curl --request GET \
--url 'https://api.lovable.dev/v1/projects/project-id/security-scans/scan-id' \
--header 'Lovable-API-Key: lov_your-api-key' \
--header 'Lovable-Version: 2026-09-11'{
"commit_sha": "9fceb02d0ae598e95dc970b74767f19372d61af8",
"finished_at": "2026-01-15T09:30:00Z",
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"requested_scanners": [
"agent_security"
],
"started_at": "2026-01-15T09:30:00Z",
"status": "completed"
}{
"detail": "validation failed",
"errors": [
{
"location": "body.members",
"message": "expected array length >= 1"
}
],
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 400,
"title": "Bad Request",
"type": "invalid_request"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 401,
"title": "Authorization header required",
"type": "unauthorized"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 402,
"title": "You need to upgrade your plan to access this feature",
"type": "payment_required"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 403,
"title": "You don't have the permissions to perform this action",
"type": "forbidden"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 404,
"title": "Not Found",
"type": "security_scan_not_found"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 406,
"title": "This endpoint produces application/json. Send a matching Accept header, */*, or omit the header.",
"type": "not_acceptable"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 429,
"title": "Too Many Requests",
"type": "rate_limited"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 503,
"title": "Request timed out",
"type": "request_timeout"
}{
"detail": "validation failed",
"errors": [
{
"location": "body.workspace_id",
"message": "expected string"
}
],
"props": {
"finding_refs": [
"supabase/finding-1"
]
},
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 429,
"title": "Too Many Requests",
"type": "rate_limited"
}Get security scan
Plan: Business or higher
Scope: projects:read
Returns a security scan’s status, timing, and requested checks. Findings are available from GET /v1/projects//security-scans//findings.
curl --request GET \
--url 'https://api.lovable.dev/v1/projects/project-id/security-scans/scan-id' \
--header 'Lovable-API-Key: lov_your-api-key' \
--header 'Lovable-Version: 2026-09-11'{
"commit_sha": "9fceb02d0ae598e95dc970b74767f19372d61af8",
"finished_at": "2026-01-15T09:30:00Z",
"id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"requested_scanners": [
"agent_security"
],
"started_at": "2026-01-15T09:30:00Z",
"status": "completed"
}{
"detail": "validation failed",
"errors": [
{
"location": "body.members",
"message": "expected array length >= 1"
}
],
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 400,
"title": "Bad Request",
"type": "invalid_request"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 401,
"title": "Authorization header required",
"type": "unauthorized"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 402,
"title": "You need to upgrade your plan to access this feature",
"type": "payment_required"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 403,
"title": "You don't have the permissions to perform this action",
"type": "forbidden"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 404,
"title": "Not Found",
"type": "security_scan_not_found"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 406,
"title": "This endpoint produces application/json. Send a matching Accept header, */*, or omit the header.",
"type": "not_acceptable"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 429,
"title": "Too Many Requests",
"type": "rate_limited"
}{
"detail": null,
"errors": null,
"props": null,
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 503,
"title": "Request timed out",
"type": "request_timeout"
}{
"detail": "validation failed",
"errors": [
{
"location": "body.workspace_id",
"message": "expected string"
}
],
"props": {
"finding_refs": [
"supabase/finding-1"
]
},
"request_id": "4bf92f3577b34da6a3ce929d0e0e4736",
"status": 429,
"title": "Too Many Requests",
"type": "rate_limited"
}Authorizations
Lovable API key. Send its value in the Lovable-API-Key header.
Headers
Stable API version to serve, as a YYYY-MM-DD date. Omit for the oldest supported stable version, currently 2026-09-11.
Comma-separated beta revision strings to enable on top of the stable version.
Path Parameters
Project ID.
"prj_01jw3k9m2xq8r5v0c7d4e6f2gh"
Security scan ID returned by the list endpoint.
"a1b2c3d4-e5f6-7890-abcd-ef1234567890"
Response
OK
Status and timing of the security scan. Retrieve findings from this scan's paginated findings endpoint.
Git commit SHA of the project when the scan started; null when unavailable.
"9fceb02d0ae598e95dc970b74767f19372d61af8"
When the scan finished, UTC; null while still running.
"2026-01-15T09:30:00Z"
Security scan ID.
"a1b2c3d4-e5f6-7890-abcd-ef1234567890"
Identifiers of the security checks requested for this scan.
["agent_security"]
When the scan started, UTC.
"2026-01-15T09:30:00Z"
Overall scan state. Finishing a scan does not mean that no security issues were found. More values may be added; clients must tolerate unknown values.
running, completed, failed "completed"
Was this page helpful?