---
title: "Get latest profile scan result"
method: GET
path: "/api/v1/app/{appId}/profile/results"
tags: ["Profile Scans"]
---

# Get latest profile scan result

`GET /api/v1/app/{appId}/profile/results`

Retrieves the most recent profile scan result for an application with testability analysis.


> Requires `read:scan` permission.

## Path parameters

- `appId` string, uuid, required

## Response `200`

OK

- ScanresultsProfileScanResult
  - `assets` ScanresultsAssetInventory
    - `assetSummary` ScanresultsAssetSummary — Asset summary categorized by security relevance
      - `dynamicContent` ScanresultsAssetCategoryCount
        - `count` integer
        - `sampleUrls` string[]
        - `totalSizeBytes` integer
      - `scripts` ScanresultsAssetCategoryCount
        - `count` integer
        - `sampleUrls` string[]
        - `totalSizeBytes` integer
      - `staticMedia` ScanresultsAssetCategoryCount
        - `count` integer
        - `sampleUrls` string[]
        - `totalSizeBytes` integer
    - `buildStrategy` 'BUILD_SINGLE_BUNDLE' | 'BUILD_VENDOR_APP_SPLIT' | 'BUILD_CODE_SPLIT_OPTIMIZED' | 'BUILD_STRATEGY_UNKNOWN' — Build analysis
    - `optimizationNotes` string[]
    - `totalAssets` integer — Summary
    - `totalSizeBytes` integer
  - `authConfigPresent` boolean
  - `authMarkers` ScanresultsAuthMarker[] — Authentication markers detected
    - `confidence` 'AUTH_CONFIDENCE_LOW' | 'AUTH_CONFIDENCE_MEDIUM' | 'AUTH_CONFIDENCE_HIGH'
    - `evidence` string
    - `signals` ScanresultsAuthSignal[]
      - `detail` string
      - `signalType` 'SIGNAL_PATH_PATTERN' | 'SIGNAL_STATUS_CODE_401_403' | 'SIGNAL_REDIRECT_TO_AUTH' | 'SIGNAL_LOGIN_FORM_DETECTED' | 'SIGNAL_OAUTH_PROMPT' | 'SIGNAL_SESSION_COOKIE' | 'SIGNAL_WWW_AUTHENTICATE' | 'SIGNAL_CSRF_TOKEN'
    - `type` 'AUTH_LOGIN_FORM' | 'AUTH_REDIRECT_TO_AUTH' | 'AUTH_SESSION_COOKIE' | 'AUTH_OAUTH_ENDPOINT' | 'AUTH_WWW_AUTHENTICATE' | 'AUTH_PROTECTED_ENDPOINT'
  - `classification` 'APP_SPA_WITH_AUTH' | 'APP_API_WITH_AUTH' | 'APP_PUBLIC_WEBSITE' | 'APP_STATIC_SITE' | 'APP_CLASSIFICATION_UNKNOWN' — Application classification
  - `discoveredOpenapiSpecPath` string — Path where OpenAPI/Swagger spec was discovered (e.g., "/api/v3/api-docs") Empty if no spec was discovered
  - `paths` ScanresultsPathDiscovery
    - `authProtectedCount` integer
    - `dynamicCount` integer
    - `samplesAuthProtected` ScanresultsPathInfo[]
      - `authEvidence` string
      - `method` string
      - `url` string
    - `samplesDynamic` ScanresultsPathInfo[]
      - `authEvidence` string
      - `method` string
      - `url` string
    - `samplesStatic` ScanresultsPathInfo[] — Sample paths (up to 10 each for UI display)
      - `authEvidence` string
      - `method` string
      - `url` string
    - `staticCount` integer
    - `total` integer — Total counts
  - `recommendations` string[] — Actionable recommendations
  - `scanId` string
  - `score` 'TESTABILITY_HIGH' | 'TESTABILITY_MEDIUM' | 'TESTABILITY_LOW' — Testability assessment
  - `scoreReasons` string[]
  - `timestamp` integer

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.net/stackhawk/apis/stackhawk-public-api.md) · [All operations](https://skmtc.net/stackhawk/apis/stackhawk-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stackhawk/stackhawk-public-api/revisions/ad3dfd54cb63/schema)