> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Project Reports

> How to generate a frozen report of a project's posture at its latest completed scan, as a PDF, a CSV bundle, or both, and find it again on the project's Reports page.

A **project report** is a project's posture written down for a reader: its merge gate, vulnerabilities, licence obligations, cryptography and export, and AI provenance, as a PDF, a CSV bundle, or both. Attach one when someone asks where a project stands.

A project report isn't the same as a [snapshot report](/en/latest/earnie/evidence/exporting-sboms#snapshot-reports). A snapshot report describes one SBOM snapshot's inventory. A project report describes the project's posture at its latest completed scan.

**Before you start:**

* The project needs a completed full scan. A project whose posture comes from declared components only, such as an imported SBOM, can't have a report. Until there's a full scan, the dialog says "Run a full scan first: a report is frozen at a completed full scan."
* You need the Operator or Admin role to generate a report. Viewers can see and download reports but can't generate them.

## Generating a Report

<Steps>
  <Step title="Open the dialog">
    On the project's Dashboard, select **Report**, on the right beside **Edit**. You can also select **Generate report** on the project's **Reports** page.
  </Step>

  <Step title="Choose a template">
    Under **Template**, choose **Compliance** (the default), **Executive**, or **Operator**. The template sets who the document is written for and how many rows of the licence table the PDF prints: 5 for Executive, 15 for Compliance, and 40 for Operator. The CSV always has every row.
  </Step>

  <Step title="Check the anchor scan">
    **Anchor scan** is read-only. It names the scan the Dashboard describes, with its short ID, the day it completed, and its coverage. The report's numbers, verdicts, and dataset versions come from this scan. You don't choose it.
  </Step>

  <Step title="Choose sections and formats">
    Under **Sections**, every section you can see is on. Keep at least one. A section appears only when your organisation has the scanner behind it:

    | Section | Needs |
    | - | - |
    | **Merge gate** | Nothing extra |
    | **Vulnerabilities** | Open-source matching |
    | **License obligations** | Open-source matching |
    | **Cryptography and export** | Cryptography |
    | **AI provenance** | AI provenance |

    Under **Formats**, keep **PDF**, **CSV**, or both. Both are on to start with.
  </Step>

  <Step title="Generate">
    Select **Generate**. It stays disabled while Earnie generates the report. When it finishes, the dialog closes and a message offers **View reports**.
  </Step>
</Steps>

<Note>
  **Frozen and anchored.** Earnie draws a report once, when you generate it,
  and stores its files. Downloading it later returns those same files, so a
  report shows what was true at its anchor scan even after newer scans and
  decisions have moved the Dashboard on. If a newer scan completes while the
  dialog is open, Earnie tells you, shows the new anchor scan, and asks you to
  generate again, so you never freeze a scan you didn't look at.
</Note>

## What's in the Files

* **PDF** is an A4 portrait document.
* **CSV** is a ZIP of CSV files. `00-report.csv` holds the header, the figures at a glance, the headlines, and the dataset versions. Each section adds a file of its figures and, where the section has a chart by scan, a file with one row per scan.

A figure nobody measured reads "not measured" in a figures file and is an empty cell in a by-scan file, never a zero. As in snapshot reports, a cell a spreadsheet would read as a formula starts with an apostrophe, so opening the CSV never runs anything.

## The Reports Page

Select **Reports** in the project's sidebar to see every report for the project, newest first. Each row shows:

* **Template**: Compliance, Executive, or Operator
* **Anchor**: the anchor scan's short ID and date, linking to that scan
* **Date**: the day the report was generated
* **Formats**: the formats it was generated in
* **By**: who generated it
* **Download**: a button for each format

You can't edit or delete a report. To capture later changes, generate another one.

A report that covers a scanner you can't see isn't listed for you. Earnie keeps it, and it appears again once that scanner is enabled for you.

Earnie records each generation in the [audit log](/en/latest/earnie/evidence/audit-log) as `project_report.generated`.

## Through the API

| Endpoint | Does | Scope |
| - | - | - |
| `POST /v1/projects/{projectId}/reports` | Generates a report | `scans:write` |
| `GET /v1/projects/{projectId}/reports` | Lists the project's reports, newest first | `scans:read` |
| `GET /v1/projects/{projectId}/reports/{reportId}/files/{format}` | Downloads one file (`pdf` or `csv`) | `scans:read` |

The request body takes a `template` (`compliance`, `executive`, or `operator`) and `formats` (`pdf`, `csv`), and optionally `sections` (`merge_gate`, `vulnerabilities`, `license_obligations`, `cryptography_export`, `ai_provenance`) and `anchor_scan_id`. Leave out `sections` to get every section you can see.

Earnie always anchors the report to the project's latest completed scan. `anchor_scan_id` is only a check: if a newer scan has completed since, the request fails with `409 anchor_not_latest` and nothing is generated.

Other errors:

* `409 no_completed_scan`: the project has no completed scan to anchor to.
* `422 invalid_report`: an unknown or repeated template, section, or format, or no format.
* `422 section_not_visible`: you asked for a section you can't see.
* `404 format_not_rendered`: you asked to download a format the report wasn't generated in.

See [Using the API](/en/latest/earnie/api/using-the-api) for authentication and scopes.

## What's Next

A report shows where a project stands. When someone later asks why a decision was made, the answer is in [the audit log](/en/latest/earnie/evidence/audit-log).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.