Skip to main content
GET
List or export AI Deep Scan code findings
The AI Deep Scan code findings API is available on all plans with a non-agentic API key and the security:read permission. No Enterprise plan, Security add-on, or Security trial is required. Results are limited to the key’s authorized organization or workspace scope. Other APIs retain their existing plan requirements. Use this API to integrate existing findings with external security workflows. It does not start scans or change scan billing. The endpoint supports paginated JSON and full-inventory CSV or SARIF downloads. In CSV exports, the final reachability_call_stack column contains a JSON-encoded array. In SARIF exports, runs[].results[].message.text contains the explanation, and runs[].results[].properties.reachabilityCallStack contains the stack. For scan setup, finding triage, and export guidance, see the CodeRabbit Security documentation.

Authorizations

x-coderabbitai-api-key
string
header
required

API key for authentication. You can create an API key from the CodeRabbit dashboard.

Query Parameters

org_id
string

Git-provider organization ID for workspace API keys. Omit for the complete workspace scope.

repo_id
string

One exact Git-provider repository ID. It must belong to the authenticated organization scope; response items expose it as repository_id together with organization and repository names.

scan_id
string<uuid>

Historical scan snapshot. By default each repository uses its latest completed scan.

state
enum<string>
default:open
Available options:
open,
fixed,
dismissed,
all
limit
integer
default:1000

JSON pagination only.

Required range: 1 <= x <= 1000
cursor
string

Opaque next_cursor from the previous JSON response.

format
enum<string>
default:json
Available options:
json,
csv,
sarif

Response

Paginated JSON or a full-inventory download.

data
object[]
required
next_cursor
string | null
required