How do I check a CI-triggered scan's result through the API?

Steps

1. Save the scanId that POST /api/ci/scan gave you.
2. Send GET /api/ci/result/{scanId} with the header Authorization: Bearer YOUR_TOKEN.
3. Look at done. While it is false, the scan is still running.
4. Wait 30 seconds and ask again. Stop as soon as done turns true.
5. Read the result. It holds the status, the totals, the severity counts and a findings list.

Good to know

Each entry in the list has a severity, a title and a location. For a white-box scan the location is a file and line. Our ready-made job prints one line per finding in that shape. It then ends with a count of findings, which gives you a quick sense of the size of the problem before you open the app.

Your token needs scan:read to read the result. The trigger call needs ci:trigger, so a token used for both holds both permissions.

The generated job asks up to 120 times, 30 seconds apart. That is about an hour of waiting, and the in-app documentation says a typical scan of a small app takes roughly an hour. A larger application can run longer than your job waits. The scan itself carries on inside Cyberlop whether or not your job is still listening, so open Recent Scans later to see how it ended and to read the full set of findings with their evidence. For that case, see why the CI job stopped waiting.

Want findings in a richer shape, with confidence, class and triage status for every row? Use the Issues endpoint filtered by scan, which returns far more detail than the CI route does.

Related questions

• How do I trigger a Cyberlop scan from my CI pipeline?
• How do I pull the findings for one scan through the API?
• My CI job stopped waiting before the scan finished. Why?
• Why did my CI job pass even though Cyberlop found critical issues?
• How do I launch a scan through the API?

Full tutorial

How to add security scanning to your CI/CD pipeline

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre