curl --request GET \
--url https://api.coderabbit.ai/v1/security/scans/code \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/scans/code"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/scans/code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"data": [
{
"id": "<string>",
"organization_id": "<string>",
"organization_name": "<string>",
"repository_id": "<string>",
"repository_name": "<string>",
"severity": "<string>",
"state": "open",
"publication_status": "published",
"cwe": "<string>",
"description": "<string>",
"reachability_call_stack": [
"<string>"
],
"file_path": "<string>",
"start_line": 123,
"end_line": 123,
"scan_provenance": {
"scanId": "<string>",
"scope": {
"primary": {
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
},
"selectedContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"limitations": [
"<string>"
],
"linkedContext": {
"status": "unavailable",
"reason": "denied"
}
},
"evidenceStatus": "available",
"supportingContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"sourceFrames": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>",
"evidenceId": "<string>",
"targetSnapshotId": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"contentHash": "<string>",
"role": "<string>",
"freshness": "<string>"
}
],
"coverageScope": {
"kind": "repository"
},
"contextCitations": [
{
"repositoryId": "<string>",
"repository": "<string>",
"revision": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"url": "<string>"
}
]
}
}
],
"next_cursor": "<string>",
"metadata": {
"ai_generated": {
"version": 1,
"generator": "CodeRabbit"
}
}
}List or export AI Deep Scan code findings
Returns cursor-paginated JSON by default. CSV and SARIF formats download the complete repository/scan inventory (up to 50,000 records and 16 MB). Code findings include saved reachability evidence as raw call-stack strings and explanation text. The call-stack array may combine frames from multiple paths; an empty array means no stack was captured, not that the finding is unreachable. Available on all plans with a non-agentic API key and security:read permission. No Security add-on or trial is required. Other APIs retain their existing plan requirements. JSON rows may include scan_provenance with saved scope, coverageScope, and evidenceStatus not_loaded. CSV scan_provenance contains compact scanId, coverageScope, primary repositoryId/revision, selectedContextRepositoryIds, and evidenceStatus. SARIF result properties.scanProvenance contains the full provenance, including available evidence. coverageScope distinguishes repository, selected directories, or unavailable metadata independently from execution completion. Context repositories do not own findings or coverage.
curl --request GET \
--url https://api.coderabbit.ai/v1/security/scans/code \
--header 'x-coderabbitai-api-key: <api-key>'import requests
url = "https://api.coderabbit.ai/v1/security/scans/code"
headers = {"x-coderabbitai-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-coderabbitai-api-key': '<api-key>'}};
fetch('https://api.coderabbit.ai/v1/security/scans/code', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"data": [
{
"id": "<string>",
"organization_id": "<string>",
"organization_name": "<string>",
"repository_id": "<string>",
"repository_name": "<string>",
"severity": "<string>",
"state": "open",
"publication_status": "published",
"cwe": "<string>",
"description": "<string>",
"reachability_call_stack": [
"<string>"
],
"file_path": "<string>",
"start_line": 123,
"end_line": 123,
"scan_provenance": {
"scanId": "<string>",
"scope": {
"primary": {
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
},
"selectedContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"limitations": [
"<string>"
],
"linkedContext": {
"status": "unavailable",
"reason": "denied"
}
},
"evidenceStatus": "available",
"supportingContext": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>"
}
],
"sourceFrames": [
{
"repositoryId": "<string>",
"provider": "<string>",
"host": "<string>",
"revision": "<string>",
"evidenceId": "<string>",
"targetSnapshotId": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"contentHash": "<string>",
"role": "<string>",
"freshness": "<string>"
}
],
"coverageScope": {
"kind": "repository"
},
"contextCitations": [
{
"repositoryId": "<string>",
"repository": "<string>",
"revision": "<string>",
"path": "<string>",
"startLine": 2,
"endLine": 2,
"url": "<string>"
}
]
}
}
],
"next_cursor": "<string>",
"metadata": {
"ai_generated": {
"version": 1,
"generator": "CodeRabbit"
}
}
}- CLI Tool
- MCP Server
coderabbit api request /security/scans/code
reachability_call_stack column holds the call stack as a JSON-encoded array. In SARIF, it’s in runs[].results[].properties.reachabilityCallStack. See Export Deep Scan code findings.Authorizations
See Authentication for the key types and where to create a key.
Query Parameters
Response
Paginated JSON or a full-inventory download.
Was this page helpful?