> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Internal links on these pages omit the .md extension. Append .md to a docs page URL, or send an Accept: text/markdown header, to get that page as markdown.

# Ignore security finding

> <Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Ignores one [finding](/developers/references/apps-api/sections/security#scan-findings) in the app's security scan, so it stays hidden across rescans for as long as its [fingerprint](/developers/references/apps-api/sections/security#findings-and-fingerprints) doesn't change. Get the finding's `fingerprint` from [Get security scan](/api-reference/get-security-scan), and send the `finding_type` for its group.

Ignoring doesn't change the app, and it doesn't remove the finding from the scan result. The finding stays in its list, and its fingerprint is added to `ignored_fingerprints`. The app editor hides findings whose fingerprint is there. To undo an ignore, use [Restore security finding](/api-reference/restore-security-finding).

A successful call doesn't confirm that the finding is now ignored. Base44 doesn't check that `fingerprint` belongs to a finding, so a mistyped or outdated one is saved and returns the same response. Check that the finding's `fingerprint` appears in `ignored_fingerprints`.



## OpenAPI

````yaml /developers/references/app-management/app-management-openapi.json post /api/apps/{app_id}/security/scan/ignore
openapi: 3.1.0
info:
  title: Base44 App Management API
  version: 1.0.0
servers:
  - url: https://app.base44.com
security:
  - PersonalAccessTokenAuth: []
paths:
  /api/apps/{app_id}/security/scan/ignore:
    post:
      summary: Ignore security finding
      description: >-
        <Info>This API is in beta. Endpoints, fields, and behavior may still
        change, so avoid depending on it in production.</Info>


        Ignores one
        [finding](/developers/references/apps-api/sections/security#scan-findings)
        in the app's security scan, so it stays hidden across rescans for as
        long as its
        [fingerprint](/developers/references/apps-api/sections/security#findings-and-fingerprints)
        doesn't change. Get the finding's `fingerprint` from [Get security
        scan](/api-reference/get-security-scan), and send the `finding_type` for
        its group.


        Ignoring doesn't change the app, and it doesn't remove the finding from
        the scan result. The finding stays in its list, and its fingerprint is
        added to `ignored_fingerprints`. The app editor hides findings whose
        fingerprint is there. To undo an ignore, use [Restore security
        finding](/api-reference/restore-security-finding).


        A successful call doesn't confirm that the finding is now ignored.
        Base44 doesn't check that `fingerprint` belongs to a finding, so a
        mistyped or outdated one is saved and returns the same response. Check
        that the finding's `fingerprint` appears in `ignored_fingerprints`.
      operationId: ignore_finding_api_apps__app_id__security_scan_ignore_post
      parameters:
        - name: app_id
          in: path
          required: true
          schema:
            type: string
            description: ID of the app.
            title: App Id
          description: ID of the app.
          example: 6820f3a4e7b91d003c45a1f2
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IgnoreFindingPayload'
      responses:
        '200':
          description: The call was accepted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityFindingIgnoreStatus'
        '401':
          description: Missing or invalid credentials.
        '403':
          description: >-
            You don't have editor access to this app, or you used a workspace
            API key. A read-only personal access token is refused.
        '404':
          description: App not found.
        '422':
          description: >-
            The body is missing or isn't a JSON object, has fields other than
            `fingerprint`, `finding_type`, `file_path`, and `title`, or leaves
            out `fingerprint` or `finding_type`. Also returned when a value
            isn't a string, is longer than its limit, or is empty for
            `fingerprint` or `finding_type`.
        '429':
          description: >-
            Rate limit exceeded. The base limit is 60 requests per minute for
            each app, shared by every personal access token in the workspace.
            See [Rate
            limits](/developers/references/apps-api/get-started/rate-limits) for
            the multiplier your plan gets.
      security:
        - PersonalAccessTokenAuth:
            - full_access
components:
  schemas:
    IgnoreFindingPayload:
      properties:
        fingerprint:
          type: string
          maxLength: 128
          minLength: 1
          title: Fingerprint
          description: >-
            The finding's
            [fingerprint](/developers/references/apps-api/sections/security#findings-and-fingerprints),
            as returned by [Get security
            scan](/api-reference/get-security-scan). Up to 128 characters.
          example: 3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e
        finding_type:
          type: string
          maxLength: 64
          minLength: 1
          title: Finding Type
          description: >-
            The finding's
            [type](/developers/references/apps-api/sections/security#scan-findings),
            which matches the group it came from in [Get security
            scan](/api-reference/get-security-scan). Any other value is accepted
            and nothing is recorded.
          example: static_code
        file_path:
          type: string
          maxLength: 1024
          title: File Path
          description: >-
            Path of the file the finding points at, kept with the ignore as a
            record of what was ignored. Up to 1,024 characters. Defaults to an
            empty string.
          default: ''
          example: src/pages/Orders.jsx
        title:
          type: string
          maxLength: 2000
          title: Title
          description: >-
            Short name for the finding, kept with the ignore as a record of what
            was ignored. Up to 2,000 characters. Defaults to an empty string.
          default: ''
          example: Order lookup trusts a client-supplied ID
      additionalProperties: false
      type: object
      required:
        - fingerprint
        - finding_type
      title: IgnoreFindingPayload
      description: The security finding to ignore.
    SecurityFindingIgnoreStatus:
      properties:
        status:
          type: string
          title: Status
          description: Always `ok`, including when nothing changed.
          example: ok
      type: object
      required:
        - status
      title: SecurityFindingIgnoreStatus
  securitySchemes:
    PersonalAccessTokenAuth:
      type: http
      scheme: bearer
      description: >-
        Personal access token, sent as `Authorization: Bearer <token>`. Each
        operation lists the permission it needs: `read_only` or `full_access`. A
        full-access token can call every operation. A read-only token can call
        only the operations that list `read_only`; anything else returns 403
        `read_only_credential_route_not_allowed`.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.