Error
A valid request URL is required to generate request examples{
"version": "2.1.0",
"runs": [
{}
]
}{
"error": "Invalid or expired API token"
}{
"error": "<string>",
"code": "<string>",
"message": "<string>"
}Scans
Download scan results as SARIF 2.1.0
Returns a SARIF log for a COMPLETED scan — the standard format for GitHub Code Scanning, GitLab, Bitbucket, or Azure DevOps. Each result carries its BreachLens severity at result.properties.severity (CRITICAL | HIGH | MEDIUM | LOW | INFO) — the field the CLI counts for its --severity-gate. Requires the scans:read scope.
GET
/
api
/
scans
/
{scanId}
/
export.sarif
Error
A valid request URL is required to generate request examples{
"version": "2.1.0",
"runs": [
{}
]
}{
"error": "Invalid or expired API token"
}{
"error": "<string>",
"code": "<string>",
"message": "<string>"
}Authorizations
Scoped API token from Settings → API Tokens (scopes: scans:trigger, scans:read).
Headers
Cloudflare Access service-token client id (ends in .access). Only for CF-Access-fronted deployments; leave blank for self-hosted.
Cloudflare Access service-token secret. Pair it with CF-Access-Client-Id.
Path Parameters
Scan job ID (must be COMPLETED).