Export scan findings
curl --request GET \
--url https://api.example.com/scans/{id}/findings/exportimport requests
url = "https://api.example.com/scans/{id}/findings/export"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.example.com/scans/{id}/findings/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/scans/{id}/findings/export",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/scans/{id}/findings/export"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/scans/{id}/findings/export")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/scans/{id}/findings/export")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_bodyScans
Export scan findings
Download all findings for a scan as JSON, CSV, or SARIF.
GET
/
scans
/
{id}
/
findings
/
export
Export scan findings
curl --request GET \
--url https://api.example.com/scans/{id}/findings/exportimport requests
url = "https://api.example.com/scans/{id}/findings/export"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.example.com/scans/{id}/findings/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/scans/{id}/findings/export",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/scans/{id}/findings/export"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.example.com/scans/{id}/findings/export")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/scans/{id}/findings/export")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_bodyReturns every approved finding for a scan in one of three formats. Unlike List scan findings, this endpoint is not paginated; all findings are returned in a single response.
Returns a JSON array of finding objects, each matching the schema described in List findings.
Returns a CSV document with one row per finding and a header row. Intended for spreadsheets, BI tools, and ad‑hoc review.
Returns a SARIF 2.1.0 document. SARIF is consumed by GitHub code scanning, Azure DevOps, and most IDE security plugins; use this format to integrate Hacktron findings into existing security tooling.
Scope required:
readRequest
curl "https://api.hacktron.ai/v1/scans/a1b2c3d4-e5f6-7890-abcd-ef1234567890/findings/export?format=sarif" \
-H "X-Api-Key: $HACKTRON_API_KEY" \
-o findings.sarif
Path parameters
| Parameter | Type | Description |
|---|---|---|
id | UUID | Scan UUID. |
Query parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
format | enum | Yes | One of json, csv, sarif. |
Response
TheContent-Type and Content-Disposition headers depend on the requested format.
format=json
Content-Type: application/json; charset=utf-8
format=csv
Content-Type: text/csv; charset=utf-8
Content-Disposition: attachment; filename="findings-<scanId>.csv"
format=sarif
Content-Type: application/sarif+json; charset=utf-8
Content-Disposition: attachment; filename="findings-<scanId>.sarif"
Errors
400— missing or invalidformatquery parameter.404— scan not found or not visible to your organization.
⌘I