> ## Documentation Index > Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt > Use this file to discover all available pages before exploring further. # List or export Bug Scan findings > Returns one repository's Bug Scan findings from its latest completed scan, or from scan_id. Cursor-paginated JSON by default; CSV and SARIF 2.1.0 download every matching finding of the scan (up to 50,000 records and 16 MB). Findings are in the scan's rank order. Each finding carries its fingerprint, severity, category, location, every location it applies to, explanation, the prompt for AI agents, the verifier's account, and its state (open, fixed or dismissed) with the dismiss reason. Requires a non-agentic API key with bug_scan:read permission, and Bug Scan enabled for the organization; other organizations receive 403 BUG_SCAN_NOT_ENABLED. ## OpenAPI ````yaml /openapi.json get /v1/bug-scan/findings openapi: 3.0.3 info: title: CodeRabbit API spec version: 1.0.0 servers: - url: https://api.coderabbit.ai security: - ApiKeyAuth: [] paths: /v1/bug-scan/findings: get: tags: - Bug Scan summary: List or export Bug Scan findings description: >- Returns one repository's Bug Scan findings from its latest completed scan, or from scan_id. Cursor-paginated JSON by default; CSV and SARIF 2.1.0 download every matching finding of the scan (up to 50,000 records and 16 MB). Findings are in the scan's rank order. Each finding carries its fingerprint, severity, category, location, every location it applies to, explanation, the prompt for AI agents, the verifier's account, and its state (open, fixed or dismissed) with the dismiss reason. Requires a non-agentic API key with bug_scan:read permission, and Bug Scan enabled for the organization; other organizations receive 403 BUG_SCAN_NOT_ENABLED. operationId: bug-scan-findings-list parameters: - in: query name: org_id required: false schema: type: string description: >- Git-provider organization ID for workspace API keys. Omit for the complete workspace scope. - in: query name: repo_id required: true schema: type: string description: >- One exact Git-provider repository ID in the authenticated organization scope. - in: query name: scan_id required: false schema: type: string format: uuid description: >- A completed scan of the repository. Defaults to the latest completed scan. - in: query name: severity required: false schema: type: string enum: - critical - major - minor - trivial - in: query name: limit required: false schema: type: integer minimum: 1 maximum: 1000 default: 100 description: JSON page size. - in: query name: cursor required: false schema: type: string description: >- next_cursor from the previous JSON page. A cursor stays on the scan it was issued for. - in: query name: format schema: type: string enum: - json - csv - sarif default: json responses: '200': description: Paginated JSON or a full-scan download. content: application/json: schema: type: object required: - data - next_cursor - scan properties: data: type: array items: type: object required: - state - dismiss_reason properties: id: type: string format: uuid fingerprint: type: string nullable: true severity: type: string enum: - critical - major - minor - trivial category: type: string nullable: true path: type: string nullable: true start_line: type: integer nullable: true end_line: type: integer nullable: true locations: type: array description: >- Every location the finding applies to, the anchor first (role anchor), then each other site (role sibling), in this file or another. Empty when the finding has no path or line. items: type: object required: - path - start_line - end_line - role properties: path: type: string start_line: type: integer end_line: type: integer role: type: string enum: - anchor - sibling explanation: type: string agent_prompt: type: string nullable: true verification: type: object properties: status: type: string enum: - verified - unverified result: type: string nullable: true evidence: type: string rank: type: integer nullable: true state: type: string enum: - open - fixed - dismissed dismiss_reason: type: string nullable: true description: >- false_positive, wont_fix, accepted_risk or other; null unless state is dismissed. organization_id: type: string organization_name: type: string repository_id: type: string repository_name: type: string scan_id: type: string format: uuid next_cursor: type: string nullable: true scan: type: object nullable: true properties: id: type: string format: uuid head_commit: type: string nullable: true completed_at: type: string format: date-time nullable: true partial_coverage: type: boolean description: >- True when the scan did not cover the whole repository (its completeness verdict is incomplete). A scan that recorded no verdict reports its legacy partial flag. text/csv: schema: type: string format: binary application/sarif+json: schema: type: string format: binary '400': description: >- Invalid parameter or cursor, or a repo_id held by more than one workspace organization (AMBIGUOUS_REPOSITORY: pass org_id). '401': description: Invalid or inactive API key. '403': description: >- Forbidden key type, missing bug_scan:read, Bug Scan not enabled, or repository outside scope. '404': description: scan_id is not a completed scan of the repository. '410': description: Legacy organization API keys are no longer accepted. '413': description: >- More than 50,000 records or more than 16 MB. Narrow with severity or reduce limit. '429': description: Rate limit exceeded. '500': description: Internal server error. components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-coderabbitai-api-key description: >- API key for authentication. You can create an API key from the CodeRabbit dashboard. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.