Get security scan
Check the progress, timing, and check types of a specific security scan using the Lovable API. This endpoint only provides scan metadata, not the list of issues detected.
Teams on a Business plan or higher who want to programmatically monitor when a security scan finishes.
Do this, in order
- 1
Create an API key in your workspace settings with at least the 'projects:read' scope.
The security scan endpoint requires authenticated access and will reject keys without project read permissions.
- 2
Retrieve your project ID and the specific scan ID you want to check.
Both identifiers are required in the URL path to locate the exact scan record.
- 3
Send a GET request to /v1/projects/{project_id}/security-scans/{scan_id} with your API key in the 'Lovable-API-Key' header.
This returns the status, timestamps, and requested check details for that scan.
- 4
Query the separate findings endpoint if you need to inspect specific security issues discovered by the scan.
Scan metadata and actual security findings are separated into different endpoints.
Paste this into your project
Create an administrative dashboard card that checks the status of a Lovable security scan. It should call GET https://api.lovable.dev/v1/projects/{project_id}/security-scans/{scan_id} using an API key stored securely in environment variables, and display the scan's status, started time, and completed time.Words decoded
- Security scan
- An automated inspection that checks your project for security vulnerabilities or exposed private data.
- Scope
- The specific permission granted to an API key determining what information it is allowed to see or change.
- Endpoint
- A specific web address an external program calls to send or receive information.
Where people get stuck
- Do not look for the list of security vulnerabilities in this response; you must call the dedicated findings endpoint to see them.
- Requests will fail with a 402 payment required error if your workspace is not on a Business plan or higher.
- API keys are tied to a single workspace; requesting a project belonging to a different workspace returns a 404 not found error.
The short version, steps, decoder and prompt on this page are written automatically from Lovable's own documentation and can lag or misread it. The official page is always the authority.