Skip to HighLevel documentation

Development build · Not released

Vibe App Scanner for HighLevel

Bring an existing website report into a client-care workflow. Retrieve reported finding counts, a coverage note and an authenticated report link. Your next HighLevel step can use those fields in a task or internal handoff you configure.

This app is in development and is not yet available in the HighLevel Marketplace. The setup instructions below describe the planned release.

What the first action does

Get Website Report takes one existing website report UUID. It reads the report for the connected VAS account and returns a summary. It does not start scans, create contacts or tasks, or send messages. It does not provide a completion trigger.

Prerequisites

  • A VAS account with REST API access and an existing website report.
  • An expiring API key with only the scan:read scope. Request a scoped key from VAS support.
  • A HighLevel sub-account with the approved app installed once released.
  • LC Premium Triggers & Actions enabled. HighLevel workflow executions may incur charges; verify the current charges in your HighLevel account.

The planned HighLevel permission is workflows.readonly so the installed app's action can appear in the workflow picker. VAS does not request contact-write access or store a HighLevel OAuth token for this report read.

Connect and read after release

  1. Install the released Vibe App Scanner app in the intended sub-account.
  2. Enter the report-only VAS key in the app's External Authentication password field. Keep keys out of workflow action fields, notes and contact records.
  3. Add Get Website Report and enter the UUID of a report owned by that VAS account. Use a fixed report ID for your first manual test.
  4. Run a test and inspect status, counts, coverage, report access and the report URL.
  5. Review recipient access and coverage before configuring a later task or message step.

Use a separate connection for each intended VAS account and HighLevel location. Sharing a connection across unrelated client locations exposes that VAS account's report summaries to those locations. Report links still require VAS sign-in and permission; sending a link does not grant access.

Output and troubleshooting

See the summary API reference for all fields. Pending counts are unknown. Zero is a reported zero, not a security guarantee. Failed scans can retain findings that need review. eligibleForNotification means a terminal report has confirmed access; you must still review coverage and the destination. The action sends nothing by itself.

For 401 or 403, check key expiry, scope and VAS REST eligibility. For 404, confirm report ownership and its UUID. For 429, wait before retrying this read. Other errors leave the read unconfirmed; do not create a replacement scan.

Data handling

The summary endpoint returns counts, fixed coverage notes and an authenticated report URL. Full findings, evidence, target URLs and account details are excluded by VAS before the response reaches HighLevel. Summary fields and report IDs can still appear in HighLevel execution history. Native credential masking and HTTP behavior must be verified before release.

Support: Contact VAS. Do not include keys or private findings in support messages.