API Reports

Download the same reports that can be generated in the AppCheck web interface, for a scan’s latest run or for a specific run. Each request returns the report file itself.

Note

Building a report can take several minutes for a large run, so these requests wait for the report to be ready. Allow a client timeout of at least 10 minutes, and retry a 202 response as described in GET /api/v1/(api_key)/scan/(scan_id)/report.

GET /api/v1/(api_key)/scan/(scan_id)/report

New in version 1.5.0.

Generate a report for the latest run of a scan and download it.

The report is built by the same report generator as the web interface, from the vulnerabilities of the scan’s most recent run (the run returned as data[0] by GET /api/v1/(api_key)/scan/(scan_id)/runs). To report on a specific run use GET /api/v1/(api_key)/scan/(scan_id)/run/(run_id)/report.

The request blocks until the report is ready and the response body is the report file itself. Reports can take several minutes to build for large runs - see Caching and long-running requests below.

Example request:

GET /api/v1/44df57d3f5a479e334e622f314787dcc/scan/b4ab4a50c3474b7d/report?type=full&format=xlsx&severity=high HTTP/1.1
Host: api.appcheck-ng.com
Accept-Encoding: identity

Example response (report still being generated):

HTTP/1.1 202 Accepted
Content-Type: application/json
Retry-After: 30
Date: Tue, 13 Oct 2026 11:23:50 GMT

{
  "data": {
    "status": "ongoing"
  },
  "message": "Report is still being generated; retry the same request",
  "success": false
}
Parameters:
  • api_key (string) – Your API key
  • scan_id (string) – ID of the scan
Query Parameters:
 
  • type (string) – report type, full (default) or executive
  • format (string) – report format. docx (default), xlsx or csv for a full report; pdf (default) for an executive report
  • severity (string) – only include vulnerabilities with this severity or higher: critical, high, medium, low or info. Default: every severity
  • status (string) – comma-separated list of vulnerability status values to include: unfixed, investigating, confirmed, fixed, false_positive, acceptable_risk, backported. Default: unfixed,investigating
  • no_cache (boolean) – 1 (or true) to always build a new report rather than return a cached one. Default: 0
Response Headers:
 
  • Content-Type – application/vnd.openxmlformats-officedocument.wordprocessingml.document (docx), application/vnd.openxmlformats-officedocument.spreadsheetml.sheet (xlsx), text/csv (csv) or application/pdf (pdf). application/json for every response that is not a report
  • Content-Disposition – attachment with a filename made from the scan name, report type and run date, e.g. filename="Example_Scan_Full_Report_2026-10-13.CONFIDENTIAL.docx"
  • X-Report-Cached – true if the report was served from the cache, false if it was built for this request
  • Retry-After – seconds to wait before retrying (202 responses only)
Status Codes:
  • 200 OK – the report file. Also used, with a JSON body and success: false, for requests that cannot be served: an invalid scan or run id (Invalid scan id, This scan has no runs, Invalid run id for this scan id), an invalid filter (the message names the parameter and lists the valid values), or a report that failed to build (Report generation failed)
  • 202 Accepted – the report is still being built. JSON body {"success": false, "data": {"status": "ongoing"}}. Retry the same request after Retry-After seconds
  • 503 Service Unavailable – the report service is unavailable; retry later
  • 400 Bad Request – access denied

Report types and formats

type contents formats
full every vulnerability in the run matching the filters, with descriptions, evidence and remediation advice docx (default), xlsx, csv
executive a summary for a non-technical audience: a severity breakdown chart and the vulnerabilities found on each host, without the technical detail pdf (only)

Asking for an executive report in any format other than pdf is an error, not a silent conversion.

Filters

severity and status narrow which of the run’s vulnerabilities are included, and apply to both report types. severity uses the same levels as GET /api/v1/(api_key)/scan/(scan_id)/run/(run_id)/vulnerabilities, but an unrecognised value is rejected rather than ignored. For example:

  • ?type=full&format=xlsx&severity=high - spreadsheet of the high and critical vulnerabilities that are unfixed or being investigated
  • ?type=executive - executive summary of every unfixed or investigating vulnerability
  • ?status=unfixed,confirmed&no_cache=1 - Word report of unfixed and confirmed vulnerabilities, built fresh

Caching and long-running requests

A built report is kept for up to 30 minutes and returned again for a request for the same run, type, format and filters (X-Report-Cached: true). A cached report is never returned if it was built before the run finished. It does not reflect vulnerability changes made after it was built, such as a status change - use no_cache=1 to build a new one.

If a report for the same request is already being built, the request waits for that build instead of starting another, even with no_cache=1.

A request blocks for up to 9 minutes. If the report is not ready by then the response is a 202 with a Retry-After header. Retrying the same request waits for the same build - it does not start a new one - so retry until you receive the file.

See also:
GET /api/v1/(api_key)/scan/(scan_id)/run/(run_id)/report

New in version 1.5.0.

Generate a report for a specific run of a scan and download it.

Identical to GET /api/v1/(api_key)/scan/(scan_id)/report - the same report types, formats, filters, caching and blocking behaviour - except that it reports on the given run rather than the latest one. See GET /api/v1/(api_key)/scan/(scan_id)/report for the full description of each.

Example request:

GET /api/v1/44df57d3f5a479e334e622f314787dcc/scan/b4ab4a50c3474b7d/run/e385fa8ff6774215/report?type=executive HTTP/1.1
Host: api.appcheck-ng.com
Accept-Encoding: identity
Parameters:
  • api_key (string) – Your API key
  • scan_id (string) – ID of the scan
  • run_id (string) – ID of the run. Must be a run of this scan
Query Parameters:
 
  • type (string) – report type, full (default) or executive
  • format (string) – report format. docx (default), xlsx or csv for a full report; pdf (default) for an executive report
  • severity (string) – minimum severity to include: critical, high, medium, low or info. Default: every severity
  • status (string) – comma-separated vulnerability status values to include. Default: unfixed,investigating
  • no_cache (boolean) – 1 to always build a new report. Default: 0
Response Headers:
 
  • Content-Type – the report’s type (see GET /api/v1/(api_key)/scan/(scan_id)/report), or application/json for every response that is not a report
  • Content-Disposition – attachment with the report filename
  • X-Report-Cached – true if the report was served from the cache
  • Retry-After – seconds to wait before retrying (202 responses only)
Status Codes:
See also: