---
title: "Get security scan"
method: GET
path: "/v1/projects/{project_id}/security-scans/{scan_id}"
tags: ["security-governance"]
---

# Get security scan

`GET /v1/projects/{project_id}/security-scans/{scan_id}`

**Plan:** `Business or higher`

Returns a single security scan invocation with per-scanner run details and findings.

## Path parameters

- `project_id` string, required — Project ID
- `scan_id` string, required — Scan invocation ID from the list endpoint

## Response `200`

OK

- V1GetSecurityScanOutputBody
  - `findings` V1SecurityFinding[], nullable, required — Security findings captured in this scan.
    - `category` string — Finding category.
    - `created_at` string, date-time, required — When this finding was first recorded, UTC.
    - `description` string — Human-readable summary of the finding.
    - `details` string — Raw scanner output (e.g. matched pattern fragments). May be empty due to access restrictions; use 'description' and 'metadata' for the user-facing summary.
    - `finding_id` string, required — Stable identifier for this finding.
    - `first_seen_scan_id` string — Scan invocation ID where this finding was first seen.
    - `level` string, required — error | warn | info
    - `link` string — Link to remediation guidance for this finding.
    - `metadata` object — Scanner-specific metadata (file_path, line_number, package, cve, ...)
    - `name` string, required — Short finding title.
    - `recurrence` integer, required — Number of consecutive scans this finding has appeared in
    - `remediation_difficulty` string — Estimated remediation effort (easy, medium, or hard).
    - `scanner_name` string, required — Name of the scanner that produced this finding.
    - `status` string, required — Finding status. One of: open, fixed, ignored. More values may be added; clients must tolerate unknown values.
    - `updated_at` string, date-time, required — When this finding was last updated, UTC.
  - `scan` V1SecurityScanSummary, required
    - `commit_sha` string — Project commit at scan start
    - `finished_at` string, date-time — When the scan finished, UTC; absent while still running.
    - `requested_scanners` string[], nullable, required — Scanners requested for this invocation
    - `scan_id` string, required — Unique scan invocation ID
    - `started_at` string, date-time, required — When the scan started, UTC.
    - `status` string, required — Scan status. One of: running, completed, failed. More values may be added; clients must tolerate unknown values.
    - `trigger_source` string, required — What triggered the scan. Known values include: workflow, user, ui_auto, aikido_import, app_mcp_deep_auto, hvt_scheduled, workspace_scheduled, enterprise_batch, gitsync_pull. More values may be added; clients must tolerate unknown values.
    - `triggered_by` V1SecurityScanActor, required
      - `email` string — Email of the user actor, when resolvable.
      - `id` string — Lovable user ID when the actor is a user.
      - `name` string — Display name of the user actor, when resolvable.
      - `type` string, required — Actor type. One of: user, system. More values may be added; clients must tolerate unknown values.
  - `scanner_runs` V1SecurityScannerRun[], nullable, required — Per-scanner execution records for this scan.
    - `commit_sha` string — Commit at which this scanner actually ran (may differ from invocation commit on carry-forward)
    - `error_message` string — Error message when the scanner failed.
    - `finished_at` string, date-time — When this scanner finished, UTC; absent while still running.
    - `scanner_name` string, required — Name of the scanner that ran.
    - `scanner_version` string — Version of the scanner that ran.
    - `started_at` string, date-time, required — When this scanner started, UTC.
    - `status` string, required — Scanner run status. One of: succeeded, failed, skipped. More values may be added; clients must tolerate unknown values.

## Other responses

- `401` — Missing or invalid API key.
- `402` — This operation or requested configuration requires a workspace plan that includes this feature.
- `403` — The key or caller lacks the required scope or permission.
- `406` — The Accept header excludes every media type this endpoint produces.
- `429` — Too many requests. Retry after the interval in Retry-After when present.
- `default` — Error. The response body uses the standard error envelope; status matches the HTTP status code and type is a machine-readable error code.

## Changes

- **2026-08-29** `dee6c6545511` — 1 warning
  - removed the optional property `findings/items/connector_id` from the response with the `200` status

[Change history](https://skmtc.dev/lovable/apis/lovable-api/changes/v1/projects/:project_id/security-scans/:scan_id/get.md)

---

[API](https://skmtc.dev/lovable/apis/lovable-api.md) · [All operations](https://skmtc.dev/lovable/apis/lovable-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/lovable/lovable-api/revisions/3bbd591d1876/schema)