecommendationDismissed
  - `status` string, required: Always `ok`, including when there was nothing to dismiss.

## Other responses

- `401`: Missing or invalid credentials.
- `403`: You don't have editor access to this app, or you used a workspace API key. A read-only personal access token is refused.
- `404`: App not found.
- `429`: Rate limit exceeded. The base limit is 30 requests per minute for each app, shared by every personal access token in the workspace. See [Rate limits](/developers/references/apps-api/get-started/rate-limits) for the multiplier your plan gets.

## Changes

> 58 revisions in range; 1 not diffed.

- **2026-10-12** `5e139db2e643`: 1 info
  - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API
- **2026-09-29** `d2b7ac8beb0c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adexad/apis/base44-app-management-api/changes/api/apps/:app_id/security/scan/header-recommendations/:flag/delete.md)

---

[API](https://skmtc.dev/adexad/apis/base44-app-management-api.md) · [All operations](https://skmtc.dev/adexad/apis/base44-app-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/adexad/apis/base44-app-management-api/revisions/fa29e915c226?raw)