Get a saved scan's findings
Returns the full report of a saved scan: every finding with its severity and how to fix it, the score breakdown behind each grade, and the headers and redirects seen. The report is graded for the tool the scan was run with. While the scan runs, the response carries progress instead of findings, so poll it until status is no longer running. A target that is not publicly reachable finishes with outcome forbidden.
Limited to 120 requests a minute for each person, after which it answers 429 with a Retry-After header.
Requires membership of the workspace.
AuthorizationBearer <JWT>An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.
workspaceId*stringThe workspace's id.
scanId*stringThe saved scan's id, as returned when the scan started.
lang?stringLanguage for the text in the result.
"en""en""fr"The scan report.
application/json- response
[key: string]?anycurl -X GET 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/scans/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/result'{ "scanResultId": "11132a50-38c2-4554-b967-40e599a28163", "target": "example.com", "domain": "example.com", "mode": "csp-scanner", "status": "done", "outcome": "success", "analyzed": true, "degraded": null, "progress": 100, "startedAt": "2026-09-14T08:49:32.665Z", "finishedAt": "2026-09-14T08:49:32.736Z", "durationMs": 71, "followRedirects": true, "urlAnalyzed": "https://example.com", "scores": { "overall": 291, "security": 97, "quality": 875, "breakdown": { "attacks": [ { "key": "attack.script-injection", "label": "Script Injection", "tier": "mandatory", "weight": 9, "security": { "value": 0, "status": "failed" }, "quality": { "value": null, "status": "not-evaluated" }, "global": { "value": 0, "status": "failed" }, "status": "failed", "mechanisms": [ { "id": "script-gate", "importance": 60, "applicable": true, "present": false, "strength": 0, "penalty": 0, "findings": [] } ] } ] } }, "summary": { "security": { "critical": 0, "high": 2, "medium": 4, "low": 0, "info": 0, "total": 6 }, "quality": { "critical": 0, "high": 0, "medium": 0, "low": 0, "info": 1, "total": 1 }, "total": 7 }, "findings": [ { "id": "f2", "code": "attack.script-injection.unprotected", "class": "security", "severity": "high", "title": "Nothing stops an injected script from running", "description": "The enforced CSP sets no script directive (script-src, script-src-elem or default-src) and does not require Trusted Types, so the page has no defence against script injection.", "recommendation": "Make the script directive strict: a nonce-based script-src with 'strict-dynamic' and require-trusted-types-for 'script', and lock the injection sinks with base-uri 'self' and object-src 'none'.", "nextAction": "Add a strict nonce-based script-src with 'strict-dynamic'.", "impact": "An injected or tampered script runs with the page's privileges (cross-site scripting), able to read the DOM, tokens, and form fields.", "exploit": "An HTML-injection point loads or inlines attacker JavaScript, and nothing in the page's policy stops it from executing under the page's origin.", "example": "Content-Security-Policy: script-src 'nonce-r4nd0m' 'strict-dynamic'", "links": [ "https://www.w3.org/TR/CSP3/#directive-script-src" ], "directives": [], "vectors": [], "items": [] } ], "recommendations": [ { "id": "f15", "code": "headers.content-type.missing_charset", "class": "quality", "severity": "info", "title": "Content-Type has no charset", "description": "The text Content-Type text/html declares no charset.", "recommendation": "Add charset=utf-8 to text content types.", "nextAction": "Add charset=utf-8 to the text Content-Type header.", "impact": "Charset sniffing can be abused to slip past filters.", "example": "Content-Type: text/html; charset=utf-8", "links": [ "https://developer.mozilla.org/docs/Web/HTTP/Headers/Content-Type" ], "directives": [], "vectors": [], "items": [] } ], "headers": { "order": [ "content-type", "server" ], "byName": { "content-type": [ { "value": "text/html; charset=UTF-8" } ], "server": [ { "value": "nginx" } ] } }, "content": { "metaCsp": null }, "reportingApi": null, "get": { "dns": { "addresses": [ "93.184.215.14" ] }, "http": { "requestedUrl": "https://example.com", "finalUrl": "https://example.com", "statusCode": 200, "responseKind": "html", "contentType": "text/html", "hops": [ { "url": "https://example.com", "statusCode": 200 } ], "hopCount": 1 } }}Get a saved scan GET
Returns the status of one of your saved scans and, once it finishes, its scores and finding counts by severity.
Analyze a policy value POST
Reviews a Content-Security-Policy header value and reports what each directive does and where the policy is weak, such as an unsafe keyword or an overly broad...