Run security scan

curl --request POST \
  --url https://app.base44.com/api/apps/{app_id}/security/scan \
  --header 'api_key: <api-key>'

const options = {method: 'POST', headers: {api_key: '<api-key>'}};

fetch('https://app.base44.com/api/apps/{app_id}/security/scan', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/security/scan",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "api_key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/security/scan"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("api_key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/security/scan")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["api_key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "status": "up_to_date",
  "result": {
    "analysis_summary": "The app exposes orders to any signed-in user and has one hardcoded credential.",
    "rls_recommendations": [],
    "hardcoded_secrets": [],
    "backend_functions": [],
    "dependency_vulnerabilities": [],
    "static_code_findings": [],
    "header_recommendations": [],
    "core_integration_recommendation": "compatible",
    "scanned_at": "2026-08-25T14:05:00Z"
  },
  "static_code_enabled": true
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

API Reference

Run security scan

This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.

Scans the app for security problems and returns the findings.

The response is the same shape as Get security scan, and which of two things you get depends on whether Base44 already has a current answer:

If the last scan still matches the app, you get it straight back with status set to up_to_date, and the X-Scan-Source response header set to cache. Nothing is re-scanned.
Otherwise a scan starts in the background and you get status set to scanning with the previous findings still in result, and X-Scan-Source set to async. Poll Get security scan while status is pending or scanning, since both mean a scan is still going to settle.

So a 200 here does not mean a scan ran, and it does not mean the findings in the body are current. Read status and the X-Scan-Source header to tell the two apart.

A real scan reads the app’s code and runs a language model over it, which takes a while and is why it runs in the background rather than on your connection. This endpoint is limited to 5 requests per minute.

Findings are only ever as fresh as the scan that produced them. On out_of_date the app has changed since, so treat the findings as a previous snapshot and run a new scan before acting on them.

The response includes fields beyond the ones documented here. Don’t rely on undocumented response fields, as they can change at any time.

POST

api

apps

{app_id}

security

scan

Run security scan

curl --request POST \
  --url https://app.base44.com/api/apps/{app_id}/security/scan \
  --header 'api_key: <api-key>'

const options = {method: 'POST', headers: {api_key: '<api-key>'}};

fetch('https://app.base44.com/api/apps/{app_id}/security/scan', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/security/scan",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "api_key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://app.base44.com/api/apps/{app_id}/security/scan"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("api_key", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://app.base44.com/api/apps/{app_id}/security/scan")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["api_key"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "status": "up_to_date",
  "result": {
    "analysis_summary": "The app exposes orders to any signed-in user and has one hardcoded credential.",
    "rls_recommendations": [],
    "hardcoded_secrets": [],
    "backend_functions": [],
    "dependency_vulnerabilities": [],
    "static_code_findings": [],
    "header_recommendations": [],
    "core_integration_recommendation": "compatible",
    "scanned_at": "2026-08-25T14:05:00Z"
  },
  "static_code_enabled": true
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

Authorizations

api_key

string

header

required

Personal API key.

Path Parameters

app_id

string

required

ID of the app to scan.

Query Parameters

language

enum<string>

default:en

Language to return generated text in, as a lowercase two-letter code. An unsupported value is rejected with a 422.

Available options:

en,

ja,

de,

es,

fr,

pt

Response

The findings, or the state of the scan that just started.

The state of an app's security scan, and its findings when it has any.

status

string

required

Where the scan is. up_to_date means result reflects the app as it is now. out_of_date means the app changed since the last scan, so result is stale or absent. none means the app has never been scanned. pending means a scan is queued and scanning means one is running, and both can carry an earlier result while you wait. scan_failed means the last scan died, so run another.

Example:

"up_to_date"

result

SecurityScanFindings · object | null

required

What the scan found, or null when there is nothing to show. It is null on none, and also on out_of_date when the last scan came from a different version of the scanner, in which case only a fresh scan produces findings.

Show child attributes

static_code_enabled

boolean

required

Whether code-reading analysis is switched on for this app (true) or not (false). When it is false, result.static_code_findings comes back as an empty list, so this field is the only way to tell an analysis that found nothing from one that never ran.

Example:

true

App Management API (Beta)

Entities API (Beta)

Virality API (Beta)

Workflows API (Beta)

Analytics API (Beta)

Google Ads API (Beta)

Monitoring API

Audit Logs API

Run security scan

Authorizations

Path Parameters

Query Parameters

Response