There are some improvements I've made in your code, see below:
https://[username]:[apiKey]@api.softlayer.com/rest/v3/SoftLayer_Account/getSecurityScanRequests?objectMask=mask[id,ipAddress,createDate, status[name],guest[id, primaryBackendIpAddress],hardware[id, primaryBackendIpAddress], hostId, guestId, hardwareId]&objectFilter={"securityScanRequests":{"status":{"id":{"operation":[statusId]}}}}
Besides using masks to retrieve the server ids, you required to make use of Object Filters to return only the vulnerability scans, like in this example you should change the value [statusId] for 103 to return the "Scan Complete" objects, don't forget to change username and apiKey values for valid credentials.
Notice that each message status for vulnerability scann has a name, for example The status messages are as follows:
*Scan Pending
*Scan Processing
*Scan Complete (103)
*Scan Cancelled
*Generating Report.
For more information, see below:
https://sldn.softlayer.com/article/object-filters
https://sldn.softlayer.com/article/object-masks
http://sldn.softlayer.com/reference/datatypes/SoftLayer_Network_Security_Scanner_Request_Status