Skip to main content
GET
Get Code Scan Profile

Permissions

Requires a service user or personal access token with the ViewCodeScans permission at the organization level.

Behavior

Returns the profile’s metadata, visibility (org-owned or shared account-wide), include/exclude globs, and all of its guidance fields (investigation, communication, and ingestion-source guidance). Find profile IDs with List Code Scan Profiles. Returns 404 when the profile does not exist or is not visible to the organization.

Authorizations

Authorization
string
header
required

Service User credential (prefix: cog_)

Path Parameters

profile_id
string
required
org_id
string
required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Response

Successful Response

Full details of a code scan profile, including its guidance.

created_at
integer
required

When the profile was created (unix seconds).

description
string | null
required

Description of the profile, if any.

exclude_globs
string[] | null
required

Glob patterns of files to exclude from the scan, if any.

include_globs
string[] | null
required

Glob patterns of files to include in the scan, if any.

ingestion_source_guidance
string | null
required

Guidance describing the ingestion source, if any.

investigation_guidance
string | null
required

Guidance for the investigation phase, if any.

mode
enum<string>
required

Profile mode: discover or ingest.

Available options:
discover,
ingest
name
string
required

Name of the profile.

org_id
string | null
required

Organization that owns the profile. Null when the profile is shared account-wide.

post_ingestion_guidance
string | null
required

Guidance for the post-ingestion phase, if any.

profile_id
string
required

Unique identifier for the profile.

remediation_guidance
string | null
required

Guidance for the remediation phase, if any.

report_guidance
string | null
required

Guidance for the report phase, if any.

scan_type
enum<string>
required

Type of scan the profile configures.

Available options:
security,
performance,
db-queries,
test-coverage,
dead-code,
code-quality,
telemetry,
accessibility,
general,
migration-docs
threat_model_guidance
string | null
required

Guidance describing the threat model, if any.

triage_guidance
string | null
required

Guidance for the triage phase, if any.

validation_guidance
string | null
required

Guidance for the validation phase, if any.

visibility
enum<string>
required

Whether the profile is owned by a single organization or shared across the whole account.

Available options:
org,
account
communication_guidance
string | null

Guidance for the communication phase (acting on final findings, e.g. notifying owners or stakeholders), if any.