---
title: "Export findings as SARIF"
method: GET
path: "/api/projects/{projectId}/security/findings/export/sarif"
tags: ["Security"]
---

# Export findings as SARIF

`GET /api/projects/{projectId}/security/findings/export/sarif`

## Request

- Base URL: `https://api.routebase.dev`
- URL: `https://api.routebase.dev/api/projects/{projectId}/security/findings/export/sarif`
- Auth: API key in header `X-API-Key`

Returns the findings of a project as a SARIF 2.1.0 document, which GitHub code
scanning and comparable tools ingest directly. Upload it from your pipeline and
the findings show up next to the code they concern. Without a `status` filter it
returns the open ones, which is what a build gate wants.

## Path parameters

- `ProjectId` string, uuid, required

## Query parameters

- `status` 'open' | 'inProgress' | 'fixed' | 'falsePositive' | 'acceptedRisk' | 'duplicate': Where a finding stands in triage.

## Headers

- `X-RB-Region` string

## Response `200`

The SARIF document.

## Other responses

- `401`: The API key is missing, invalid, expired or revoked. A US organization calling without `X-RB-Region: us` also lands here, because the request reached the wrong region.
- `403`: The key is valid but lacks the permission or the project scope for this call. A scoped key is also refused on organization level operations by design.
- `404`: The resource does not exist, or it belongs to another organization or project. Both cases answer the same way on purpose, so the API cannot be used to probe for foreign identifiers.
- `429`: The rate limit was exceeded. The `Retry-After` header gives the seconds to wait.

---

[API](https://skmtc.dev/routebase/apis/routebase-public-api.md) · [All operations](https://skmtc.dev/routebase/apis/routebase-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/routebase/apis/routebase-public-api/revisions/7187df489f27?raw)