---
title: "List security scan findings"
method: GET
path: "/v1/projects/{project_id}/security-scans/{scan_id}/findings"
tags: ["security-governance"]
---

# List security scan findings

`GET /v1/projects/{project_id}/security-scans/{scan_id}/findings`

## Request

- Base URL: `https://api.lovable.dev`
- URL: `https://api.lovable.dev/v1/projects/{project_id}/security-scans/{scan_id}/findings`
- Auth: one of:
  - API key in header `Lovable-API-Key`
  - HTTP bearer

**Plan:** `Business or higher`

**Scope:** `projects:read`

Returns a page of findings in the scan snapshot, including results reused from earlier scans and findings marked fixed or ignored. Findings are ordered by scanner_name, ascending, with a stable order within each scanner. Follow pagination.next_cursor until pagination.has_more is false to retrieve the complete snapshot.

## Path parameters

- `project_id` string, required: Project ID.
- `scan_id` string, required: Security scan ID returned by the list endpoint.

## Query parameters

- `limit` integer: Maximum number of items to return per page.
- `cursor` string: Pass pagination.next_cursor from the previous response to fetch the next page. Omit for the first page; keep the same filters and sort order across pages.

## Headers

- `Lovable-Version` string
- `Lovable-Beta` string

## Response `200`

OK

- SecurityFindingPage
  - `data` SecurityFinding[], required: Items in this page. Empty when there are none.
    - `category` string, nullable, required: Finding category; null when the scanner reports none.
    - `created_at` string, date-time, required: When this finding was first recorded, UTC.
    - `description` string, nullable, required: Human-readable summary of the finding; null when the scanner reports none.
    - `id` string, required: Stable identifier for this finding.
    - `level` 'error' | 'warn' | 'info', required: Severity reported by the scanner. More values may be added; clients must tolerate unknown values.
    - `name` string, required: Short finding title.
    - `scanner_name` string, required: Name of the scanner that produced this finding.
    - `status` 'open' | 'fixed' | 'ignored' | 'suppressed', required: Review state of the security finding. suppressed means every deep-scan check the finding cites is turned off for the project: hidden, not resolved. More values may be added; clients must tolerate unknown values.
    - `updated_at` string, date-time, required: When this finding was last updated, UTC.
  - `pagination` Pagination, required
    - `has_more` boolean, required: Whether more results are available beyond this page.
    - `next_cursor` string, nullable, required: Pass this value as the cursor query parameter to fetch the next page. Treat it as an opaque string; null when there are no more results.

## Other responses

- `400`: The request body or parameters are malformed or fail validation. Each failing field is listed in errors.
- `401`: Missing or invalid API key, session token, or OAuth access token.
- `402`: Public API access requires Business or higher. Some operations or configurations require an additional feature entitlement.
- `403`: The key or caller lacks the required scope or permission. For email_not_verified, verify the account email before retrying.
- `404`: The project does not exist, has been deleted, or is not accessible to the authenticated client. The security scan may also be missing or belong to another project.
- `406`: The Accept header excludes every media type this endpoint produces.
- `429`: Too many requests. Retry after the interval in Retry-After when present.
- `503`: The service is temporarily unavailable, or the processing deadline expired (request_timeout). A mutation may still complete; check resource state before retrying.
- `default`: Error. The response body uses the standard error envelope; status matches the HTTP status code and type is a machine-readable error code.

## Changes

- **2026-09-18** `a83f0776a896`: 1 warning, 2 info
  - added the new `suppressed` enum value to the `data/items/status` response property for the response status `200`
  - for the `header` request parameter `Lovable-Version`, the format was generalized from `date` to no format
  - added the non-success response with the status `503`
- **2026-09-17** `63e95b862209`: 1 info
  - added the non-success response with the status `404`
- **2026-09-16** `1eba97261efb`: 1 breaking, 1 info
  - removed the required property `data/items/finding_id` from the response with the `200` status
  - added the required property `data/items/id` to the response with the `200` status
- **2026-09-15** `82dda6df74b8`: 30 breaking, 37 info
  - the response property `data/items/category` became nullable for the status `200`
  - the response property `data/items/description` became nullable for the status `200`
  - the response property `detail` became nullable for the status `400`
  - the response property `detail` became nullable for the status `401`
  - …63 more
- **2026-09-14** `8539cafd5cb6`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/lovable/apis/lovable-api/changes/v1/projects/:project_id/security-scans/:scan_id/findings/get.md)

---

[API](https://skmtc.dev/lovable/apis/lovable-api.md) - [All operations](https://skmtc.dev/lovable/apis/lovable-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lovable/apis/lovable-api/revisions/ed671816c468?raw)