> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Internal links on these pages omit the .md extension. Append .md to a docs page URL, or send an Accept: text/markdown header, to get that page as markdown.

# Dismiss header recommendation

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Removes one security header [recommendation](/developers/references/apps-api/sections/security#scan-findings) from the app's security scan result without changing the app's headers. Get the `flag` from `header_recommendations` in [Get security scan](/api-reference/get-security-scan).

The recommendation stays out of the scan result until the next call to [Run security scan](/api-reference/run-security-scan). That call judges the app's headers again, even when it returns the existing scan result, so the recommendation comes back if it still applies.

To act on the recommendation instead, turn the setting on with [Update security headers](/api-reference/update-security-headers).



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json delete /api/apps/{app_id}/security/scan/header-recommendations/{flag}
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/security/scan/header-recommendations/{flag}:
    delete:
      summary: Dismiss header recommendation
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Removes one security header
        [recommendation](/developers/references/apps-api/sections/security#scan-findings)
        from the app's security scan result without changing the app's headers.
        Get the `flag` from `header_recommendations` in [Get security
        scan](/api-reference/get-security-scan).


        The recommendation stays out of the scan result until the next call to
        [Run security scan](/api-reference/run-security-scan). That call judges
        the app's headers again, even when it returns the existing scan result,
        so the recommendation comes back if it still applies.


        To act on the recommendation instead, turn the setting on with [Update
        security headers](/api-reference/update-security-headers).
      operationId: >-
        dismiss_header_recommendation_api_apps__app_id__security_scan_header_recommendations__flag__delete
      parameters:
        - name: flag
          in: path
          required: true
          schema:
            type: string
            description: >-
              The recommendation to dismiss, as returned in
              `header_recommendations[].flag` by [Get security
              scan](/api-reference/get-security-scan). Either
              `prevent_iframe_embedding` or `restrict_browser_features`.
            title: Flag
          description: >-
            The recommendation to dismiss, as returned in
            `header_recommendations[].flag` by [Get security
            scan](/api-reference/get-security-scan). Either
            `prevent_iframe_embedding` or `restrict_browser_features`.
          example: prevent_iframe_embedding
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app.
            title: App Id
          description: ID of the app.
          example: 6820f3a4e7b91d003c45a1f2
      responses:
        '200':
          description: The recommendation is dismissed, or there was nothing to dismiss.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityHeaderRecommendationDismissed'
        '401':
          description: Missing or invalid credentials.
        '403':
          description: >-
            You don't have editor access to this app, or you used a workspace
            API key. A read-only personal access token is refused.
        '404':
          description: App not found.
        '429':
          description: >-
            Rate limit exceeded. The base limit is 30 requests per minute for
            each app, shared by every personal access token in the workspace.
            See [Rate
            limits](/developers/references/apps-api/get-started/rate-limits) for
            the multiplier your plan gets.
      security:
        - PersonalAccessTokenAuth:
            - full_access
components:
  schemas:
    SecurityHeaderRecommendationDismissed:
      properties:
        status:
          type: string
          title: Status
          description: Always `ok`, including when there was nothing to dismiss.
          example: ok
      type: object
      required:
        - status
      title: SecurityHeaderRecommendationDismissed
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: >-
        Personal access token, sent as `Authorization: Bearer <token>`. Each
        operation lists the permission it needs: `read_only` or `full_access`. A
        full-access token can call every operation. A read-only token can call
        only the operations that list `read_only`; anything else returns 403
        `read_only_credential_route_not_allowed`.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.