--- title: "Fix RLS recommendations" method: POST path: "/api/apps/{app_id}/security/scan/rls/fix" --- # Fix RLS recommendations `POST /api/apps/{app_id}/security/scan/rls/fix` ## Request - Base URL: `https://app.base44.com` - URL: `https://app.base44.com/api/apps/{app_id}/security/scan/rls/fix` - Auth: HTTP bearer This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production. Applies the row-level security rules the app's latest security scan recommends, for the entities you name. Get the names from `rls_recommendations` in [Get security scan](/api-reference/get-security-scan). For each entity, Base44 replaces the entity's `rls` with the recommendation's create, read, update, and delete rules, exactly as the scan stored them. An operation the recommendation has no rule for is left with no rule, which doesn't restrict it. It doesn't run the scan again or ask an AI model anything, and it uses no credits. The applied recommendations are removed from `rls_recommendations`. An entity with nothing to apply doesn't fail the call. It's listed in `failed` with the reason, and the rest are still applied. They're saved together, so if saving fails, the entities it failed for are listed in `failed` as `write_failed`, and that can be all of them. Some of their rules can still have changed in that case, so read the entities' schemas before you retry. Read both lists rather than treating a successful response as every entity fixed. By default the fix also shows up in the app's AI chat, with a checkpoint of the app's code saved just before it, so you can roll it back from there. Set `record_security_fix_chat` to `false` to skip both. ## Path parameters - `app_id` string, required: ID of the app. ## Request body - RlsFixRequest: Which entities to apply the recommended row-level security rules to. - `entity_names` string[], required: Entities to fix, as returned in `rls_recommendations` by [Get security scan](/api-reference/get-security-scan). Name at least one and at most 100. A name listed twice is applied once. - `record_security_fix_chat` boolean: Whether to add the fix to the app's AI chat and save a checkpoint of the app first. Set `true` to do both and `false` to apply the fix with neither. Defaults to `true`. - `security_fix_total_count` integer, nullable: When you split one fix across several calls, the total number of entities across all of them. It's used only in the chat message, and ignored unless it's larger than the number of names in `entity_names`. ## Response `200` Which entities got their recommended rules, and which didn't. - RlsFixResponse - `fixed` string[], required: Entities whose `rls` now holds the recommended rules. An entity can also appear in `failed` as `no_recommendation` when a newer scan replaced its recommendation while the rules were being applied. - `failed` RlsFixFailure[], required: Entities that weren't fixed, each with the reason. - `entity_name` string, required: Entity that wasn't fixed. - `reason` 'no_scan' | 'no_recommendation' | 'entity_not_found' | 'write_failed', required: Why it wasn't fixed. - `no_scan`: The app has no scan result from the current scanner, so run [Run security scan](/api-reference/run-security-scan) first. - `no_recommendation`: The latest result holds no recommendation for the entity, because it never had one or it was already resolved. - `entity_not_found`: The app no longer has the entity. - `write_failed`: Saving the rules failed, though some of them may have landed, and the recommendation is kept so you can retry. ## Other responses - `401`: Missing or invalid credentials. - `403`: You don't have editor access to this app, or you used a workspace API key. A read-only personal access token is refused. - `404`: App not found. - `409`: The app isn't ready for fixes, because: - A security scan is running on it. - The AI is working on it. The error code is `builder_busy`. - It changed since its last scan. The error code is `scan_out_of_date`, and it's returned only to callers whose fixes require a fresh scan. Apply the fixes once the scan or the AI finishes, or run a new scan with [Run security scan](/api-reference/run-security-scan) first. - `422`: The body is invalid, because: - It's missing, or has fields other than `entity_names`, `record_security_fix_chat`, and `security_fix_total_count`. - The list in `entity_names` is empty, holds more than 100 names, or has a name with a character other than a letter, digit, or underscore. - A value has the wrong type, or `security_fix_total_count` is less than 1. - `429`: Rate limit exceeded. The base limit is 30 requests per minute for each app, shared by every personal access token in the workspace. See [Rate limits](/developers/references/apps-api/get-started/rate-limits) for the multiplier your plan gets. ## Changes > 58 revisions in range; 1 not diffed. - **2026-10-12** `5e139db2e643`: 1 info - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API - **2026-09-28** `347e2afcf94a`: 1 info - endpoint added [Operation history](https://skmtc.dev/adexad/apis/base44-app-management-api/changes/api/apps/:app_id/security/scan/rls/fix/post.md) --- [API](https://skmtc.dev/adexad/apis/base44-app-management-api.md) · [All operations](https://skmtc.dev/adexad/apis/base44-app-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/adexad/apis/base44-app-management-api/revisions/fa29e915c226?raw)