Export scan findings

Returns every approved finding for a scan in one of three formats. Unlike GET /scans/{id}/findings, this endpoint isn’t paginated, so every finding comes back in one response.

format=json

1
Content-Type: application/json; charset=utf-8

Returns a JSON array of finding objects, each matching the schema in GET /findings.

format=csv

1
Content-Type: text/csv; charset=utf-8
2
Content-Disposition: attachment; filename="findings-<scanId>.csv"

Returns a CSV document with a header row and one row per finding, for spreadsheets, BI tools, and ad hoc review.

format=sarif

1
Content-Type: application/sarif+json; charset=utf-8
2
Content-Disposition: attachment; filename="findings-<scanId>.sarif"

Returns a SARIF 2.1.0 document. GitHub code scanning, Azure DevOps, and most IDE security plugins read SARIF, so use this format to bring Hacktron findings into the security tooling you already use.

Request

GET /scans/{id}/findings/export

Send an API key with the read scope in the X-Api-Key header.

Path parameters

Query parameters

Responses

200 OK