---
title: "List security scans"
method: GET
path: "/v1/projects/{project_id}/security-scans"
tags: ["security-governance"]
---

# List security scans

`GET /v1/projects/{project_id}/security-scans`

**Plan:** `Business or higher`

Returns the project's security scan invocations, newest first.

## Path parameters

- `project_id` string, required — Project ID

## Query parameters

- `limit` integer — Page size (max 100)
- `cursor` string — Opaque cursor from a prior response

## Response `200`

OK

- CursorListResponseV1SecurityScanSummary
  - `data` V1SecurityScanSummary[], nullable, required
    - `commit_sha` string — Project commit at scan start
    - `finished_at` string, date-time
    - `requested_scanners` string[], nullable, required — Scanners requested for this invocation
    - `scan_id` string, required — Unique scan invocation ID
    - `started_at` string, date-time, required
    - `status` string, required — Scan status. One of: running, completed, failed. More values may be added; clients must tolerate unknown values.
    - `trigger_source` string, required — What triggered the scan. Known values include: workflow, aikido_import, app_mcp_deep_auto. More values may be added; clients must tolerate unknown values.
    - `triggered_by` V1SecurityScanActor, required
      - `email` string — Email of the user actor, when resolvable.
      - `id` string — Lovable user ID when the actor is a user.
      - `name` string — Display name of the user actor, when resolvable.
      - `type` string, required — Actor type. One of: user, system. More values may be added; clients must tolerate unknown values.
  - `pagination` Pagination, required
    - `has_more` boolean, required — Whether more results are available beyond this page
    - `next_cursor` string, nullable, required — Cursor for the next page; null when there are no more results

## Other responses

- `401` — Missing or invalid API key.
- `402` — This operation or requested configuration requires a workspace plan that includes this feature.
- `403` — The key or caller lacks the required scope or permission.
- `406` — The Accept header excludes every media type this endpoint produces.
- `429` — Too many requests. Retry after the interval in Retry-After when present.
- `default` — Error. The response body uses the standard error envelope; status matches the HTTP status code and type is a machine-readable error code.

---

[API](https://skmtc.net/lovable/apis/lovable-api.md) · [All operations](https://skmtc.net/lovable/apis/lovable-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lovable/lovable-api/revisions/aa8d44585147/schema)