API reference

Properties

A property groups one product's sites and repositories. These endpoints return its combined score, each tool's score, the findings of every tool merged into one list, and what to do next.

Properties are created in the app on Properties. The API reads them: any key works, including read-only keys. A team key sees the team's properties.

List properties

GET/api/v1/properties

Every property of the key's team (or its owner) with scores per tool.

Response

json

{
  "properties": [
    {
      "id": "cm9prop...",
      "name": "Acme Store",
      "category": "ecommerce",
      "client": null,
      "score": 76,
      "lastScannedAt": "2026-11-12T09:30:00.000Z",
      "openTasks": 4,
      "targets": [
        { "target": "shop.acme.com", "kind": "site" },
        { "target": "acme/storefront", "kind": "repo" }
      ],
      "tools": [
        { "tool": "audit", "score": 86, "change": 3, "scanned": 1, "of": 1, "at": "2026-11-12T09:30:00.000Z" },
        { "tool": "security", "score": 54, "change": -12, "scanned": 1, "of": 1, "at": "2026-11-10T08:00:00.000Z" }
      ]
    }
  ]
}

Get a property

GET/api/v1/properties/{id}

One property with its 30-day trend, merged issues and next steps.

Path parameters

Field	Description
`id`stringRequired	The property's id from the list.

Response

json

{
  "id": "cm9prop...",
  "name": "Acme Store",
  "score": 76,
  "trend": [{ "day": "2026-11-12", "score": 76 }],
  "issues": [
    {
      "title": "Missing Content-Security-Policy",
      "severity": "high",
      "tools": ["security", "audit"],
      "targets": ["shop.acme.com"],
      "places": 1,
      "task": { "id": "cm9task...", "status": "open", "assignee": "Sam Lee" },
      "url": "https://www.scanverra.com/security-scan/cm9scan...?finding=..."
    }
  ],
  "nextSteps": [
    { "kind": "secretsLive", "tool": "security", "target": "shop.acme.com", "url": "https://www.scanverra.com/security-scan?url=..." }
  ],
  "packs": [
    {
      "ref": "checkout-security",
      "name": "Checkout security",
      "official": true,
      "pass": false,
      "passed": 5,
      "total": 7,
      "rules": [
        { "kind": "minScore", "tool": "security", "expected": 85, "actual": 50, "pass": false }
      ]
    }
  ]
}

Fields

Field	Description
`score`number \| nullOptional	The combined health: each tool's average across the property's targets, then the tools averaged equally. null before anything was scanned.
`tools[]`object[]Optional	One entry per tool that has scanned the property: score, change since the previous scan, how many targets it scanned (scanned of of) and when.
`issues[]`object[]Optional	Findings of every tool's latest scans, merged: the same problem reported by two tools is one entry, with both in tools and how often it was found in places.
`issues[].task`object \| nullOptional	The open remediation task for the issue, if someone was assigned it.
`nextSteps[]`object[]Optional	What to scan or fix next, most urgent first (kinds below). url opens the right page with the target filled in.
`packs[]`object[]Optional	Policy packs installed on the property (from the marketplace), each checked against its latest scans: pass, how many rules pass (passed of total) and every rule with its threshold (expected) and current value (actual). Official pack names are in English.
`trend[]`object[]Optional	The combined score per day for the last 30 days.

Next step kinds

nextSteps read across tools, so a finding in one tool points at the scan or fix another tool makes possible.

secretsLive
The repo leaks a secret: check what the live site exposes.
regression
A tool's score fell 10 points or more since its previous scan.
run360
Most tools haven't checked a site yet.
headersInCode
The live site misses security headers and its repo is in the property.
neverScanned
One tool never ran on a target.
stale
The latest scan of a target is older than 30 days.
linkRepo
The property has sites but no repository.
addSite
The property has repositories but no site.

Examples

curl https://www.scanverra.com/api/v1/properties \
  -H "X-API-Key: $SCANVERRA_API_KEY"