Fix RLS recommendations

This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.

Applies the row-level security rules the app’s latest security scan recommends, for the entities you name. Get the names from rls_recommendations in Get security scan.

For each entity, Base44 replaces the entity’s rls with the recommendation’s create, read, update, and delete rules, exactly as the scan stored them. An operation the recommendation has no rule for is left with no rule, which doesn’t restrict it. It doesn’t run the scan again or ask an AI model anything, and it uses no credits. The applied recommendations are removed from rls_recommendations.

An entity with nothing to apply doesn’t fail the call. It’s listed in failed with the reason, and the rest are still applied. They’re saved together, so if saving fails, the entities it failed for are listed in failed as write_failed, and that can be all of them. Some of their rules can still have changed in that case, so read the entities’ schemas before you retry. Read both lists rather than treating a successful response as every entity fixed.

By default the fix also shows up in the app’s AI chat, with a checkpoint of the app’s code saved just before it, so you can roll it back from there. Set record_security_fix_chat to false to skip both.

POST /api/apps/{app_id}/security/scan/rls/fix

Fix RLS recommendations

cURL

curl --request POST \
  --url https://app.base44.com/api/apps/{app_id}/security/scan/rls/fix \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "entity_names": [
    "Order",
    "Customer"
  ],
  "record_security_fix_chat": true,
  "security_fix_total_count": 150
}
'

200

{
  "fixed": [
    "Order"
  ],
  "failed": [
    {
      "entity_name": "Customer",
      "reason": "no_recommendation"
    }
  ]
}

Authorizations

Authorization · string · header · required

Personal access token, sent as Authorization: Bearer <token>. Each operation lists the permission it needs: read_only or full_access. A full-access token can call every operation. A read-only token can call only the operations that list read_only; anything else returns 403 read_only_credential_route_not_allowed.

Path Parameters

app_id · string · required

ID of the app.

Body

application/json

Which entities to apply the recommended row-level security rules to.

entity_names · string[] · required

Entities to fix, as returned in rls_recommendations by Get security scan. Name at least one and at most 100. A name listed twice is applied once.

Required array length: 1 - 100 elements

Example:

["Order", "Customer"]

record_security_fix_chat · boolean · default: true

Whether to add the fix to the app's AI chat and save a checkpoint of the app first. Set true to do both and false to apply the fix with neither. Defaults to true.

Example:

true

security_fix_total_count · integer | null

When you split one fix across several calls, the total number of entities across all of them. It's used only in the chat message, and ignored unless it's larger than the number of names in entity_names.

Required range: x >= 1

Example:

150

Response

200

application/json

Which entities got their recommended rules, and which didn't.

fixed · string[] · required

Entities whose rls now holds the recommended rules. An entity can also appear in failed as no_recommendation when a newer scan replaced its recommendation while the rules were being applied.

Example:

["Order"]

failed · RlsFixFailure · object[] · required

Entities that weren't fixed, each with the reason.

Show child attributes

Example:

[
  {
    "entity_name": "Customer",
    "reason": "no_recommendation"
  }
]