---
title: "Generate a security report"
method: POST
path: "/api/v2/reports/generate"
tags: ["Reports"]
---

# Generate a security report

`POST /api/v2/reports/generate`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/reports/generate`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Initiate asynchronous generation of a security report for a specific scan. The report captures vulnerability findings from the scan in the requested format (DOCX, CSV, SARIF, or SBOM). Generation happens in the background — the response includes a reportId for tracking. Use this to produce downloadable security assessment documents, export findings for compliance workflows, or generate SBOMs for software supply chain transparency. Requires scanId, repositoryId, and repositoryName; all other parameters have sensible defaults.

## Request body

- ReportsGenerateRequest: Input for initiating security report generation for a scan. The report is generated asynchronously — the response contains a reportId that can be used to poll for completion.
  - `organizationId` string: Organization that owns the repository and scan. If omitted, the organization is resolved from the authenticated caller.
  - `scanId` string, required: The ID of the scan to generate a report for. This determines which vulnerability findings are included in the report. Use `scans.list` to find available scan IDs.
  - `repositoryId` string, required: The ID of the repository that was scanned. Use `repositories.list` to find available repository IDs.
  - `repositoryName` string, required: The human-readable name of the repository (e.g. "my-org/my-repo"). Used as the title in generated reports.
  - `threshold` number: Minimum severity score threshold (0-100). Only vulnerabilities with a score at or above this threshold are included in the report. Defaults to 0 (include all).
  - `issueTypes` string[]: Which issue lifecycle states to include in the report. Defaults to `["open"]` (only open/unresolved issues). Pass `["open", "closed"]` to include resolved issues as well.
  - `reportFormat` 'docx' | 'csv' | 'sarif' | 'sbom': Output format for the report. "docx" produces a Word document with a full security assessment narrative. "csv" produces a tabular spreadsheet of findings. "sarif" produces a SARIF v2.1.0 file for integration with code scanning tools. "sbom" produces a CycloneDX JSON software bill of materials. Defaults to "docx".

## Response `200`

Report generation initiated successfully

- ReportsGenerateResponse: Response after initiating report generation.
  - `reportId` string, required: Unique identifier for the generated report. Use this to check report status or download the report once complete.
  - `status` 'pending' | 'processing' | 'completed' | 'failed', required: Current status of the report. Will be "pending" immediately after initiation. Transitions through "processing" to "completed" or "failed" once the asynchronous generation job finishes.
  - `stagedJobId` string: Job ID for SBOM reports. Only present when reportFormat is "sbom".
  - `message` string, required: Human-readable status message describing the outcome of the initiation request.

## Other responses

- `400`: Error Response
- `401`: Error Response
- `404`: Error Response
- `412`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)