CSV Export
Every scan run can be exported as CSV: one row per finding, containing safe metadata only. It is the format to hand to an auditor, feed into a ticketing system, or keep as evidence past the retention window.
There is no export button in the UI today. The export is an admin-only API
endpoint, and every export is written to the audit log
as FINDINGS_CSV_EXPORTED with the scan run ID and the exported row count.
Fetching an export
curl -H "Authorization: Bearer <admin-access-token>" \
-o findings-scan-42.csv \
https://riskscanner.example.com/api/scans/42/export/csv
The response is text/csv and is named findings-scan-<id>.csv.
Columns
| Column | Meaning |
|---|---|
scan_run_id | The scan run this finding belongs to. |
finding_id | Stable identifier of the finding. |
jira_base_url_hash | Hash of the Jira base URL the scan ran against, so exports from different instances stay distinguishable without disclosing the URL. |
project_key | Jira project key. |
issue_key | Jira issue key. |
content_type | Where the match sat: issue field, comment, or attachment. |
field_id | Field the match came from, when applicable. |
comment_id | Comment the match came from, when applicable. |
text_variant | Whether the match was found in rendered text or the raw field value. |
offset_start | Character offset where the match begins. |
offset_end | Character offset where the match ends. |
rule_id | The detection rule that matched. |
rule_version_id | The exact rule version that produced the finding. |
severity | INFO, LOW, MEDIUM, HIGH, or CRITICAL. |
review_status | OPEN, FALSE_POSITIVE, ACCEPTED_RISK, or FIXED. |
detection_state | ACTIVE, NOT_FOUND_IN_LATEST_FULL_SCAN (the finding existed before but the latest full scan no longer sees it), or SOURCE_UNAVAILABLE. |
What is deliberately not in the export
The matched value, and any excerpt of the text around it. The export
carries no excerpt column of any kind, and there is nowhere else to find one:
the scanner stores no excerpt at all, only a keyed fingerprint and a source
locator. The file tells a reader precisely where to look - issue, field, and
character offsets - and leaves the value itself in Jira.
This is what makes the file safe to move around: a CSV of findings can be
attached to a ticket or mailed to an auditor without becoming a second copy of
the very data you are trying to contain. To read a value, open the issue in
Jira using the issue_key.