---
title: "Export Code Application Findings report asynchronously (Code - SAST)"
method: POST
path: "/api/v3.0/applications/{applicationUuid}/code/reports/findings"
tags: ["Reports"]
---

# Export Code Application Findings report asynchronously (Code - SAST)

`POST /api/v3.0/applications/{applicationUuid}/code/reports/findings`

## Path parameters

- `applicationUuid` string, required

## Request body

- CreateReportDTO
  - `name` string
  - `format` 'json' | 'html' | 'unknown' | 'xml' | 'excel' | 'yaml' | 'pdf' | 'tv' | 'rdf' | 'csv' | 'sarif' | 'text'
  - `sendEmailNotification` boolean
  - `labelsUuidList` string[] — List of label UUIDs used to scope the report. Pass an empty array ([]) to apply no label filtering (the report then covers the full scope). Note: the placeholder value "string" shown in the example schema is not a valid UUID — passing it (or any non-existent label UUID) matches no labels and produces an empty report.
  - `excludeInactiveProjects` boolean

## Response `200`

OK

- DWRResponseV3ReportExportProcessDTO
  - `supportToken` string
  - `response` ReportExportProcessDTO
    - `uuid` string
    - `name` string
    - `scopeUuid` string
    - `scopeName` string
    - `subScopes` EntityTreeDTO[]
      - `uuid` string
      - `name` string
      - `scopeUuid` string
      - `scopeName` string
    - `title` string
    - `reportType` 'attribution' | 'inventory' | 'vulnerabilities' | 'securityAlerts' | 'sbom' | 'Cbom' | 'securityAlertsLibrary' | 'Compliance' | 'Findings' | 'Suppressions' | 'Resolved' | 'spdx' | 'spdx_2_3' | 'cycloneDX' | 'cycloneDX_1_5' | 'cycloneDX_1_6' | 'dueDiligence' | 'unknown' | 'imgAttribution' | 'imgDueDiligence' | 'imgSpdx' | 'imgSpdx_2_3' | 'imgCycloneDX' | 'imgCycloneDX_1_5' | 'aiInventory' | 'aiFindings' | 'imgCycloneDX_1_6' | 'risk' | 'users' | 'zeroDayCatalog' | 'activityLog'
    - `format` 'json' | 'html' | 'unknown' | 'xml' | 'excel' | 'yaml' | 'pdf' | 'tv' | 'rdf' | 'csv' | 'sarif' | 'text'
    - `scopeType` 'organization' | 'product' | 'project' | 'unsupported' | 'account'
    - `scopeUuidList` string[]
    - `projectUuids` string[]
    - `status` 'PENDING' | 'IN_PROGRESS' | 'FAILED' | 'FAILURE' | 'SUCCESS'
    - `createdBy` string
    - `createdAt` string, date-time
    - `sendEmailNotification` boolean
    - `labelsUuidList` string[]
    - `includeVulnerabilities` boolean
    - `excludeInactiveProjects` boolean

## Other responses

- `400` — Bad Request
- `403` — Forbidden

---

[API](https://skmtc.net/mend/apis/mend-api.md) · [All operations](https://skmtc.net/mend/apis/mend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mend/mend-api/versions/849dfb157abc/schema)