# SonarQube /api/security\_reports/show Categories: Mapping

**URL:** <https://community.sonarsource.com/t/sonarqube-api-security-reports-show-categories-mapping/145327>\
**Category:** SonarQube for IDE\
**Created:** [July 28, 2025, 11:37am UTC](https://community.sonarsource.com/t/sonarqube-api-security-reports-show-categories-mapping/145327 "2025-07-28T11:37:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mryaeu](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/mryaeu/32/66369_2.png) [@mryaeu](https://community.sonarsource.com/u/mryaeu)\
**Post date:** [July 28, 2025, 11:37am UTC](https://community.sonarsource.com/t/sonarqube-api-security-reports-show-categories-mapping/145327/1 "2025-07-28T11:37:49Z")

</div>

I am using the Sonar Qube API and specifically this endpoint: “/api/security\_reports/show”

The json that I get as a respone looks like this

```auto
{
        "categories": [
            {
                "category": "1",
                "vulnerabilities": 0,
                "toReviewSecurityHotspots": 0,
                "reviewedSecurityHotspots": 0,
                "securityReviewRating": 1,
                "distribution": [],
                "activeRules": 0,
                "totalRules": 0,
                "hasMoreRules": false
            },

```

I noticed that there are several different categories and I noticed that category 3 means authentication but I do not know what the other categories mean. Is there a list somewhere for the mapping? A link to an enum in a gitlab repo url would be enough.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [July 29, 2025, 8:25am UTC](https://community.sonarsource.com/t/sonarqube-api-security-reports-show-categories-mapping/145327/2 "2025-07-29T08:25:34Z")

</div>

Hello! Unfortunately, the public code for this feature isn’t available because it’s a commercial feature.

However, the logic is straightforward: the categories in the API are listed in the same order they appear in the UI.

For example, here’s what the API response looks like:

```auto
https://next.sonarqube.com/sonarqube/project/extension/securityreport/securityreport?id=SonarSource_echoes-react_AYvOIyNg-JQvdKIPB6Ig&standard=pciDss&version=4.0

```

```json
{
  "categories": [
    ...
    { "category": "1", ... },
    { "category": "2", ... },
    { "category": "3", ... },
    // and so on
  ]
}

```

And the [UI](https://next.sonarqube.com/sonarqube/project/extension/securityreport/securityreport?id=SonarSource_echoes-react_AYvOIyNg-JQvdKIPB6Ig&standard=pciDss&version=4.0) looks as so:

 ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/6/7/679a73e0a0a84e1e298a7df7b32b2f24fe58b37f.png)

Category mappings:

- `1` = `1 - Install and Maintain Network Security Controls`
- `2` = `2- Apply Secure Configurations to All System Components`
- etc…

This internal API is a bit rough, so use it at your own risk. The category order and values match what you see in the UI.