> ## Documentation Index > Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt > Use this file to discover all available pages before exploring further. # Export Hotlist to Excel > Renders every finding matching `filters` and `search` — ranked exactly as the findings endpoint returns them — into an Excel (.xlsx) workbook, and returns a presigned download link valid for five minutes. The workbook is a single `Hotlist` sheet with a frozen, auto-filtered header row covering rank, finding, identifier, type, severity, location, priority score and signals, exploit / KEV / fixable flags, ticket status, provider, assignee, provider status, SLA due date and status, ticket URL, file path, line and compliance frameworks. Unlike the findings endpoint this is not paginated — the export always holds the complete filtered list. Omit `filters` and `search` to export the entire Hotlist. ## OpenAPI ````yaml /openapi.json post /api/security/hotlist/export openapi: 3.0.3 info: title: CodeAnt AI API description: >- API for code analysis (SAST, SCA, secrets, IaC) and developer productivity metrics. Supports GitHub, GitLab, Bitbucket, and Azure DevOps. version: 1.0.0 servers: - url: https://api.codeant.ai description: Production server security: [] tags: - name: Analysis description: Code analysis operations - name: Agent Analysis description: >- AI-powered agent analysis operations. Uses LLM-based code exploration agents to perform deep security threat hunting, bug finding, and custom analysis with reflection-based false positive filtering. - name: Developer Metrics - Teams description: >- Manage developer teams: create, update, delete teams and manage team membership. Teams are used to organize developers and scope metrics. - name: Developer Metrics description: >- Developer productivity and activity metrics: active developers, PR throughput, individual comparisons, and AI-generated summaries. All endpoints support GitHub, GitLab, Bitbucket, and Azure DevOps. - name: Audit Logs description: >- Read-only access to your organization's audit trail for compliance, ETL and SIEM ingestion. Events are immutable, retained for 180 days, and cover security-relevant actions: user management, access control, credentials, scan triggers, configuration changes and data exports. Secrets and tokens are redacted and never appear in any response format. - name: Container Scanning description: >- Container image vulnerability scanning across AWS ECR, Azure ACR, and GCP GAR registries. List tracked containers with their latest scan, then fetch the full vulnerability findings of a scan — the same data shown on the Cloud Security → Container Scanning page. Authenticate with a CodeAnt API token (requires the `view_cloud_security: read` permission when token scoping is configured). - name: Security Hotlist description: >- The organization-wide security Hotlist: every SCA, SAST, secrets, IaC, cloud (CSPM) and AI-exploitation finding, deduplicated and priority-scored into one ranked list with live ticket, assignee and SLA state. Query it with filters, facets and cursor pagination, or export the full filtered list as an Excel workbook. Authenticate with a CodeAnt API token (requires the `view_code_security: read` permission when token scoping is configured). paths: /api/security/hotlist/export: post: tags: - Security Hotlist summary: Export Hotlist to Excel description: >- Renders every finding matching `filters` and `search` — ranked exactly as the findings endpoint returns them — into an Excel (.xlsx) workbook, and returns a presigned download link valid for five minutes. The workbook is a single `Hotlist` sheet with a frozen, auto-filtered header row covering rank, finding, identifier, type, severity, location, priority score and signals, exploit / KEV / fixable flags, ticket status, provider, assignee, provider status, SLA due date and status, ticket URL, file path, line and compliance frameworks. Unlike the findings endpoint this is not paginated — the export always holds the complete filtered list. Omit `filters` and `search` to export the entire Hotlist. operationId: exportHotlistExcel requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/HotlistExportRequest' example: platform: github org: Example-Org filters: severities: - critical responses: '200': description: Workbook generated content: application/json: schema: type: object properties: status: type: string example: success download_url: type: string description: >- Presigned link to the .xlsx workbook. It needs no authentication and expires after `expires_in` seconds. expires_in: type: integer description: Lifetime of `download_url`, in seconds. example: 300 filename: type: string example: Hotlist_Example-Org_20260829T101500Z.xlsx size_bytes: type: integer finding_count: type: integer description: Rows written to the workbook. '202': description: The Hotlist snapshot is still building; retry shortly content: application/json: schema: $ref: '#/components/schemas/HotlistBuildingResponse' '400': description: Invalid filter or search content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Missing or invalid access token content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - BearerAuth: [] components: schemas: HotlistExportRequest: type: object description: >- Excel export request. `filters` and `search` behave exactly as they do for the findings endpoint, and the workbook contains every matching finding — not just one page. required: - platform - org properties: platform: type: string enum: - github - gitlab - bitbucket - azure_devops description: Git platform of the organization org: type: string description: Organization / workspace slug github_base_url: type: string description: >- Self-hosted instance URL (also gitlab_base_url / bitbucket_base_url / azure_devops_base_url). Defaults to the cloud host. example: https://github.com filters: $ref: '#/components/schemas/HotlistFilters' search: type: string description: >- Case-insensitive substring match over the finding title, identifier, location and file path. HotlistBuildingResponse: type: object description: >- The Hotlist snapshot is being materialized. Retry after `retry_after_seconds`. properties: state: type: string example: building started_at: type: string format: date-time retry_after_seconds: type: integer example: 3 ErrorResponse: type: object properties: error: type: string description: Error message HotlistFilters: type: object description: >- Values within one dimension are ORed; dimensions are ANDed together. Omit a dimension, or send an empty list, to leave it unfiltered. Use the `facets` of a previous response to discover the values available in your organization. properties: types: type: array description: Scanner that produced the finding. items: type: string enum: - SCA - SAST - Secrets - IaC - Infrastructure - AI Exploitation severities: type: array items: type: string enum: - critical - high - medium - low - unknown locations: type: array description: >- Repository full names, or cloud account identifiers for Infrastructure findings. items: type: string ticket_statuses: type: array items: type: string enum: - created - not_created assignees: type: array description: >- Assignee email (lowercased) or provider user id, as returned in each finding's `assignee`. items: type: string provider_statuses: type: array description: >- Native workflow state names from the linked ticket provider, e.g. `In Progress`. items: type: string sla_statuses: type: array items: type: string enum: - breached - on_track - met - no_sla compliance: type: array items: type: string enum: - soc2 validation: type: array description: Restrict to findings CodeAnt has actively proven exploitable. items: type: string enum: - exploit_confirmed securitySchemes: BearerAuth: type: http scheme: bearer description: >- CodeAnt API token (`cdt_...`), created on the Settings → API Tokens page. Pass via `Authorization: Bearer ` header. ````