Ignore security finding
curl --request POST \
--url https://app.base44.com/api/apps/{app_id}/security/scan/ignore \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"fingerprint": "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e",
"finding_type": "static_code",
"file_path": "src/pages/Orders.jsx",
"title": "Order lookup trusts a client-supplied ID"
}
'import requests
url = "https://app.base44.com/api/apps/{app_id}/security/scan/ignore"
payload = {
"fingerprint": "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e",
"finding_type": "static_code",
"file_path": "src/pages/Orders.jsx",
"title": "Order lookup trusts a client-supplied ID"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
fingerprint: '3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e',
finding_type: 'static_code',
file_path: 'src/pages/Orders.jsx',
title: 'Order lookup trusts a client-supplied ID'
})
};
fetch('https://app.base44.com/api/apps/{app_id}/security/scan/ignore', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/security/scan/ignore",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'fingerprint' => '3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e',
'finding_type' => 'static_code',
'file_path' => 'src/pages/Orders.jsx',
'title' => 'Order lookup trusts a client-supplied ID'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.base44.com/api/apps/{app_id}/security/scan/ignore"
payload := strings.NewReader("{\n \"fingerprint\": \"3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e\",\n \"finding_type\": \"static_code\",\n \"file_path\": \"src/pages/Orders.jsx\",\n \"title\": \"Order lookup trusts a client-supplied ID\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/security/scan/ignore")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"fingerprint\": \"3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e\",\n \"finding_type\": \"static_code\",\n \"file_path\": \"src/pages/Orders.jsx\",\n \"title\": \"Order lookup trusts a client-supplied ID\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.base44.com/api/apps/{app_id}/security/scan/ignore")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"fingerprint\": \"3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e\",\n \"finding_type\": \"static_code\",\n \"file_path\": \"src/pages/Orders.jsx\",\n \"title\": \"Order lookup trusts a client-supplied ID\"\n}"
response = http.request(request)
puts response.read_body{
"status": "ok"
}Security
Ignore security finding
This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.
Ignores one finding in the app’s security scan, so it stays hidden across rescans for as long as its fingerprint doesn’t change. Get the finding’s fingerprint from Get security scan, and send the finding_type for its group.
Ignoring doesn’t change the app, and it doesn’t remove the finding from the scan result. The finding stays in its list, and its fingerprint is added to ignored_fingerprints. The app editor hides findings whose fingerprint is there. To undo an ignore, use Restore security finding.
A successful call doesn’t confirm that the finding is now ignored. Base44 doesn’t check that fingerprint belongs to a finding, so a mistyped or outdated one is saved and returns the same response. Check that the finding’s fingerprint appears in ignored_fingerprints.
POST
/
api
/
apps
/
{app_id}
/
security
/
scan
/
ignore
Ignore security finding
curl --request POST \
--url https://app.base44.com/api/apps/{app_id}/security/scan/ignore \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"fingerprint": "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e",
"finding_type": "static_code",
"file_path": "src/pages/Orders.jsx",
"title": "Order lookup trusts a client-supplied ID"
}
'import requests
url = "https://app.base44.com/api/apps/{app_id}/security/scan/ignore"
payload = {
"fingerprint": "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e",
"finding_type": "static_code",
"file_path": "src/pages/Orders.jsx",
"title": "Order lookup trusts a client-supplied ID"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
fingerprint: '3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e',
finding_type: 'static_code',
file_path: 'src/pages/Orders.jsx',
title: 'Order lookup trusts a client-supplied ID'
})
};
fetch('https://app.base44.com/api/apps/{app_id}/security/scan/ignore', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.base44.com/api/apps/{app_id}/security/scan/ignore",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'fingerprint' => '3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e',
'finding_type' => 'static_code',
'file_path' => 'src/pages/Orders.jsx',
'title' => 'Order lookup trusts a client-supplied ID'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.base44.com/api/apps/{app_id}/security/scan/ignore"
payload := strings.NewReader("{\n \"fingerprint\": \"3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e\",\n \"finding_type\": \"static_code\",\n \"file_path\": \"src/pages/Orders.jsx\",\n \"title\": \"Order lookup trusts a client-supplied ID\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.base44.com/api/apps/{app_id}/security/scan/ignore")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"fingerprint\": \"3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e\",\n \"finding_type\": \"static_code\",\n \"file_path\": \"src/pages/Orders.jsx\",\n \"title\": \"Order lookup trusts a client-supplied ID\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.base44.com/api/apps/{app_id}/security/scan/ignore")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"fingerprint\": \"3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e\",\n \"finding_type\": \"static_code\",\n \"file_path\": \"src/pages/Orders.jsx\",\n \"title\": \"Order lookup trusts a client-supplied ID\"\n}"
response = http.request(request)
puts response.read_body{
"status": "ok"
}Authorizations
Personal access token, sent as Authorization: Bearer <token>. Each operation lists the permission it needs: read_only or full_access. A full-access token can call every operation. A read-only token can call only the operations that list read_only; anything else returns 403 read_only_credential_route_not_allowed.
Path Parameters
ID of the app.
Body
application/json
The security finding to ignore.
The finding's fingerprint, as returned by Get security scan. Up to 128 characters.
Required string length:
1 - 128Example:
"3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e"
The finding's type, which matches the group it came from in Get security scan. Any other value is accepted and nothing is recorded.
Required string length:
1 - 64Example:
"static_code"
Path of the file the finding points at, kept with the ignore as a record of what was ignored. Up to 1,024 characters. Defaults to an empty string.
Maximum string length:
1024Example:
"src/pages/Orders.jsx"
Short name for the finding, kept with the ignore as a record of what was ignored. Up to 2,000 characters. Defaults to an empty string.
Maximum string length:
2000Example:
"Order lookup trusts a client-supplied ID"
Response
The call was accepted.
Always ok, including when nothing changed.
Example:
"ok"
Was this page helpful?