VAS report-summary API for automation

This reference describes report-summary routes for integration development. The HighLevel and Zapier apps are not yet available to install. The existing Make app continues to use its verified report-status route.

Authentication and connection check

Origin: https://api.vibeappscanner.com. Use HTTPS with Authorization: Bearer <VAS API key> and Accept: application/json. The key needs scan:read, an expiry and a REST-eligible VAS account. Current account eligibility and report ownership rules apply; these routes grant no new plan capabilities.

GET /integrations/connection: confirms the key and REST access.
POST /integrations/connection: the same read-only check for HighLevel's installation payload. The body is ignored and never saved. The protected Authorization header is required; a key in the body is not authentication.

A successful response is HTTP 200 with {"contract":"vas-report-connection-v1","connected":true}. No inventory, account name or email is returned. Use POST for HighLevel so its install fields are sent in a body instead of a URL query string.

Read one existing report

GET /integrations/reports/{scanId}

The ID must be a complete website report UUID. URLs, paths, whitespace and query strings are not IDs. The report must belong to the authenticated VAS account. There is no creation, polling, write or scan-start operation on this route.

Field	Meaning
`contract`	`vas-report-handoff-v1`
`id`, `scanId`	Existing report UUID
`status`, `terminal`	Recognized lifecycle and terminal-state flag
`findingsCount`	Reported nonnegative whole total, or null while pending/unknown
Severity count fields	`criticalFindingsCount`, `highFindingsCount`, `mediumFindingsCount`, `lowFindingsCount`, `infoFindingsCount`
`pageCoverage`	Known page category or `unknown`
`reviewRequired`	Always true
`coverageNote`	Fixed reminder to review incomplete or limited checks
`reportAccess`	`available`, `locked` or `unknown`
`reportUrl`	Authenticated link on vibeappscanner.com
`eligibleForNotification`	Terminal with confirmed access; sends nothing and still requires review
`summary`	Plain text constructed only from the allowed summary fields

Full findings, evidence, raw scanner messages, target URLs, secrets and account metadata are not included. A completed report with zero findings is not a security certification. Failed reports can retain findings; missing coverage stays unknown.

Errors and limits

400 means the report UUID is malformed; 401 means authentication failed; 403 means scope, plan or access was denied; 404 means the report is not available for the connected account; 429 means the existing key/global rate limit applies. A report that cannot be safely projected returns a fixed 502 message. No error starts a scan.

Responses use Cache-Control: private, no-store. The projection is deliberately small; Zapier bounds responses to 12,000 bytes and uses a 15-second HTTP timeout with redirects refused. HighLevel's native timeout, redirect and logging behavior must be verified in its tester before the integration is released.

Counts and report IDs may still be confidential. Automation platforms can retain summaries in execution history. Restrict destinations and access accordingly.