---
title: "List or export Deep Scan code findings"
method: GET
path: "/v1/security/scans/code"
tags: ["Security"]
---

# List or export Deep Scan code findings

`GET /v1/security/scans/code`

## Request

- Base URL: `https://api.coderabbit.ai`
- URL: `https://api.coderabbit.ai/v1/security/scans/code`
- Auth: API key in header `x-coderabbitai-api-key`

Returns cursor-paginated JSON by default. CSV and SARIF formats download the complete repository/scan inventory (up to 50,000 records and 16 MB). Code findings include saved reachability evidence as raw call-stack strings and explanation text. The call-stack array may combine frames from multiple paths; an empty array means no stack was captured, not that the finding is unreachable. Available on all plans with a non-agentic API key and security:read permission. No Security add-on or trial is required. Other APIs retain their existing plan requirements. JSON rows may include scan_provenance with saved scope, coverageScope, and evidenceStatus not_loaded. CSV scan_provenance contains compact scanId, coverageScope, primary repositoryId/revision, selectedContextRepositoryIds, and evidenceStatus. SARIF result properties.scanProvenance contains the full provenance, including available evidence. coverageScope distinguishes repository, selected directories, or unavailable metadata independently from execution completion. Context repositories do not own findings or coverage.

## Query parameters

- `org_id` string
- `repo_id` string
- `scan_id` string, uuid
- `state` 'open' | 'fixed' | 'dismissed' | 'all'
- `limit` integer
- `cursor` string
- `format` 'json' | 'csv' | 'sarif'

## Response `200`

Paginated JSON or a full-inventory download.

- object
  - `data` SecurityCodeFinding[], required
    - `id` string, required
    - `organization_id` string, required: Git-provider organization ID.
    - `organization_name` string, required
    - `repository_id` string, required: Git-provider repository ID.
    - `repository_name` string, required
    - `severity` string, required
    - `state` 'open' | 'fixed' | 'dismissed', required
    - `cwe` string, nullable, required
    - `description` string, required: Saved finding explanation as raw text.
    - `reachability_call_stack` string[], required: Stored human-readable reachability evidence captured for the finding. The array may combine and deduplicate frames from multiple paths, so it does not guarantee one source-to-sink order or a stable frame grammar. An empty array means no stack was captured; it does not mean the finding is unreachable.
    - `file_path` string, required
    - `start_line` integer, required
    - `end_line` integer, required
    - `scan_provenance` SecurityFindingProvenance: Optional scan provenance. Nested fields use camelCase. Linked repositories provide context; finding ownership and coverage remain with the primary repository. Paginated JSON does not load evidence: evidenceStatus is not_loaded, supportingContext is null, and sourceFrames is empty.
      - `scanId` string, required
      - `coverageScope` union: Saved coverage selection, independent of completion and linked context. Missing or unavailable metadata must never be interpreted as repository coverage.
        - object
          - `kind` 'repository', required
        - object
          - `kind` 'directories', required
          - `directories` string[], required
        - object
          - `kind` 'unavailable', required
      - `contextCitations` object[]
        - `repositoryId` string, required
        - `repository` string, required
        - `revision` string, required
        - `path` string, required
        - `startLine` integer, nullable, required
        - `endLine` integer, nullable, required
        - `url` string, uri, required
      - `scope` object, required
        - `primary` SecurityProvenanceRepository, required
          - `repositoryId` string, required
          - `provider` string, nullable, required
          - `host` string, nullable, required
          - `revision` string, nullable, required
        - `selectedContext` SecurityProvenanceRepository[], required
          - `repositoryId` string, required
          - `provider` string, nullable, required
          - `host` string, nullable, required
          - `revision` string, nullable, required
        - `limitations` string[], required
        - `linkedContext` object: Present when selected linked repositories were unavailable at scan time and the scan covered the primary repository only.
          - `status` 'unavailable', required
          - `reason` 'denied' | 'unavailable' | 'limit_exceeded', required
      - `evidenceStatus` 'available' | 'unavailable' | 'not_loaded', required
      - `supportingContext` SecurityProvenanceRepository[], nullable, required
        - `repositoryId` string, required
        - `provider` string, nullable, required
        - `host` string, nullable, required
        - `revision` string, nullable, required
      - `sourceFrames` object[], required
        - `repositoryId` string, required
        - `provider` string, nullable, required
        - `host` string, nullable, required
        - `revision` string, nullable, required
        - `evidenceId` string, required
        - `targetSnapshotId` string, required
        - `path` string, required
        - `startLine` integer, required
        - `endLine` integer, required
        - `contentHash` string, required
        - `role` string, required
        - `freshness` string, required
  - `next_cursor` string, nullable, required
  - `metadata` object: Present only when this page contains populated LLM-generated description or call-stack text. This is a response-level provenance assertion, not attribution of every finding or field.
    - `ai_generated` object, required
      - `version` 1, required
      - `generator` 'CodeRabbit', required

## Other responses

- `400`: Invalid parameter or cursor.
- `401`: Invalid or inactive API key.
- `403`: Forbidden key type, missing security:read, or repository outside scope.
- `410`: Legacy organization API keys are no longer accepted.
- `413`: More than 50,000 records or more than 16 MB. Narrow with repo_id or scan_id.
- `429`: Rate limit exceeded.
- `500`: Internal server error.

## Changes

- **2026-11-06** `a9e20f8748a9`: 3 info
  - added the optional property `data/items/scan_provenance/coverageScope` to the response with the `200` status
  - added the optional property `data/items/scan_provenance/scope/linkedContext` to the response with the `200` status
  - added the optional property `metadata` to the response with the `200` status
- **2026-09-30** `04c944348fd0`: 3 info
  - added the optional property `data/items/scan_provenance` to the response with the `200` status
  - added the required property `data/items/description` to the response with the `200` status
  - added the required property `data/items/reachability_call_stack` to the response with the `200` status
- **2026-08-31** `342932e3f001`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/coderabbit/apis/coderabbit-api-spec/changes/v1/security/scans/code/get.md)

---

[API](https://skmtc.dev/coderabbit/apis/coderabbit-api-spec.md) - [All operations](https://skmtc.dev/coderabbit/apis/coderabbit-api-spec/llms.txt) - [OpenAPI document](https://skmtc.dev/coderabbit/apis/coderabbit-api-spec/revisions/a9e20f8748a9?raw)