---
title: "Get security scan"
method: GET
path: "/v1/projects/{project_id}/security-scans/{scan_id}"
tags: ["security-governance"]
---

# Get security scan

`GET /v1/projects/{project_id}/security-scans/{scan_id}`

**Plan:** `Business or higher`

Returns a single security scan invocation with per-scanner run details and findings.

## Path parameters

- `project_id` string, required — Project ID
- `scan_id` string, required — Scan invocation ID from the list endpoint

## Response `200`

OK

- V1GetSecurityScanOutputBody
  - `findings` V1SecurityFinding[], nullable, required
    - `category` string
    - `connector_id` string
    - `created_at` string, date-time, required
    - `description` string
    - `details` string — Raw scanner output (e.g. matched pattern fragments). May be empty due to access restrictions; use 'description' and 'metadata' for the user-facing summary.
    - `finding_id` string, required
    - `first_seen_scan_id` string
    - `level` string, required — error | warn | info
    - `link` string
    - `metadata` object — Scanner-specific metadata (file_path, line_number, package, cve, ...)
    - `name` string, required
    - `recurrence` integer, required — Number of consecutive scans this finding has appeared in
    - `remediation_difficulty` string
    - `scanner_name` string, required
    - `status` string, required — Finding status. One of: open, fixed, ignored. More values may be added; clients must tolerate unknown values.
    - `updated_at` string, date-time, required
  - `scan` V1SecurityScanSummary, required
    - `commit_sha` string — Project commit at scan start
    - `finished_at` string, date-time
    - `requested_scanners` string[], nullable, required — Scanners requested for this invocation
    - `scan_id` string, required — Unique scan invocation ID
    - `started_at` string, date-time, required
    - `status` string, required — Scan status. One of: running, completed, failed. More values may be added; clients must tolerate unknown values.
    - `trigger_source` string, required — What triggered the scan. Known values include: workflow, aikido_import, app_mcp_deep_auto. More values may be added; clients must tolerate unknown values.
    - `triggered_by` V1SecurityScanActor, required
      - `email` string — Email of the user actor, when resolvable.
      - `id` string — Lovable user ID when the actor is a user.
      - `name` string — Display name of the user actor, when resolvable.
      - `type` string, required — Actor type. One of: user, system. More values may be added; clients must tolerate unknown values.
  - `scanner_runs` V1SecurityScannerRun[], nullable, required
    - `commit_sha` string — Commit at which this scanner actually ran (may differ from invocation commit on carry-forward)
    - `error_message` string
    - `finished_at` string, date-time
    - `scanner_name` string, required
    - `scanner_version` string
    - `started_at` string, date-time, required
    - `status` string, required — Scanner run status. One of: succeeded, failed, skipped. More values may be added; clients must tolerate unknown values.

## Other responses

- `401` — Missing or invalid API key.
- `402` — This operation or requested configuration requires a workspace plan that includes this feature.
- `403` — The key or caller lacks the required scope or permission.
- `406` — The Accept header excludes every media type this endpoint produces.
- `429` — Too many requests. Retry after the interval in Retry-After when present.
- `default` — Error. The response body uses the standard error envelope; status matches the HTTP status code and type is a machine-readable error code.

---

[API](https://skmtc.net/lovable/apis/lovable-api.md) · [All operations](https://skmtc.net/lovable/apis/lovable-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lovable/lovable-api/revisions/aa8d44585147/schema)