LOlovable
security-governance

List workspace security project inventory

Changed on

Plan: Enterprise

Scope: workspaces:read

Returns workspace projects with review priorities, security finding counts, activity counts, and publishing details. Use GET /v1/projects/{project_id}/security-scans/{scan_id}/findings for individual findings. Supports search and filters. By default, projects are ordered by most recently edited, or search relevance when query is set. Project and membership data is eventually consistent and may not immediately reflect recent changes.

get/v1/workspaces/{workspace_id}/security-center/insights/projects

Request

  • Base URL
    https://api.lovable.dev
  • Auth
    • API key in header Lovable-API-Key
    • or HTTP bearer

Path parameters

workspace_idstring required

Workspace ID.

Example:workspace_01jw3k9m2xq8r5v0c7d4e6f2gh

Query parameters

limitinteger

Maximum number of items to return per page.

Example:50
cursorstring

Pass pagination.next_cursor from the previous response to fetch the next page. Omit for the first page; keep the same filters and sort order across pages.

querystring

Free-text search across project name and owner. Terms shorter than 3 characters are ignored. A full project ID matches that project exactly.

Example:landing
sort_by'relevance' | 'review_priority' | 'name' | 'publish_audience' | 'last_edited_at' | 'risk_factor_count' | 'open_pii_finding_count' | 'external_access_rank' | 'edits_24h' | 'edits_7d' | 'edits_30d' | 'visitors_24h' | 'visitors_7d' | 'visitors_30d' | 'last_security_scan_at'

Sort field. Omit for the default order: most recently edited first, or best matches first when query is set. Ties break by project id unless noted. review_priority: unscored projects last in both directions, ties by risk score. name: projects without a name first ascending and last descending. publish_audience: ranks not published, then workspace, custom, public. last_edited_at: falls back to the last update time. risk_factor_count, open_pii_finding_count, external_access_rank: missing counts as 0, ties by name; external_access_rank ranks external collaborators above shared users, publicly published apps, then none; open_pii_finding_count returns 402 when personal data detection is not available on the workspace plan. edits_* and visitors_*: missing counts as 0. last_security_scan_at: never scanned last in both directions. relevance: requires query, ties by last update time.

Example:review_priority
sort_order'asc' | 'desc'

Direction for sort_by. Defaults to descending. Requires sort_by.

Example:desc
activity_groupstring[]

Filter by the activity_group field: time since the last edit, or last update for projects never edited, using 14-day and 60-day boundaries. Repeat to match any value. Omit for no filter.

[
  "last_14_days"
]
is_publishedboolean

Filter by whether the project is published. Omit for no filter.

Example:true
visibilitystring[]

Filter by the visibility field. Repeat to match any of the values. Omit for no filter.

[
  "workspace_edit"
]
has_piiboolean

Filter by the has_pii signal. false selects projects without detected personal data. Omit for no filter. Returns 402 when personal data detection is not available on the workspace plan.

has_connectorsboolean

Filter by whether the project has a connected service. false selects projects without one. Omit for no filter.

Example:true
publish_audiencestring[]

Filter published projects by the publish_audience field. Repeat to match any value. Omit for no filter. Requires is_published to be true or omitted.

[
  "workspace"
]
review_prioritystring[]

Filter by Security Center review priority. Repeat to match any selected priority; unscored matches projects not yet scored. Omit to include every project.

[
  "needs_review"
]
finding_type_idstring[]

Finding type IDs returned by GET /v1/workspaces/{workspace_id}/security-center/insights. Finding filters use the same category rules as project_count in that response. A project matching a more specific related type is excluded from the broader type. Repeat to match any selected type. Unknown IDs return 400. Types that depend on personal data detection return 402 when that feature is not available on the workspace plan.

[
  "public_security_exposure"
]
folder_idstring[]

Filter by the folder_id field: projects placed directly in the folder, not those in folders nested inside it. Repeat to match any of the folders, for example a folder and its children from GET /v1/workspaces/{workspace_id}/folders. Omit for no filter.

[
  "fold_01jw3k9m2xq8r5v0c7d4e6f2gh"
]
is_in_folderboolean

Filter by whether the project is in a folder. false selects projects whose folder_id is null. Omit for no filter. Cannot be false when folder_id is set.

Example:true

Headers

Lovable-Versionstring

Stable API version to serve, as a YYYY-MM-DD date. Omit for the oldest supported stable version, currently 2026-09-11.

Lovable-Betastring

Comma-separated beta revision strings to enable on top of the stable version.

Response

OK

as_ofstring date-time nullable required

Timestamp indicating the freshness of workspace review-priority data. Individual projects may have newer results. Null when unavailable; not a security scan completion time.

totalinteger required

Total matching projects across all pages.

Example response

{
  "activity_as_of": {
    "edits_as_of": "2026-01-15T09:30:00Z",
    "visitors_as_of": "2026-01-15T09:30:00Z"
  },
  "applied_finding": {
    "category": "exposure",
    "description": "Publicly published projects with error-level security findings.",
    "id": "public_security_exposure",
    "project_count": 12,
    "review_priority": "needs_review",
    "title": "Public app with security errors"
  },
  "as_of": "2026-01-15T09:30:00Z",
  "data": [
    {
      "activity_group": "last_14_days",
      "connectors": [
        "supabase",
        "stripe"
      ],
      "description": "A single-page marketing site with a hero, feature grid, and signup form.",
      "edge_functions": [
        {
          "name": "send-welcome-email"
        }
      ],
      "edit_count": 128,
      "edits_24h": 4,
      "edits_30d": 67,
      "edits_7d": 21,
      "folder_id": "fold_01jw3k9m2xq8r5v0c7d4e6f2gh",
      "id": "prj_01jw3k9m2xq8r5v0c7d4e6f2gh",
      "is_published": true,
      "last_edited_at": "2026-01-15T09:30:00Z",
      "last_security_scan_at": "2026-01-15T09:30:00Z",
      "matched_reason": {
        "category": "data",
        "detail": "A public table exposes personal data to anonymous callers.",
        "id": "public_pii_exposure",
        "label": "Public PII exposure",
        "review_priority": "needs_review",
        "values": {
          "connector_count": 2,
          "edge_function_count": 3,
          "error_count": 2,
          "info_count": 8,
          "open_pii_finding_count": 3,
          "secret_count": 4,
          "shared_user_count": 6,
          "warning_count": 5
        }
      },
      "message_count": 56,
      "name": "Acme Landing Page",
      "owner": {
        "display_name": "Jane Cooper"
      },
      "publish_audience": "public",
      "review_priority": "needs_review",
      "review_priority_explanation": [
        {
          "category": "data",
          "detail": "A public table exposes personal data to anonymous callers.",
          "id": "public_pii_exposure",
          "label": "Public PII exposure",
          "review_priority": "needs_review"
        }
      ],
      "url": "https://acme-landing-page.lovable.app",
      "visibility": "workspace_edit",
      "visitors_24h": 35,
      "visitors_30d": 840,
      "visitors_7d": 210
    }
  ],
  "pagination": {
    "has_more": true,
    "next_cursor": "eyJ2IjoxLCJpZCI6InByal8wMWp3M2s5In0"
  },
  "total": 42
}

Changes

  • 247d08b1bc5bRevision changes
    • info

      added the new optional query request parameter folder_id

    • info

      added the new optional query request parameter is_in_folder

    • info

      added the required property // to the response with the status

  • a83f0776a896Revision changes
    • breaking

      removed the required property ///// from the response with the status

    • breaking

      removed the required property /////// from the response with the status

    • breaking

      removed the required property //// from the response with the status

    • info

      for the header request parameter Lovable-Version, the format was generalized from date to no format

    • info

      added the non-success response with the status

    • info

      added the required property ///// to the response with the status

    • info

      added the required property /////// to the response with the status

    • info

      added the required property //// to the response with the status