--- title: "List workspace security project inventory" method: GET path: "/v1/workspaces/{workspace_id}/security-center/insights/projects" tags: ["security-governance"] --- # List workspace security project inventory `GET /v1/workspaces/{workspace_id}/security-center/insights/projects` **Plan:** `Enterprise` Returns the review-priority-ranked project inventory for the workspace, sorted by the selected sort_by (default last_edited, or relevance when query is set) with offset-based paging behind the cursor. ## Path parameters - `workspace_id` string, required — Workspace ID ## Query parameters - `limit` integer — Max results per page. - `cursor` string — Opaque cursor from a prior response. Omit on the first page. - `query` string — Free-text search across project name and owner. - `sort_by` 'review_priority_desc' | 'name_asc' | 'name_desc' | 'published_status_asc' | 'published_status_desc' | 'last_edited_asc' | 'last_edited_desc' | 'risk_factors_asc' | 'risk_factors_desc' | 'pii_findings_asc' | 'pii_findings_desc' | 'external_access_asc' | 'external_access_desc' | 'most_edited_24h' | 'most_edited_7d' | 'most_edited_30d' | 'most_visitors_24h' | 'most_visitors_7d' | 'most_visitors_30d' | 'last_scan_desc' | 'last_scan_asc' — Sort axis. When omitted, results sort by last_edited (or by relevance when 'query' is set). - `activity` 'active' | 'inactive' | 'dead' — Activity bucket filter. - `is_published` 'true' | 'false' — Filter by publishing status. Omit for no filter. - `visibility` 'public' | 'private' | 'draft' — Filter by project visibility. - `contains_pii` boolean — Filter to projects flagged with PII. - `has_connectors` boolean — Filter to projects with at least one connector. - `publish_status` string[], nullable — Repeat to include multiple publishing statuses. Omit for all. - `review_priority` string[], nullable — Repeat to include multiple review priorities (needs_review=critical, review_recommended=high+medium, no_review_needed=low+minimal). Unscored projects are not filterable but may appear in results. - `finding_id` string[], nullable — Repeat to filter to projects matching any of the listed catalog findings (e.g. public_pii_exposure, abandoned_published). Unknown finding ids return 400. ## Response `200` OK - V1WorkspaceInsightsProjectsBody - `activity_as_of` V1WorkspaceInsightsActivityFreshness - `edits_as_of` string, date-time — Data horizon for the edit counts. - `visitors_as_of` string, date-time — Data horizon for the visitor counts. - `applied_finding` V1WorkspaceInsightsFinding - `category` string, required — Finding category (e.g. data, access, exposure). - `description` string, required — Human-readable finding description. - `id` string, required — Stable finding-catalog slug (e.g. public_pii_exposure, orphaned_owner). - `project_count` integer, required — Projects matching this finding. - `severity` string, required — Review priority: needs_review | review_recommended | no_review_needed. - `title` string, required — Human-readable finding title. - `as_of` string, date-time — Conservative workspace-wide freshness horizon for the risk rollups; individual project rollups may be newer. - `data` V1WorkspaceInsightsProject[], nullable, required — Items in this page. - `activity_group` string — Activity bucket: active, inactive, or dead. - `connectors` string[], nullable — Configured connector names. - `description` string — User-provided project description. - `display_name` string — Project display name. - `edge_functions` V1WorkspaceInsightsEdgeFunction[], nullable — Deployed edge functions. - `name` string, required — Edge function name. - `edit_count` integer, required — Total edits over the project's lifetime. - `edits_24h` integer, required — Edits in the last 24 hours. - `edits_30d` integer, required — Edits in the last 30 days. - `edits_7d` integer, required — Edits in the last 7 days. - `generated_description` string — AI-generated project description. - `id` string, required — Project ID. - `is_published` boolean — Whether the project is published. - `last_edited_at` string, date-time — When the project was last edited. - `last_security_scan_at` string, date-time — When the project was last security-scanned. - `matched_reason` V1WorkspaceInsightsReason - `category` string, required — Risk-reason category (e.g. data, access, exposure). - `detail` string, required — Human-readable explanation of the risk reason. - `id` string, required — Stable risk-reason slug. - `label` string, required — Human-readable risk-reason label. - `severity` string, required — Review priority: needs_review | review_recommended | no_review_needed. - `values` V1WorkspaceInsightsReasonValues - `connector_count` integer — Number of configured connectors. - `edge_function_count` integer — Number of deployed edge functions. - `error_count` integer — Number of error-level security findings. - `info_count` integer — Number of info-level security findings. - `open_pii_finding_count` integer — Number of open PII findings. - `secret_count` integer — Number of stored project secrets. - `shared_user_count` integer — Number of users the project is shared with. - `warning_count` integer — Number of warning-level security findings. - `message_count` integer, required — Total chat messages in the project. - `name` string — Project name. - `og_image_url` string — Open Graph preview image URL. - `owner` V1WorkspaceInsightsOwner - `display_name` string — Project owner's display name. - `publish_visibility` string — Publishing status: external, workspace, or not_published. - `review_priority` string — Review priority: needs_review, review_recommended, no_review_needed, or unscored. - `review_priority_explanation` V1WorkspaceInsightsReason[], nullable, required — Risk reasons explaining the review priority. - `category` string, required — Risk-reason category (e.g. data, access, exposure). - `detail` string, required — Human-readable explanation of the risk reason. - `id` string, required — Stable risk-reason slug. - `label` string, required — Human-readable risk-reason label. - `severity` string, required — Review priority: needs_review | review_recommended | no_review_needed. - `values` V1WorkspaceInsightsReasonValues - `connector_count` integer — Number of configured connectors. - `edge_function_count` integer — Number of deployed edge functions. - `error_count` integer — Number of error-level security findings. - `info_count` integer — Number of info-level security findings. - `open_pii_finding_count` integer — Number of open PII findings. - `secret_count` integer — Number of stored project secrets. - `shared_user_count` integer — Number of users the project is shared with. - `warning_count` integer — Number of warning-level security findings. - `signals` V1WorkspaceInsightsSignals, required - `chat_attachment_count` integer, required — Number of chat attachments. - `connector_count` integer, required — Number of configured connectors. - `edge_function_count` integer, required — Number of deployed edge functions. - `error_count` integer, required — Number of error-level security findings. - `external_collaborators_known` boolean, required — Whether external-collaborator status could be determined. - `has_chat_attachment` boolean, required — Whether the project has any chat attachments. - `has_external_collaborators` boolean, required — Whether the project has collaborators outside the workspace. - `has_pii` boolean, required — Whether the project has any detected PII. - `has_project_asset` boolean, required — Whether the project has any uploaded assets. - `has_project_secret` boolean, required — Whether the project stores any secrets. - `info_count` integer, required — Number of info-level security findings. - `is_orphaned` boolean, required — Whether the project has no active owner. - `is_public_published` boolean, required — Whether the project is published to a public (external) audience. - `is_published` boolean, required — Whether the project is published. - `lovable_cloud_enabled` boolean, required — Whether Lovable Cloud (Supabase) is enabled for the project. - `open_pii_finding_count` integer, required — Number of open PII findings. - `overshared` boolean, required — Whether the project is shared more broadly than recommended. - `project_asset_count` integer, required — Number of uploaded project assets. - `project_secret_count` integer, required — Number of stored project secrets. - `shared_user_count` integer, required — Number of users the project is shared with. - `supabase_auth_providers` string[], nullable — Enabled Supabase auth providers. - `supabase_rls_enabled_table_count` integer — Number of Supabase tables with row-level security enabled. - `supabase_signals_fetched_at` string, date-time — When the Supabase signals were last fetched. - `supabase_storage_bucket_count` integer — Number of Supabase storage buckets. - `supabase_table_count` integer — Number of Supabase database tables. - `supply_chain_error_count` integer, required — Number of error-level supply-chain findings. - `supply_chain_info_count` integer, required — Number of info-level supply-chain findings. - `supply_chain_warning_count` integer, required — Number of warning-level supply-chain findings. - `warning_count` integer, required — Number of warning-level security findings. - `url` string — Live project preview URL. - `visibility` string — Project visibility: public, private, or draft. - `visitors_24h` integer, required — Unique visitors in the last 24 hours. - `visitors_30d` integer, required — Unique visitors in the last 30 days. - `visitors_7d` integer, required — Unique visitors in the last 7 days. - `pagination` Pagination, required - `has_more` boolean, required — Whether more results are available beyond this page - `next_cursor` string, nullable, required — Cursor for the next page; null when there are no more results - `total` integer, required — Total matching projects across all pages. ## Other responses - `401` — Missing or invalid API key. - `402` — This operation or requested configuration requires a workspace plan that includes this feature. - `403` — The key or caller lacks the required scope or permission. - `406` — The Accept header excludes every media type this endpoint produces. - `429` — Too many requests. Retry after the interval in Retry-After when present. - `default` — Error. The response body uses the standard error envelope; status matches the HTTP status code and type is a machine-readable error code. ## Changes - **2026-08-13** `7fd7141a8e7c` — 1 info - endpoint added [Change history](https://skmtc.dev/lovable/apis/lovable-api/changes/v1/workspaces/:workspace_id/security-center/insights/projects/get.md) --- [API](https://skmtc.dev/lovable/apis/lovable-api.md) · [All operations](https://skmtc.dev/lovable/apis/lovable-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/lovable/lovable-api/revisions/3bbd591d1876/schema)