---
title: "Dismiss RLS recommendation"
method: DELETE
path: "/api/apps/{app_id}/security/scan/rls-recommendation/{entity_name}"
---

# Dismiss RLS recommendation

`DELETE /api/apps/{app_id}/security/scan/rls-recommendation/{entity_name}`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/security/scan/rls-recommendation/{entity_name}`
- Auth: HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Removes one entity's row-level security recommendation from the app's latest security scan result. Get `entity_name` from `rls_recommendations` in [Get security scan](/api-reference/get-security-scan).

The call changes only the scan result, never the entity's rules. You can send it two ways:
- Send `applied_rule` to record a fix. Apply the rules with [Update entity schema](/api-reference/update-entity-schema) first, because Base44 records the rules as you send them and doesn't check them against the entity.
- Leave `applied_rule` out to dismiss the recommendation without recording a fix.

The next scan that checks row-level security judges every entity again, so a recommendation can come back if the entity's rules still need to change.

## Path parameters

- `entity_name` string, required: Entity whose recommendation to remove, as returned in `rls_recommendations` by [Get security scan](/api-reference/get-security-scan). It contains only letters, digits, and underscores.
- `app_id` string, required: ID of the app.

## Request body

- object
  - `applied_rule` object, nullable: The rules you applied to the entity, keyed by operation in the same format as the entity's `rls`. Send it to record the call as a fix. Leave it out, or send `null` or an empty object, to record a plain dismissal. Keys other than the five operations are rejected. A filter can use only the query operators `$eq`, `$ne`, `$gt`, `$gte`, `$lt`, `$lte`, `$in`, `$nin`, `$and`, `$or`, `$not`, `$nor`, `$exists`, `$type`, `$all`, `$elemMatch`, `$size`, `$regex`, `$options`, `$text`, `$search`, `$near`, `$nearSphere`, `$geoIntersects`, and `$geoWithin`. The operators `$and`, `$or`, and `$nor` take a list. The operators `$in`, `$nin`, and `$all` take a list or a template string such as `{{user.data.departments}}`. The `user_condition` key takes an object. The whole value can be up to 20,000 bytes as compact JSON, nest up to 8 levels deep, and hold up to 200 keys in total. Lists can hold up to 50 items, keys up to 200 characters, and strings up to 2,000 characters. The keys `__proto__`, `constructor`, and `prototype` aren't allowed.
    - `create` union: Rule you applied for creating a record. Send `true` to allow it for everyone, `false` to block it outright, `null` to leave it unset, or an object as a filter matched against the record and the signed-in app user.
      - boolean
      - object
    - `read` union: Rule you applied for reading records. Send `true` to allow it for everyone, `false` to block it outright, `null` to leave it unset, or an object as a filter matched against the record and the signed-in app user.
      - boolean
      - object
    - `update` union: Rule you applied for updating a record. Send `true` to allow it for everyone, `false` to block it outright, `null` to leave it unset, or an object as a filter matched against the record and the signed-in app user.
      - boolean
      - object
    - `delete` union: Rule you applied for deleting a record. Send `true` to allow it for everyone, `false` to block it outright, `null` to leave it unset, or an object as a filter matched against the record and the signed-in app user.
      - boolean
      - object
    - `write` union: Legacy rule for updating and deleting, used for whichever of the two has no rule of its own. Send `true` to allow it for everyone, `false` to block it outright, `null` to leave it unset, or an object as a filter matched against the record and the signed-in app user.
      - boolean
      - object

## Response `200`

The recommendation left the scan result.

- SecurityRlsRecommendationDismissed
  - `status` string, required: Always `ok`. The recommendation is no longer in the scan result.

## Other responses

- `400`: The `entity_name` isn't a valid entity name.
- `401`: Missing or invalid credentials.
- `403`: You don't have editor access to this app, or you used a workspace API key. A read-only personal access token is refused.
- `404`: App not found.
- `409`: The latest scan result has no recommendation for the entity, so nothing was recorded. The detail is `RLS recommendation was not dismissed. Refresh scan results and try again.` This happens when: - The app has no scan result. - The scan result came from an earlier version of the scanner. - The recommendation was already resolved, or a newer scan replaced it. Read the result again with [Get security scan](/api-reference/get-security-scan) before you retry.
- `422`: The body isn't a JSON object, has fields other than `applied_rule`, or `applied_rule` breaks one of the limits described on the field.
- `429`: Rate limit exceeded. The base limit is 30 requests per minute for each app, shared by every personal access token in the workspace. See [Rate limits](/developers/references/apps-api/get-started/rate-limits) for the multiplier your plan gets.

## Changes

> 58 revisions in range; 1 not diffed.

- **2026-10-12** `5e139db2e643`: 1 info
  - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API
- **2026-09-28** `347e2afcf94a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/adexad/apis/base44-app-management-api/changes/api/apps/:app_id/security/scan/rls-recommendation/:entity_name/delete.md)

---

[API](https://skmtc.dev/adexad/apis/base44-app-management-api.md) · [All operations](https://skmtc.dev/adexad/apis/base44-app-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/adexad/apis/base44-app-management-api/revisions/fa29e915c226?raw)