CentralCSP
APIScans

Get a saved scan

Returns the status of one of your saved scans and, once it finishes, its scores and finding counts by severity. Poll it to follow a running scan, and read the findings for the full report.

Limited to 120 requests a minute for each person, after which it answers 429 with a Retry-After header. Listing and reading scans share this limit.

Requires membership of the workspace.

GET
/v1/workspaces/{workspaceId}/scans/{scanId}

Authorization

headerAuthorizationBearer <JWT>

An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.

Path Parameters

workspaceId*string

The workspace's id.

scanId*string

The saved scan's id, as returned when the scan started.

Response Body

A saved website scan and its outcome.

application/json
  1. response
scanId*string

Identifies the scan. Pass it as scanId to the other scan endpoints.

tool*string

Which scanner produced the scan. csp-scanner grades the Content Security Policy, header-scanner grades every security header, and reporting-api checks the reporting setup.

Value in"csp-scanner""header-scanner""reporting-api"
target*string

Domain or URL that was scanned.

status*string

Where the scan job stands: running until it finishes, then done or failed. A done scan may still have been unable to read the site (bot protection, an error page, an unreachable host): read state for what the scan came to.

Value in"running""done""failed"
state*string

What the scan came to: queued or running while it runs, completed when the site was read and graded, otherwise why it could not be: blocked (bot protection answered), site_error (the site answered an error page), not_found (the host does not resolve), unreachable (nothing answered), redirect_loop (too many redirects), refused (an address we do not scan) or failed (the scan produced no result).

Value in"queued""running""completed""blocked""site_error""not_found""unreachable""redirect_loop""refused""failed"
outcome*|null
error*|null
httpStatus*|null
urlAnalyzed*|null
followRedirects*boolean

Whether the scan followed redirects.

scanResultId*string

Identifies the scan's result in a share link. Anyone holding it can read the result, so treat it as a share token.

scores*|null
findings*|null
createdAt*string

When the scan was started.

Formatdate-time
finishedAt*|null
Example Request
curl -X GET 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/scans/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90'
Example Response
{  "scanId": "01a09f1b-76f9-7499-8734-038798d60789",  "tool": "csp-scanner",  "target": "example.com",  "status": "done",  "state": "completed",  "outcome": "no_host",  "error": "bot protection interstitial detected",  "httpStatus": 403,  "urlAnalyzed": "https://example.com/",  "followRedirects": true,  "scanResultId": "11132a50-38c2-4554-b967-40e599a28163",  "scores": {    "overall": 37,    "security": 17,    "quality": 94  },  "findings": {    "critical": 0,    "high": 3,    "medium": 7,    "low": 3,    "info": 6,    "total": 19  },  "createdAt": "2026-09-14T08:49:32.409Z",  "finishedAt": "2026-09-14T08:49:32.830Z"}

List the scanner's IP addresses GET

Returns every address scans are sent from. Allow them through your firewall, WAF or bot protection so scans are not blocked.

Get a saved scan's findings GET

Returns the full report of a saved scan: every finding with its severity and how to fix it, the score breakdown behind each grade, and the headers and...