Skip to main content
GET
Get Code Scan Profile

Permissions

Requires a service user or personal access token with the ViewAccountCodeScans permission at the enterprise level.

Behavior

Returns the profile’s metadata, visibility (org-owned or shared account-wide), include/exclude globs, and all of its guidance fields (investigation, communication, and ingestion-source guidance). Returns 404 when the profile does not exist or is not visible to the enterprise account. The organization-scoped equivalent is Get Code Scan Profile (Organization).

Authorizations

Authorization
string
header
required

Service User credential (prefix: cog_)

Path Parameters

profile_id
string
required

Response

Successful Response

Full details of a code scan profile, including its guidance.

created_at
integer
required

When the profile was created (unix seconds).

description
string | null
required

Description of the profile, if any.

exclude_globs
string[] | null
required

Glob patterns of files to exclude from the scan, if any.

include_globs
string[] | null
required

Glob patterns of files to include in the scan, if any.

ingestion_source_guidance
string | null
required

Guidance describing the ingestion source, if any.

investigation_guidance
string | null
required

Guidance for the investigation phase, if any.

mode
enum<string>
required

Profile mode: discover or ingest.

Available options:
discover,
ingest
name
string
required

Name of the profile.

org_id
string | null
required

Organization that owns the profile. Null when the profile is shared account-wide.

post_ingestion_guidance
string | null
required

Guidance for the post-ingestion phase, if any.

profile_id
string
required

Unique identifier for the profile.

remediation_guidance
string | null
required

Guidance for the remediation phase, if any.

report_guidance
string | null
required

Guidance for the report phase, if any.

scan_type
enum<string>
required

Type of scan the profile configures.

Available options:
security,
performance,
db-queries,
test-coverage,
dead-code,
code-quality,
telemetry,
accessibility,
general,
migration-docs
threat_model_guidance
string | null
required

Guidance describing the threat model, if any.

triage_guidance
string | null
required

Guidance for the triage phase, if any.

validation_guidance
string | null
required

Guidance for the validation phase, if any.

visibility
enum<string>
required

Whether the profile is owned by a single organization or shared across the whole account.

Available options:
org,
account
communication_guidance
string | null

Guidance for the communication phase (acting on final findings, e.g. notifying owners or stakeholders), if any.