> ## Documentation Index > Fetch the complete documentation index at: https://docs.base44.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Internal links on these pages omit the .md extension. Append .md to a docs page URL, or send an Accept: text/markdown header, to get that page as markdown. # Fix RLS recommendations > This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production. Applies the row-level security rules the app's latest security scan recommends, for the entities you name. Get the names from `rls_recommendations` in [Get security scan](/api-reference/get-security-scan). For each entity, Base44 replaces the entity's `rls` with the recommendation's create, read, update, and delete rules, exactly as the scan stored them. An operation the recommendation has no rule for is left with no rule, which doesn't restrict it. It doesn't run the scan again or ask an AI model anything, and it uses no credits. The applied recommendations are removed from `rls_recommendations`. An entity with nothing to apply doesn't fail the call. It's listed in `failed` with the reason, and the rest are still applied. They're saved together, so if saving fails, the entities it failed for are listed in `failed` as `write_failed`, and that can be all of them. Some of their rules can still have changed in that case, so read the entities' schemas before you retry. Read both lists rather than treating a successful response as every entity fixed. By default the fix also shows up in the app's AI chat, with a checkpoint of the app's code saved just before it, so you can roll it back from there. Set `record_security_fix_chat` to `false` to skip both. ## OpenAPI ````yaml /developers/references/app-management/app-management-openapi.json post /api/apps/{app_id}/security/scan/rls/fix openapi: 3.1.0 info: title: Base44 App Management API version: 1.0.0 servers: - url: https://app.base44.com security: - PersonalAccessTokenAuth: [] paths: /api/apps/{app_id}/security/scan/rls/fix: post: summary: Fix RLS recommendations description: >- This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production. Applies the row-level security rules the app's latest security scan recommends, for the entities you name. Get the names from `rls_recommendations` in [Get security scan](/api-reference/get-security-scan). For each entity, Base44 replaces the entity's `rls` with the recommendation's create, read, update, and delete rules, exactly as the scan stored them. An operation the recommendation has no rule for is left with no rule, which doesn't restrict it. It doesn't run the scan again or ask an AI model anything, and it uses no credits. The applied recommendations are removed from `rls_recommendations`. An entity with nothing to apply doesn't fail the call. It's listed in `failed` with the reason, and the rest are still applied. They're saved together, so if saving fails, the entities it failed for are listed in `failed` as `write_failed`, and that can be all of them. Some of their rules can still have changed in that case, so read the entities' schemas before you retry. Read both lists rather than treating a successful response as every entity fixed. By default the fix also shows up in the app's AI chat, with a checkpoint of the app's code saved just before it, so you can roll it back from there. Set `record_security_fix_chat` to `false` to skip both. operationId: fix_rls_recommendations_api_apps__app_id__security_scan_rls_fix_post parameters: - name: app_id in: path required: true schema: type: string description: ID of the app. title: App Id description: ID of the app. example: 6820f3a4e7b91d003c45a1f2 requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/RlsFixRequest' responses: '200': description: Which entities got their recommended rules, and which didn't. content: application/json: schema: $ref: '#/components/schemas/RlsFixResponse' '401': description: Missing or invalid credentials. '403': description: >- You don't have editor access to this app, or you used a workspace API key. A read-only personal access token is refused. '404': description: App not found. '409': description: >- The app isn't ready for fixes, because: - A security scan is running on it. - The AI is working on it. The error code is `builder_busy`. - It changed since its last scan. The error code is `scan_out_of_date`, and it's returned only to callers whose fixes require a fresh scan. Apply the fixes once the scan or the AI finishes, or run a new scan with [Run security scan](/api-reference/run-security-scan) first. '422': description: >- The body is invalid, because: - It's missing, or has fields other than `entity_names`, `record_security_fix_chat`, and `security_fix_total_count`. - The list in `entity_names` is empty, holds more than 100 names, or has a name with a character other than a letter, digit, or underscore. - A value has the wrong type, or `security_fix_total_count` is less than 1. '429': description: >- Rate limit exceeded. The base limit is 30 requests per minute for each app, shared by every personal access token in the workspace. See [Rate limits](/developers/references/apps-api/get-started/rate-limits) for the multiplier your plan gets. security: - PersonalAccessTokenAuth: - full_access components: schemas: RlsFixRequest: properties: entity_names: items: type: string type: array maxItems: 100 minItems: 1 title: Entity Names description: >- Entities to fix, as returned in `rls_recommendations` by [Get security scan](/api-reference/get-security-scan). Name at least one and at most 100. A name listed twice is applied once. example: - Order - Customer record_security_fix_chat: type: boolean title: Record Security Fix Chat description: >- Whether to add the fix to the app's AI chat and save a checkpoint of the app first. Set `true` to do both and `false` to apply the fix with neither. Defaults to `true`. default: true example: true security_fix_total_count: anyOf: - type: integer minimum: 1 - type: 'null' title: Security Fix Total Count description: >- When you split one fix across several calls, the total number of entities across all of them. It's used only in the chat message, and ignored unless it's larger than the number of names in `entity_names`. example: 150 additionalProperties: false type: object required: - entity_names title: RlsFixRequest description: Which entities to apply the recommended row-level security rules to. RlsFixResponse: properties: fixed: items: type: string type: array title: Fixed description: >- Entities whose `rls` now holds the recommended rules. An entity can also appear in `failed` as `no_recommendation` when a newer scan replaced its recommendation while the rules were being applied. example: - Order failed: items: $ref: '#/components/schemas/RlsFixFailure' type: array title: Failed description: Entities that weren't fixed, each with the reason. example: - entity_name: Customer reason: no_recommendation type: object required: - fixed - failed title: RlsFixResponse RlsFixFailure: properties: entity_name: type: string title: Entity Name description: Entity that wasn't fixed. example: Customer reason: type: string enum: - no_scan - no_recommendation - entity_not_found - write_failed title: Reason description: >- Why it wasn't fixed. - `no_scan`: The app has no scan result from the current scanner, so run [Run security scan](/api-reference/run-security-scan) first. - `no_recommendation`: The latest result holds no recommendation for the entity, because it never had one or it was already resolved. - `entity_not_found`: The app no longer has the entity. - `write_failed`: Saving the rules failed, though some of them may have landed, and the recommendation is kept so you can retry. example: no_recommendation type: object required: - entity_name - reason title: RlsFixFailure description: One entity whose recommended rules weren't applied. securitySchemes: PersonalAccessTokenAuth: type: http scheme: bearer description: >- Personal access token, sent as `Authorization: Bearer `. Each operation lists the permission it needs: `read_only` or `full_access`. A full-access token can call every operation. A read-only token can call only the operations that list `read_only`; anything else returns 403 `read_only_credential_route_not_allowed`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.