> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Deep Scan code findings

> Returns cursor-paginated JSON by default. CSV and SARIF formats download the complete repository/scan inventory (up to 50,000 records and 16 MB). Requires Enterprise, the Security add-on, and security:read.

export const EnterprisePlanBadge = ({tip = "This feature is available exclusively as part of the Enterprise plan. Please refer to our pricing page for more information about our plans and features.", title = "Enterprise Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
  return <Tooltip tip={tip} cta={cta} href={href}>
        <Badge icon="building-2" disabled={disabled || undefined}>
            {title}
        </Badge>
    </Tooltip>;
};

<EnterprisePlanBadge tip="This API requires the Enterprise plan and an active Security add-on." cta="View Security requirements" href="/security-agent#access-and-billing" />

Use a non-agentic API key with the `security:read` permission to integrate AI Deep Scan code findings with external security workflows. The endpoint supports paginated JSON and full-inventory CSV or SARIF downloads.

For scan setup, finding triage, and export guidance, see the [Security Agent documentation](/security-agent).


## OpenAPI

````yaml get /v1/security/scans/code
openapi: 3.0.3
info:
  title: CodeRabbit API spec
  version: 1.0.0
servers:
  - url: https://api.coderabbit.ai
security:
  - ApiKeyAuth: []
paths:
  /v1/security/scans/code:
    get:
      tags:
        - Security
      summary: List or export AI Deep Scan code findings
      description: >-
        Returns cursor-paginated JSON by default. CSV and SARIF formats download
        the complete repository/scan inventory (up to 50,000 records and 16 MB).
        Requires Enterprise, the Security add-on, and security:read.
      operationId: security-scans-code-list
      parameters:
        - $ref: '#/components/parameters/SecurityOrgId'
        - $ref: '#/components/parameters/SecurityRepoId'
        - $ref: '#/components/parameters/SecurityScanId'
        - $ref: '#/components/parameters/SecurityCodeState'
        - $ref: '#/components/parameters/SecurityLimit'
        - $ref: '#/components/parameters/SecurityCursor'
        - in: query
          name: format
          schema:
            type: string
            enum:
              - json
              - csv
              - sarif
            default: json
      responses:
        '200':
          description: Paginated JSON or a full-inventory download.
          content:
            application/json:
              schema:
                type: object
                required:
                  - data
                  - next_cursor
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SecurityCodeFinding'
                  next_cursor:
                    type: string
                    nullable: true
            text/csv:
              schema:
                type: string
                format: binary
            application/sarif+json:
              schema:
                type: string
                format: binary
        '400':
          description: Invalid parameter or cursor.
        '401':
          description: Invalid or inactive API key.
        '403':
          description: >-
            Enterprise or Security add-on required, forbidden key type, missing
            security:read, or repository outside scope.
        '410':
          description: Legacy organization API keys are no longer accepted.
        '413':
          description: >-
            More than 50,000 records or more than 16 MB. Narrow with repo_id or
            scan_id.
        '429':
          description: Rate limit exceeded.
        '500':
          description: Internal server error.
components:
  parameters:
    SecurityOrgId:
      in: query
      name: org_id
      required: false
      schema:
        type: string
      description: >-
        Git-provider organization ID for workspace API keys. Omit for the
        complete workspace scope.
    SecurityRepoId:
      in: query
      name: repo_id
      required: false
      schema:
        type: string
      description: >-
        One exact Git-provider repository ID. It must belong to the
        authenticated organization scope; response items expose it as
        repository_id together with organization and repository names.
    SecurityScanId:
      in: query
      name: scan_id
      required: false
      schema:
        type: string
        format: uuid
      description: >-
        Historical scan snapshot. By default each repository uses its latest
        completed scan.
    SecurityCodeState:
      in: query
      name: state
      required: false
      schema:
        type: string
        enum:
          - open
          - fixed
          - dismissed
          - all
        default: open
    SecurityLimit:
      in: query
      name: limit
      required: false
      schema:
        type: integer
        minimum: 1
        maximum: 1000
        default: 1000
      description: JSON pagination only.
    SecurityCursor:
      in: query
      name: cursor
      required: false
      schema:
        type: string
      description: Opaque next_cursor from the previous JSON response.
  schemas:
    SecurityCodeFinding:
      type: object
      required:
        - id
        - organization_id
        - organization_name
        - repository_id
        - repository_name
        - severity
        - state
        - cwe
        - file_path
        - start_line
        - end_line
      properties:
        id:
          type: string
        organization_id:
          type: string
          description: Git-provider organization ID.
        organization_name:
          type: string
        repository_id:
          type: string
          description: Git-provider repository ID.
        repository_name:
          type: string
        severity:
          type: string
        state:
          type: string
          enum:
            - open
            - fixed
            - dismissed
        cwe:
          type: string
          nullable: true
        file_path:
          type: string
        start_line:
          type: integer
        end_line:
          type: integer
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-coderabbitai-api-key
      description: >-
        API key for authentication. You can create an API key from the
        CodeRabbit dashboard.

````