---
title: "List or export Bug Scan findings"
method: GET
path: "/v1/bug-scan/findings"
tags: ["Bug Scan"]
---

# List or export Bug Scan findings

`GET /v1/bug-scan/findings`

## Request

- Base URL: `https://api.coderabbit.ai`
- URL: `https://api.coderabbit.ai/v1/bug-scan/findings`
- Auth: API key in header `x-coderabbitai-api-key`

Returns one repository's Bug Scan findings from its latest completed scan, or from scan_id. Cursor-paginated JSON by default; CSV and SARIF 2.1.0 download every matching finding of the scan (up to 50,000 records and 16 MB). Findings are in the scan's rank order. Each finding carries its fingerprint, severity, category, location, every location it applies to, explanation, the prompt for AI agents, the verifier's account, and its state (open, fixed or dismissed) with the dismiss reason. Requires a non-agentic API key with bug_scan:read permission, and Bug Scan enabled for the organization; other organizations receive 403 BUG_SCAN_NOT_ENABLED.

## Query parameters

- `org_id` string
- `repo_id` string, required
- `scan_id` string, uuid
- `severity` 'critical' | 'major' | 'minor' | 'trivial'
- `limit` integer
- `cursor` string
- `format` 'json' | 'csv' | 'sarif'

## Response `200`

Paginated JSON or a full-scan download.

- object
  - `data` object[], required
    - `id` string, uuid
    - `fingerprint` string, nullable
    - `severity` 'critical' | 'major' | 'minor' | 'trivial'
    - `category` string, nullable
    - `path` string, nullable
    - `start_line` integer, nullable
    - `end_line` integer, nullable
    - `locations` object[]: Every location the finding applies to, the anchor first (role anchor), then each other site (role sibling), in this file or another. Empty when the finding has no path or line.
      - `path` string, required
      - `start_line` integer, required
      - `end_line` integer, required
      - `role` 'anchor' | 'sibling', required
    - `explanation` string
    - `agent_prompt` string, nullable
    - `verification` object
      - `status` 'verified' | 'unverified'
      - `result` string, nullable
      - `evidence` string
    - `rank` integer, nullable
    - `state` 'open' | 'fixed' | 'dismissed', required
    - `dismiss_reason` string, nullable, required: false_positive, wont_fix, accepted_risk or other; null unless state is dismissed.
    - `organization_id` string
    - `organization_name` string
    - `repository_id` string
    - `repository_name` string
    - `scan_id` string, uuid
  - `next_cursor` string, nullable, required
  - `scan` object, nullable, required
    - `id` string, uuid
    - `head_commit` string, nullable
    - `completed_at` string, date-time, nullable
    - `partial_coverage` boolean: True when the scan did not cover the whole repository (its completeness verdict is incomplete). A scan that recorded no verdict reports its legacy partial flag.

## Other responses

- `400`: Invalid parameter or cursor, or a repo_id held by more than one workspace organization (AMBIGUOUS_REPOSITORY: pass org_id).
- `401`: Invalid or inactive API key.
- `403`: Forbidden key type, missing bug_scan:read, Bug Scan not enabled, or repository outside scope.
- `404`: scan_id is not a completed scan of the repository.
- `410`: Legacy organization API keys are no longer accepted.
- `413`: More than 50,000 records or more than 16 MB. Narrow with severity or reduce limit.
- `429`: Rate limit exceeded.
- `500`: Internal server error.

## Changes

- **2026-11-06** `a9e20f8748a9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/coderabbit/apis/coderabbit-api-spec/changes/v1/bug-scan/findings/get.md)

---

[API](https://skmtc.dev/coderabbit/apis/coderabbit-api-spec.md) - [All operations](https://skmtc.dev/coderabbit/apis/coderabbit-api-spec/llms.txt) - [OpenAPI document](https://skmtc.dev/coderabbit/apis/coderabbit-api-spec/revisions/a9e20f8748a9?raw)