---
title: "Export Hotlist to Excel"
method: POST
path: "/api/security/hotlist/export"
tags: ["Security Hotlist"]
---

# Export Hotlist to Excel

`POST /api/security/hotlist/export`

## Request

- Base URL: `https://api.codeant.ai`
- URL: `https://api.codeant.ai/api/security/hotlist/export`
- Auth: HTTP bearer

Renders every finding matching `filters` and `search` — ranked exactly as the findings endpoint returns them — into an Excel (.xlsx) workbook, and returns a presigned download link valid for five minutes. The workbook is a single `Hotlist` sheet with a frozen, auto-filtered header row covering rank, finding, identifier, type, severity, location, priority score and signals, exploit / KEV / fixable flags, ticket status, provider, assignee, provider status, SLA due date and status, ticket URL, file path, line and compliance frameworks.

Unlike the findings endpoint this is not paginated — the export always holds the complete filtered list. Omit `filters` and `search` to export the entire Hotlist.

## Request body

- HotlistExportRequest: Excel export request. `filters` and `search` behave exactly as they do for the findings endpoint, and the workbook contains every matching finding — not just one page.
  - `platform` 'github' | 'gitlab' | 'bitbucket' | 'azure_devops', required: Git platform of the organization
  - `org` string, required: Organization / workspace slug
  - `github_base_url` string: Self-hosted instance URL (also gitlab_base_url / bitbucket_base_url / azure_devops_base_url). Defaults to the cloud host.
  - `filters` HotlistFilters: Values within one dimension are ORed; dimensions are ANDed together. Omit a dimension, or send an empty list, to leave it unfiltered. Use the `facets` of a previous response to discover the values available in your organization.
    - `types` string[]: Scanner that produced the finding.
    - `severities` string[]
    - `locations` string[]: Repository full names, or cloud account identifiers for Infrastructure findings.
    - `ticket_statuses` string[]
    - `assignees` string[]: Assignee email (lowercased) or provider user id, as returned in each finding's `assignee`.
    - `provider_statuses` string[]: Native workflow state names from the linked ticket provider, e.g. `In Progress`.
    - `sla_statuses` string[]
    - `compliance` string[]
    - `validation` string[]: Restrict to findings CodeAnt has actively proven exploitable.
  - `search` string: Case-insensitive substring match over the finding title, identifier, location and file path.

## Response `200`

Workbook generated

- object
  - `status` string
  - `download_url` string: Presigned link to the .xlsx workbook. It needs no authentication and expires after `expires_in` seconds.
  - `expires_in` integer: Lifetime of `download_url`, in seconds.
  - `filename` string
  - `size_bytes` integer
  - `finding_count` integer: Rows written to the workbook.

## Other responses

- `202`: The Hotlist snapshot is still building; retry shortly
- `400`: Invalid filter or search
- `401`: Missing or invalid access token

## Changes

- **2026-11-03** `0eb1442ce49d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/codeant/apis/codeant-ai-api/changes/api/security/hotlist/export/post.md)

---

[API](https://skmtc.dev/codeant/apis/codeant-ai-api.md) - [All operations](https://skmtc.dev/codeant/apis/codeant-ai-api/llms.txt) - [OpenAPI document](https://skmtc.dev/codeant/apis/codeant-ai-api/revisions/0eb1442ce49d?raw)