curl --request GET \
--url https://api.coderabbit.ai/v1/security/scans/code \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/scans/code"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/scans/code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.coderabbit.ai/v1/security/scans/code",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-coderabbitai-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.coderabbit.ai/v1/security/scans/code"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-coderabbitai-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.coderabbit.ai/v1/security/scans/code")
.header("x-coderabbitai-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.coderabbit.ai/v1/security/scans/code")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-coderabbitai-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "<string>",
"organization_id": "<string>",
"organization_name": "<string>",
"repository_id": "<string>",
"repository_name": "<string>",
"severity": "<string>",
"state": "open",
"cwe": "<string>",
"description": "<string>",
"reachability_call_stack": [
"<string>"
],
"file_path": "<string>",
"start_line": 123,
"end_line": 123,
"scan_provenance": {
"scanId": "<string>",
"scope": {
"primary": {
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
},
"selectedContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"limitations": [
"<string>"
],
"linkedContext": {
"status": "unavailable",
"reason": "denied"
}
},
"evidenceStatus": "available",
"supportingContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"sourceFrames": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>",
"evidenceId": "<string>",
"targetSnapshotId": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"contentHash": "<string>",
"role": "<string>",
"freshness": "<string>"
}
],
"coverageScope": {
"kind": "repository"
},
"contextCitations": [
{
"repositoryId": "<string>",
"repository": "<string>",
"revision": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"url": "<string>"
}
]
}
}
],
"next_cursor": "<string>",
"metadata": {
"ai_generated": {
"version": 1,
"generator": "CodeRabbit"
}
}
}List or export AI Deep Scan code findings
Returns cursor-paginated JSON by default. CSV and SARIF formats download the complete repository/scan inventory (up to 50,000 records and 16 MB). Code findings include saved reachability evidence as raw call-stack strings and explanation text. The call-stack array may combine frames from multiple paths; an empty array means no stack was captured, not that the finding is unreachable. Available on all plans with a non-agentic API key and security:read permission. No Security add-on or trial is required. Other APIs retain their existing plan requirements. JSON rows may include scan_provenance with saved scope, coverageScope, and evidenceStatus not_loaded. CSV scan_provenance contains compact scanId, coverageScope, primary repositoryId/revision, selectedContextRepositoryIds, and evidenceStatus. SARIF result properties.scanProvenance contains the full provenance, including available evidence. coverageScope distinguishes repository, selected directories, or unavailable metadata independently from execution completion. Context repositories do not own findings or coverage.
curl --request GET \
--url https://api.coderabbit.ai/v1/security/scans/code \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/scans/code"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/scans/code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.coderabbit.ai/v1/security/scans/code",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-coderabbitai-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.coderabbit.ai/v1/security/scans/code"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-coderabbitai-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.coderabbit.ai/v1/security/scans/code")
.header("x-coderabbitai-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.coderabbit.ai/v1/security/scans/code")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-coderabbitai-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "<string>",
"organization_id": "<string>",
"organization_name": "<string>",
"repository_id": "<string>",
"repository_name": "<string>",
"severity": "<string>",
"state": "open",
"cwe": "<string>",
"description": "<string>",
"reachability_call_stack": [
"<string>"
],
"file_path": "<string>",
"start_line": 123,
"end_line": 123,
"scan_provenance": {
"scanId": "<string>",
"scope": {
"primary": {
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
},
"selectedContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"limitations": [
"<string>"
],
"linkedContext": {
"status": "unavailable",
"reason": "denied"
}
},
"evidenceStatus": "available",
"supportingContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"sourceFrames": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>",
"evidenceId": "<string>",
"targetSnapshotId": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"contentHash": "<string>",
"role": "<string>",
"freshness": "<string>"
}
],
"coverageScope": {
"kind": "repository"
},
"contextCitations": [
{
"repositoryId": "<string>",
"repository": "<string>",
"revision": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"url": "<string>"
}
]
}
}
],
"next_cursor": "<string>",
"metadata": {
"ai_generated": {
"version": 1,
"generator": "CodeRabbit"
}
}
}Authorizations
API key for authentication. You can create an API key from the CodeRabbit dashboard.
Query Parameters
Git-provider organization ID for workspace API keys. Omit for the complete workspace scope.
One exact Git-provider repository ID. It must belong to the authenticated organization scope; response items expose it as repository_id together with organization and repository names.
Historical scan snapshot. By default each repository uses its latest completed scan.
open, fixed, dismissed, all JSON pagination only.
1 <= x <= 1000Opaque next_cursor from the previous JSON response.
json, csv, sarif Response
Paginated JSON or a full-inventory download.
Was this page helpful?