Reports are generated per product, not from a single global tab. Each product that produces reports has its own Reports page in that product’s left-nav, and every report can be downloaded to your browser or emailed to recipients. Code Security and AI Pentest reports can additionally be scheduled to recur.
Reports are available both in the dashboard and via the REST API. Report generation, SBOM export, and schedule management all have JSON endpoints under /api, so CI pipelines and auditors can pull artifacts without opening the dashboard.
Where reports live
| Product | Dashboard path | Generation endpoint |
|---|
| Code Security | Code Security → Reports (/code-security/reports) | POST /api/code-security/reports/generate |
| Cloud Security (CSPM) | Cloud Security → Reports (/cloud-security/reports) | POST /api/cloud-security/reports/generate |
| AI Pentest | AI Pentest → Reports (/pentest/reports) | GET /api/pentest/reports/download |
| Compliance | Compliance → Reports (/compliance/reports) | — |
| Container Security | Container Security → Images → SBOM | GET /api/container-security/images/{imageId}/sbom |
Code Security reports
Sub-page: Code Security → Reports. Pick a report type and format, optionally scope to one repository, a branch, a date range, severities, and a scan source (all / CI-CD only / in-house only), then download or email it.
Report types: summary, sca, sast, secrets, iac, sbom, full, quality.
Formats: PDF, HTML, CSV, JSON, and CycloneDX (JSON, for the SBOM type).
| Report type | What it covers |
|---|
| Summary | One-glance executive summary — risk score, severity tiles, top findings across SCA, SAST, Secrets, and IaC. |
| SCA | Vulnerable and outdated dependencies with CVE IDs, CVSS, and fixed-in versions. |
| SAST | Static-analysis findings with rule IDs, file/line locations, and severity. |
| Secrets | Detected credentials — API keys, tokens, passwords, and private keys in source. |
| IaC | Terraform / Kubernetes / Dockerfile misconfigurations. |
| SBOM | Software bill of materials for the repository (CycloneDX). |
| Full | Comprehensive audit combining all categories with executive summary, risk score, and compliance mapping. |
| Quality | Code-quality posture — maintainability metrics (bugs, code smells, technical debt, quality gate) and top quality issues. |
POST /api/code-security/reports/generate accepts { type, format, repositoryId?, branch?, from?, to?, severities?, scanSource?, delivery?, emailRecipients? }. delivery is download (default, returns the file) or email (renders and sends to emailRecipients).
SBOM export
Beyond the sbom report type, a dedicated SBOM export endpoint serves multiple standards and serializations:
GET /api/reports/sbom/export?repository_id={id}&standard={cyclonedx|spdx}&format={json|text}
GET /api/reports/sbom/cyclonedx?repository_id={id} is a shorthand for CycloneDX JSON.
Container Security SBOM
Container SBOMs are reachable from Container Security → Images → <image> → SBOM, backed by GET /api/container-security/images/{imageId}/sbom. The SBOM is stored per scanned image. Container CVE / malware / misconfig findings are viewed in the Container Security UI rather than exported through a dedicated report generator.
Cloud Security (CSPM) reports
Sub-page: Cloud Security → Reports. Choose a report type and format, optionally scope by provider, cloud account, severities, compliance frameworks, and date range, then download or email it.
Report types: findings, compliance, assets, attack_paths, executive, full.
Formats: PDF, CSV, JSON, HTML.
| Report type | What it covers |
|---|
| Findings | CSPM posture findings for the selected provider(s) / account(s). |
| Compliance | Per-framework pass/fail breakdown, filterable by the frameworks list. |
| Assets | Discovered cloud assets in scope. |
| Attack paths | Graphed exposure paths across findings. |
| Executive | High-level summary for stakeholders. |
| Full | Combined findings, compliance, and assets. |
POST /api/cloud-security/reports/generate accepts { type, format, provider?, cloudAccountId?, severities?, frameworks?, from?, to?, includeResolved?, includeMuted?, delivery?, emailRecipients? }. See Compliance frameworks for how findings map to controls.AI Pentest (TigerStrike) reports
Sub-page: AI Pentest → Reports, backed by GET /api/pentest/reports/download.
Scopes: org (every finding in the org, optionally time-boxed), scan (one scan run), target (all scans for one target URL).
Formats: JSON, CSV, SARIF (2.1.0), HTML, PDF, and bundle (a gzip archive).
GET /api/pentest/reports/download?scope={org|scan|target}&format={json|csv|sarif|html|pdf|bundle}&scope_id={id}
Compliance reports
Sub-page: Compliance → Reports lists generated compliance artifacts for the org.
For cloud posture specifically, use the Cloud Security Compliance report type (above): it produces a per-framework pass/fail report and accepts a frameworks filter. How findings and evidence map to framework controls is documented in Compliance frameworks.
Scheduling reports
Code Security and AI Pentest reports can be scheduled to recur and email their output.
| Field | Code Security (/api/reports/schedules) | AI Pentest (/api/pentest/report-schedules) |
|---|
| Frequency | weekly, monthly | weekly, monthly |
| Scope | per_repository, organization | target, organization |
| Format | pdf, html, json, csv | pdf, html, json, sarif, csv, bundle |
| Recipients | Email addresses (required) | Email addresses (required) |
| Severity filter | Default critical, high | Default critical, high |
| Timezone / hour | timezone (default UTC), hour_of_day (0–23, default 9) | timezone (default UTC), hour_of_day (0–23, default 9) |
include_sbom is set (default on). Endpoints support create (POST), list (GET /schedules), update (PATCH), delete (DELETE), a manual POST /schedules/{id}/run-now (rate-limited to 3 manual sends per hour), and delivery history (GET /schedules/{id}/deliveries).
Delivery is email-only. Slack and webhook delivery of scheduled reports are not currently supported.
Retention
| Plan | Generated reports retained for |
|---|
| Free | 30 days |
| Business | 365 days |
| Enterprise | Indefinitely (subject to org retention policy) |
Permissions
All report endpoints require an authenticated session. Pentest report access additionally respects per-team finding ACLs — a team restricted from a specific target’s findings cannot export them.
| Role | Browse | Download | Schedule |
|---|
| Owner / Admin | Yes | Yes | Yes |
| Member | Yes | Yes | No |
| Viewer | Yes | No | No |
| Auditor | Yes | Yes | No |
