Get security scan

curl --request GET \
  --url https://app.base44.com/api/apps/{app_id}/security/scan \
  --header 'api_key: <api-key>'

const options = {method: 'GET', headers: {api_key: '<api-key>'}};

fetch('https://app.base44.com/api/apps/{app_id}/security/scan', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/security/scan",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "api_key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/security/scan"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("api_key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/security/scan")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["api_key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "status": "up_to_date",
  "result": {
    "analysis_summary": "The app exposes orders to any signed-in user and has one hardcoded credential.",
    "rls_recommendations": [],
    "hardcoded_secrets": [],
    "backend_functions": [],
    "dependency_vulnerabilities": [],
    "static_code_findings": [],
    "header_recommendations": [],
    "core_integration_recommendation": "compatible",
    "scanned_at": "2026-08-25T14:05:00Z"
  },
  "static_code_enabled": true
}

API Reference

Get security scan

This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.

Returns the app’s latest security scan: what it found, and whether it still reflects the app.

Read status before result. The two are independent, so a result can be present on a status that says it is stale, and absent on one that says a scan is in progress.

The findings are grouped by what the scan looked at. rls_recommendations cover entities whose row-level security is too open, hardcoded_secrets and backend_functions cover the app’s own code and functions, dependency_vulnerabilities cover its npm packages, static_code_findings come from reading the code, and header_recommendations cover the published app’s HTTP headers.

Two of those groups depend on what is switched on for the app rather than on what the scan found. static_code_findings comes back empty unless static_code_enabled is true, and dependency_vulnerabilities is empty for a caller outside that rollout. Both are empty lists rather than absent, so an empty group is not evidence that there is nothing to find, and static_code_enabled is what tells the two apart.

This read never starts a scan. Use Run security scan for that, then poll here while status is pending or scanning. Both mean a scan will settle on its own, so treating only scanning as in progress stops the poll early on a queued scan and reads whatever findings the previous one left.

Findings are only ever as fresh as the scan that produced them. On out_of_date the app has changed since, so treat the findings as a previous snapshot and run a new scan before acting on them.

The response includes fields beyond the ones documented here. Don’t rely on undocumented response fields, as they can change at any time.

GET

api

apps

{app_id}

security

scan

Get security scan

curl --request GET \
  --url https://app.base44.com/api/apps/{app_id}/security/scan \
  --header 'api_key: <api-key>'

const options = {method: 'GET', headers: {api_key: '<api-key>'}};

fetch('https://app.base44.com/api/apps/{app_id}/security/scan', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/security/scan",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "api_key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/security/scan"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("api_key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/security/scan")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["api_key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "status": "up_to_date",
  "result": {
    "analysis_summary": "The app exposes orders to any signed-in user and has one hardcoded credential.",
    "rls_recommendations": [],
    "hardcoded_secrets": [],
    "backend_functions": [],
    "dependency_vulnerabilities": [],
    "static_code_findings": [],
    "header_recommendations": [],
    "core_integration_recommendation": "compatible",
    "scanned_at": "2026-08-25T14:05:00Z"
  },
  "static_code_enabled": true
}

Authorizations

api_key

string

header

required

Personal API key.

Path Parameters

app_id

string

required

ID of the app to scan.

Response

The scan's state and its findings.

The state of an app's security scan, and its findings when it has any.

status

string

required

Where the scan is. up_to_date means result reflects the app as it is now. out_of_date means the app changed since the last scan, so result is stale or absent. none means the app has never been scanned. pending means a scan is queued and scanning means one is running, and both can carry an earlier result while you wait. scan_failed means the last scan died, so run another.

Example:

"up_to_date"

result

SecurityScanFindings · object | null

required

What the scan found, or null when there is nothing to show. It is null on none, and also on out_of_date when the last scan came from a different version of the scanner, in which case only a fresh scan produces findings.

Show child attributes

static_code_enabled

boolean

required

Whether code-reading analysis is switched on for this app (true) or not (false). When it is false, result.static_code_findings comes back as an empty list, so this field is the only way to tell an analysis that found nothing from one that never ran.

Example:

true

App Management API (Beta)

Entities API (Beta)

Virality API (Beta)

Workflows API (Beta)

Analytics API (Beta)

Google Ads API (Beta)

Monitoring API

Audit Logs API

Get security scan

Authorizations

Path Parameters

Response