# GET /api/v1/app/{appId}/profile/results/list

**List profile scan results**

Retrieves a paginated list of profile scan results for an application.

> Requires `read:scan` permission.

## Parameters

- `appId` (in: path, string<uuid>) *(required)* — UUID identifier for this StackHawk Application.
- `limit` (in: query, integer<int32>) — Maximum number of results to return (default 10, max 50).

## Responses

### 200 — OK

#### application/json

- `profileScanResults` (scanresults.ProfileScanResult[])
  - `assets` (scanresults.AssetInventory)
    - `assetSummary` (scanresults.AssetSummary)
      - `dynamicContent` (scanresults.AssetCategoryCount)
        - `count` (integer<int32>)
        - `sampleUrls` (string[])
        - `totalSizeBytes` (integer<int64>)
      - `scripts` (scanresults.AssetCategoryCount)
        - `count` (integer<int32>)
        - `sampleUrls` (string[])
        - `totalSizeBytes` (integer<int64>)
      - `staticMedia` (scanresults.AssetCategoryCount)
        - `count` (integer<int32>)
        - `sampleUrls` (string[])
        - `totalSizeBytes` (integer<int64>)
    - `buildStrategy` (string) — Build analysis
    - `optimizationNotes` (string[])
    - `totalAssets` (integer<int32>) — Summary
    - `totalSizeBytes` (integer<int64>)
  - `authConfigPresent` (boolean)
  - `authMarkers` (scanresults.AuthMarker[]) — Authentication markers detected
    - `confidence` (string)
    - `evidence` (string)
    - `signals` (scanresults.AuthSignal[])
      - `detail` (string)
      - `signalType` (string)
    - `type` (string)
  - `classification` (string) — Application classification
  - `discoveredOpenapiSpecPath` (string) — Path where OpenAPI/Swagger spec was discovered (e.g., "/api/v3/api-docs") Empty if no spec was discovered
  - `paths` (scanresults.PathDiscovery)
    - `authProtectedCount` (integer<int32>)
    - `dynamicCount` (integer<int32>)
    - `samplesAuthProtected` (scanresults.PathInfo[])
      - `authEvidence` (string)
      - `method` (string)
      - `url` (string)
    - `samplesDynamic` (scanresults.PathInfo[])
      - `authEvidence` (string)
      - `method` (string)
      - `url` (string)
    - `samplesStatic` (scanresults.PathInfo[]) — Sample paths (up to 10 each for UI display)
      - `authEvidence` (string)
      - `method` (string)
      - `url` (string)
    - `staticCount` (integer<int32>)
    - `total` (integer<int32>) — Total counts
  - `recommendations` (string[]) — Actionable recommendations
  - `scanId` (string)
  - `score` (string) — Testability assessment
  - `scoreReasons` (string[])
  - `timestamp` (integer<int64>)

### 401 — Unauthorized

- (no body)