LOlovable
security-governance

List security scan findings

Changed on

Plan: Business or higher

Scope: projects:read

Returns a page of findings in the scan snapshot, including results reused from earlier scans and findings marked fixed or ignored. Findings are ordered by scanner_name, ascending, with a stable order within each scanner. Follow pagination.next_cursor until pagination.has_more is false to retrieve the complete snapshot.

get/v1/projects/{project_id}/security-scans/{scan_id}/findings

Request

  • Base URL
    https://api.lovable.dev
  • Auth
    • API key in header Lovable-API-Key
    • or HTTP bearer

Path parameters

project_idstring required

Project ID.

Example:prj_01jw3k9m2xq8r5v0c7d4e6f2gh
scan_idstring required

Security scan ID returned by the list endpoint.

Example:a1b2c3d4-e5f6-7890-abcd-ef1234567890

Query parameters

limitinteger

Maximum number of items to return per page.

Example:50
cursorstring

Pass pagination.next_cursor from the previous response to fetch the next page. Omit for the first page; keep the same filters and sort order across pages.

Headers

Lovable-Versionstring

Stable API version to serve, as a YYYY-MM-DD date. Omit for the oldest supported stable version, currently 2026-09-11.

Lovable-Betastring

Comma-separated beta revision strings to enable on top of the stable version.

Response

OK

Example response

{
  "data": [
    {
      "category": "data_exposure",
      "created_at": "2026-01-15T09:30:00Z",
      "description": "A public table has row-level security disabled, exposing all rows to anonymous clients.",
      "id": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
      "level": "error",
      "name": "Row-level security disabled on a public table",
      "scanner_name": "agent_security",
      "status": "open",
      "updated_at": "2026-01-15T09:30:00Z"
    }
  ],
  "pagination": {
    "has_more": true,
    "next_cursor": "eyJ2IjoxLCJpZCI6InByal8wMWp3M2s5In0"
  }
}

Changes

  • a83f0776a896Revision changes
    • warning

      added the new suppressed enum value to the // response property for the response status

    • info

      for the header request parameter Lovable-Version, the format was generalized from date to no format

    • info

      added the non-success response with the status

  • 63e95b862209Revision changes
    • info

      added the non-success response with the status