> ## Documentation Index > Fetch the complete documentation index at: https://docs.base44.com/llms.txt > Use this file to discover all available pages before exploring further. # Get security scan findings > Returns the sanitized findings and section coverage for one security scan referenced by an `app.security.check_run` audit event. See [Security scan findings](/developers/references/audit-logs-api/get-started/security-scan-findings) for the retrieval flow and how to interpret coverage. ## OpenAPI ````yaml /developers/references/audit-logs-api/audit-logs-openapi.json get /{workspace_id}/security-scan-runs/{run_id} openapi: 3.1.0 info: title: Base44 Audit Logs API description: > Workspace-scoped audit logs API for security monitoring and SIEM integrations. Returns sanitized audit events across all apps in a workspace with filtering, sorting, and cursor-based pagination. Security scan events can link to a sanitized, ownership-scoped findings response. **Authentication:** Pass a workspace API key with the `audit_logs:read` scope in the `api_key` header. **Endpoints:** - `POST /{workspace_id}/list` - `GET /{workspace_id}/security-scan-runs/{run_id}` --- ### Filtering & Sorting (first request) On the **first** request (no cursor), you may include any combination of: | Parameter | Type | Description | |-----------|------|-------------| | `app_id` | string | Narrow results to a single app | | `event_types` | list[string] | Filter by one or more event types | | `user_email` | string | Filter by user email | | `status` | string | Filter by status (`success` / `failure`) | | `start_date` | datetime | Include events from this date (inclusive) | | `end_date` | datetime | Include events until this date (exclusive) | | `order` | `ASC` or `DESC` | Sort by timestamp (default: `DESC`) | | `limit` | integer (1–1000) | Events per page (default: `50`) | --- ### Cursor Pagination This API uses **opaque cursor-based pagination**. The cursor encodes the original query (filters, sort, and limit) so the server can resume exactly where it left off. **How to paginate:** 1. **First page:** send your filters, sort, and limit — no `cursor`. 2. **Check the response:** `pagination.next_cursor` contains the cursor for the next page. When it is `null`, there are no more pages. 3. **Next pages:** send **only** `{"cursor": ""}`. **Do not** include `app_id`, `event_types`, `user_email`, `status`, `start_date`, `end_date`, `order`, or `limit` — these are already encoded in the cursor. The server returns HTTP 400 if any filter, sort, or limit parameter is provided alongside a cursor. **Cursor expiry:** cursors are valid for **24 hours** from creation. An expired cursor returns HTTP 400. --- ### Response Shape ```json { "events": [ { "timestamp", "user_email", "workspace_id", "app_id", "ip", "user_agent", "event_type", "status", "error_code", "metadata" } ], "pagination": { "total": 1234, "next_cursor": "..." } } ``` --- ### Rate Limits - 100 requests per minute per API key (enterprise workspaces get 2×) version: 1.0.0 servers: - url: https://app.base44.com/api/v1/audit-logs description: Audit Logs API security: - ApiKeyAuth: [] tags: - name: audit-logs description: >- Query audit events and retrieve sanitized findings for a referenced security scan run. paths: /{workspace_id}/security-scan-runs/{run_id}: get: tags: - audit-logs summary: Get security scan findings description: >- Returns the sanitized findings and section coverage for one security scan referenced by an `app.security.check_run` audit event. See [Security scan findings](/developers/references/audit-logs-api/get-started/security-scan-findings) for the retrieval flow and how to interpret coverage. operationId: >- get_security_scan_run_public__workspace_id__security_scan_runs__run_id__get parameters: - name: workspace_id in: path required: true schema: type: string title: Workspace Id - name: run_id in: path required: true schema: type: string description: >- Security scan run ID from the `run_id` field of an `app.security.check_run` audit event. title: Run Id description: >- Security scan run ID from the `run_id` field of an `app.security.check_run` audit event. responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/SecurityScanRunResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: SecurityScanRunResponse: properties: run_id: type: string title: Run Id description: Identifier of the security scan run. example: 6886b8d390dc7e2f4a2c91b3 app_id: type: string title: App Id description: App the scan ran against. example: 6820f3a4e7b91d003c45a1f2 workspace_id: type: string title: Workspace Id description: Workspace that owns the run. example: 67f2c8e01a3b5d004e92d7a1 created_date: type: string format: date-time title: Created Date description: When the scan ran, in `YYYY-MM-DDTHH:MM:SSZ` format (UTC). example: '2026-07-26T14:32:17Z' coverage: $ref: '#/components/schemas/SecurityScanCoverageResponse' description: >- Per-section outcome. A section's empty findings array is a clean result only when its coverage is `completed`. rls_recommendations: items: $ref: '#/components/schemas/RLSFindingResponse' type: array title: Rls Recommendations description: Row-level security recommendations. Unscored. hardcoded_secrets: items: $ref: '#/components/schemas/HardcodedSecretFindingResponse' type: array title: Hardcoded Secrets description: >- Hardcoded-secret findings. Unscored; secret values are never returned. backend_functions: items: $ref: '#/components/schemas/BackendFunctionFindingResponse' type: array title: Backend Functions description: Backend-function authorization issues. Unscored. dependency_vulnerabilities: items: $ref: '#/components/schemas/DependencyFindingResponse' type: array title: Dependency Vulnerabilities description: Dependency vulnerabilities. May carry a scanner-provided severity. static_code_findings: items: $ref: '#/components/schemas/StaticCodeFindingResponse' type: array title: Static Code Findings description: >- Static code analysis findings. May carry a scanner-provided severity. additionalProperties: false type: object required: - run_id - app_id - workspace_id - created_date - coverage title: SecurityScanRunResponse HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError SecurityScanCoverageResponse: properties: rls: type: string enum: - completed - failed - not_run - unknown title: Rls description: >- Outcome of the RLS section. Only `completed` means an empty findings array is a clean result. example: completed hardcoded_secrets: type: string enum: - completed - failed - not_run - unknown title: Hardcoded Secrets description: Outcome of the hardcoded-secrets section. example: completed backend_functions: type: string enum: - completed - failed - not_run - unknown title: Backend Functions description: Outcome of the backend-functions section. example: completed dependency_vulnerabilities: type: string enum: - completed - failed - not_run - unknown title: Dependency Vulnerabilities description: Outcome of the dependency-vulnerabilities section. example: completed static_code: type: string enum: - completed - failed - not_run - unknown title: Static Code description: Outcome of the static-code section. example: completed additionalProperties: false type: object required: - rls - hardcoded_secrets - backend_functions - dependency_vulnerabilities - static_code title: SecurityScanCoverageResponse RLSFindingResponse: properties: entity_name: type: string title: Entity Name description: Entity the recommendation applies to. example: Invoices description: type: string title: Description description: Recommended row-level security change. example: Restrict reads to records owned by the authenticated app member. additionalProperties: false type: object required: - entity_name - description title: RLSFindingResponse HardcodedSecretFindingResponse: properties: file_path: type: string title: File Path description: Path of the file containing the potential secret. example: src/lib/payments.ts description: type: string title: Description description: Fixed message; secret values and matching text are never returned. example: Potential hardcoded secret detected. additionalProperties: false type: object required: - file_path - description title: HardcodedSecretFindingResponse BackendFunctionFindingResponse: properties: file_path: type: string title: File Path description: Path of the backend function file. example: functions/exportInvoices.ts issue_description: type: string title: Issue Description description: Authorization issue found in the function. example: >- The function does not verify an authenticated app member before exporting data. additionalProperties: false type: object required: - file_path - issue_description title: BackendFunctionFindingResponse DependencyFindingResponse: properties: package_name: type: string title: Package Name description: Name of the vulnerable dependency. example: example-parser current_version: type: string title: Current Version description: Version currently in use. example: 2.4.0 fixed_version: anyOf: - type: string - type: 'null' title: Fixed Version description: >- First version that resolves the vulnerability, or `null` if none is available. example: 2.4.3 vulnerability_id: type: string title: Vulnerability Id description: Public advisory identifier. example: CVE-2026-12345 severity: anyOf: - type: string enum: - critical - high - medium - low - type: 'null' title: Severity description: Scanner-provided severity, or `null` when unscored. example: high summary: type: string title: Summary description: Short description of the vulnerability. example: Malformed input can cause excessive resource consumption. additionalProperties: false type: object required: - package_name - current_version - fixed_version - vulnerability_id - severity - summary title: DependencyFindingResponse StaticCodeFindingResponse: properties: title: type: string title: Title description: Short title of the finding. example: Unvalidated redirect target severity: anyOf: - type: string enum: - critical - high - medium - low - type: 'null' title: Severity description: Scanner-provided severity, or `null` when unscored. example: medium confidence: anyOf: - type: string enum: - high - medium - low - type: 'null' title: Confidence description: Scanner confidence in the finding, or `null` when unavailable. example: high category: type: string title: Category description: Finding category. example: open_redirect file_path: type: string title: File Path description: Path of the file the finding is in. example: src/pages/Login.tsx line: anyOf: - type: integer - type: 'null' title: Line description: 1-based line number, or `null` when not applicable. example: 48 impact: type: string title: Impact description: Potential impact of the finding. example: An attacker could redirect a person to an untrusted site. recommendation: type: string title: Recommendation description: Recommended remediation. example: Allow only application-owned redirect destinations. standards: items: $ref: '#/components/schemas/StaticCodeStandardResponse' type: array title: Standards description: Related security standards, when available. additionalProperties: false type: object required: - title - severity - confidence - category - file_path - line - impact - recommendation title: StaticCodeFindingResponse ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type type: object required: - loc - msg - type title: ValidationError StaticCodeStandardResponse: properties: framework: type: string title: Framework description: Standards framework. example: CWE id: type: string title: Id description: Identifier within the framework. example: '601' name: type: string title: Name description: Human-readable name of the standard. example: URL Redirection to Untrusted Site additionalProperties: false type: object required: - framework - id - name title: StaticCodeStandardResponse securitySchemes: ApiKeyAuth: type: apiKey in: header name: api_key description: >- API key for authentication. See the Authentication page for your API for details on how to get your key. ````