curl --request GET \
--url https://api.coderabbit.ai/v1/security/scans/code \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/scans/code"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/scans/code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.coderabbit.ai/v1/security/scans/code",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-coderabbitai-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.coderabbit.ai/v1/security/scans/code"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-coderabbitai-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.coderabbit.ai/v1/security/scans/code")
.header("x-coderabbitai-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.coderabbit.ai/v1/security/scans/code")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-coderabbitai-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "<string>",
"organization_id": "<string>",
"organization_name": "<string>",
"repository_id": "<string>",
"repository_name": "<string>",
"severity": "<string>",
"state": "open",
"cwe": "<string>",
"description": "<string>",
"reachability_call_stack": [
"<string>"
],
"file_path": "<string>",
"start_line": 123,
"end_line": 123,
"scan_provenance": {
"scanId": "<string>",
"scope": {
"primary": {
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
},
"selectedContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"limitations": [
"<string>"
]
},
"evidenceStatus": "available",
"supportingContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"sourceFrames": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>",
"evidenceId": "<string>",
"targetSnapshotId": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"contentHash": "<string>",
"role": "<string>",
"freshness": "<string>"
}
],
"contextCitations": [
{
"repositoryId": "<string>",
"repository": "<string>",
"revision": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"url": "<string>"
}
]
}
}
],
"next_cursor": "<string>"
}AI Deep Scan code findings
Returns cursor-paginated JSON by default. CSV and SARIF formats download the complete repository/scan inventory (up to 50,000 records and 16 MB). Code findings include saved reachability evidence as raw call-stack strings and explanation text. The call-stack array may combine frames from multiple paths; an empty array means no stack was captured, not that the finding is unreachable. Available on all plans with a non-agentic API key and security:read permission. No Security add-on or trial is required. Other APIs retain their existing plan requirements. JSON rows may include scan_provenance with saved scope and evidenceStatus not_loaded. CSV scan_provenance contains compact scanId, primary repositoryId/revision, selectedContextRepositoryIds, and evidenceStatus. SARIF result properties.scanProvenance contains the full provenance, including available evidence. Context repositories do not own findings or coverage.
curl --request GET \
--url https://api.coderabbit.ai/v1/security/scans/code \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/scans/code"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/scans/code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.coderabbit.ai/v1/security/scans/code",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-coderabbitai-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.coderabbit.ai/v1/security/scans/code"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-coderabbitai-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.coderabbit.ai/v1/security/scans/code")
.header("x-coderabbitai-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.coderabbit.ai/v1/security/scans/code")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-coderabbitai-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "<string>",
"organization_id": "<string>",
"organization_name": "<string>",
"repository_id": "<string>",
"repository_name": "<string>",
"severity": "<string>",
"state": "open",
"cwe": "<string>",
"description": "<string>",
"reachability_call_stack": [
"<string>"
],
"file_path": "<string>",
"start_line": 123,
"end_line": 123,
"scan_provenance": {
"scanId": "<string>",
"scope": {
"primary": {
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
},
"selectedContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"limitations": [
"<string>"
]
},
"evidenceStatus": "available",
"supportingContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"sourceFrames": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>",
"evidenceId": "<string>",
"targetSnapshotId": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"contentHash": "<string>",
"role": "<string>",
"freshness": "<string>"
}
],
"contextCitations": [
{
"repositoryId": "<string>",
"repository": "<string>",
"revision": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"url": "<string>"
}
]
}
}
],
"next_cursor": "<string>"
}security:read permission. No Enterprise plan, Security add-on, or Security trial is required. Results are limited to the key’s authorized organization or workspace scope. Other APIs retain their existing plan requirements.
Use this API to integrate existing findings with external security workflows. It does not start scans or change scan billing. The endpoint supports paginated JSON and full-inventory CSV or SARIF downloads.
In CSV exports, the final reachability_call_stack column contains a JSON-encoded array. In SARIF exports, runs[].results[].message.text contains the explanation, and runs[].results[].properties.reachabilityCallStack contains the stack.
For scan setup, finding triage, and export guidance, see the CodeRabbit Security documentation.Authorizations
API key for authentication. You can create an API key from the CodeRabbit dashboard.
Query Parameters
Git-provider organization ID for workspace API keys. Omit for the complete workspace scope.
One exact Git-provider repository ID. It must belong to the authenticated organization scope; response items expose it as repository_id together with organization and repository names.
Historical scan snapshot. By default each repository uses its latest completed scan.
open, fixed, dismissed, all JSON pagination only.
1 <= x <= 1000Opaque next_cursor from the previous JSON response.
json, csv, sarif Was this page helpful?