Code Audit

Get scan issues

Last updated September 8, 2026

get/v1/code-audit/scans/{scanId}/issues

Authentication

bearerAuth

bearerAuth: http / bearer — Use an Inth API key or OAuth access token in the Authorization header. Every operation needs a capability. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (`organizations.read`, `projects.read`, `projects.write`, `api-keys.read`, `inbox.read`, `billing.read`). A credential without the capability an operation needs is answered with `403 INSUFFICIENT_SCOPE`. `GET /v1/me` reports the capabilities of the calling credential. OAuth scopes: - `organizations.read`: List the organizations you belong to. - `organizations.write`: Create organizations you will own. - `projects.read`: Read projects and their consent configuration. - `projects.write`: Create, update, and delete projects and their consent configuration. - `members.read`: Read member names, email addresses, profile images, roles, and pending invitation email addresses. - `members.write`: Invite members, change member roles, remove members, and cancel invitations. - `api-keys.read`: List organization API keys. - `api-keys.write`: Create, roll, and delete organization API keys. - `code-audit.read`: Read Code Audit scans, their findings, and connected repositories. - `code-audit.write`: Start Code Audit scans and unlock their reports. - `inbox.read`: Read Inbox findings. - `inbox.write`: Change the status of Inbox findings and open GitHub issues for them. - `billing.read`: Read the plan and credit balance of an organization.

Request

Path Parameters

Name	Type	Required	Description
`scanId`	`string`	Required	Scan ID.

Responses

`200`

Scan findings.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`data`	`object`	Required	—
`data.scanId`	`string`	Required	—
`data.access`	`"full" \| "free-preview" \| "locked"`	Required	—
`data.totalCount`	`integer`	Required	—
`data.lockedCount`	`integer`	Required	Findings withheld until the report is unlocked.
`data.unlockCredits`	`integer \| null`	Required	—
`data.priorityCounts`	`object \| null`	Required	—
`data.issues`	`object[]`	Required	—
`data.issues[].id`	`string`	Required	—
`data.issues[].title`	`string`	Required	—
`data.issues[].description`	`string \| null`	Required	—
`data.issues[].priority`	`string`	Required	P0 to P3.
`data.issues[].reviewPriority`	`"urgent" \| "high" \| "normal" \| "low" \| null`	Required	—
`data.issues[].potentialImpact`	`"critical" \| "high" \| "medium" \| "low" \| null`	Required	—
`data.issues[].recommendation`	`string \| null`	Required	—
`data.issues[].files`	`string[]`	Required	—
`data.issues[].category`	`string \| null`	Required	—
`data.issues[].resolution`	`"active" \| "fixed" \| "superseded" \| null`	Required	—
`data.issues[].evidence`	`object \| null`	Required	—

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "data"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": true
    },
    "data": {
      "type": "object",
      "required": [
        "scanId",
        "access",
        "totalCount",
        "lockedCount",
        "unlockCredits",
        "priorityCounts",
        "issues"
      ],
      "properties": {
        "scanId": {
          "type": "string"
        },
        "access": {
          "type": "string",
          "enum": [
            "full",
            "free-preview",
            "locked"
          ]
        },
        "totalCount": {
          "type": "integer"
        },
        "lockedCount": {
          "type": "integer",
          "description": "Findings withheld until the report is unlocked."
        },
        "unlockCredits": {
          "oneOf": [
            {
              "type": "integer"
            },
            {
              "type": "null"
            }
          ]
        },
        "priorityCounts": {
          "oneOf": [
            {
              "type": "object",
              "required": [
                "P0",
                "P1",
                "P2",
                "P3"
              ],
              "properties": {
                "P0": {
                  "type": "integer"
                },
                "P1": {
                  "type": "integer"
                },
                "P2": {
                  "type": "integer"
                },
                "P3": {
                  "type": "integer"
                }
              }
            },
            {
              "type": "null"
            }
          ]
        },
        "issues": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "id",
              "title",
              "description",
              "priority",
              "reviewPriority",
              "potentialImpact",
              "recommendation",
              "files",
              "category",
              "resolution",
              "evidence"
            ],
            "properties": {
              "id": {
                "type": "string"
              },
              "title": {
                "type": "string"
              },
              "description": {
                "oneOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ]
              },
              "priority": {
                "type": "string",
                "description": "P0 to P3."
              },
              "reviewPriority": {
                "oneOf": [
                  {
                    "type": "string",
                    "enum": [
                      "urgent",
                      "high",
                      "normal",
                      "low"
                    ]
                  },
                  {
                    "type": "null"
                  }
                ]
              },
              "potentialImpact": {
                "oneOf": [
                  {
                    "type": "string",
                    "enum": [
                      "critical",
                      "high",
                      "medium",
                      "low"
                    ]
                  },
                  {
                    "type": "null"
                  }
                ]
              },
              "recommendation": {
                "oneOf": [
                  {
                    "type": "string"
                  },
                  {
                    "type": "null"
                  }
                ]
              },
              "files": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "category": {
                "oneOf": [
                  {
                    "type": "string",
                    "description": "Stable finding category, such as pii-in-logs."
                  },
                  {
                    "type": "null"
                  }
                ]
              },
              "resolution": {
                "oneOf": [
                  {
                    "type": "string",
                    "enum": [
                      "active",
                      "fixed",
                      "superseded"
                    ]
                  },
                  {
                    "type": "null"
                  }
                ]
              },
              "evidence": {
                "oneOf": [
                  {
                    "type": "object",
                    "required": [
                      "filePath",
                      "lineNumbers"
                    ],
                    "properties": {
                      "filePath": {
                        "type": "string"
                      },
                      "lineNumbers": {
                        "type": "array",
                        "items": {
                          "type": "integer"
                        }
                      },
                      "snippet": {
                        "type": "string"
                      },
                      "snippetStartLine": {
                        "type": "integer"
                      },
                      "snippetEndLine": {
                        "type": "integer"
                      }
                    }
                  },
                  {
                    "type": "null"
                  }
                ]
              }
            }
          }
        }
      }
    }
  }
}

`400`

The request payload or parameters are invalid.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`401`

Authentication is missing, invalid, or expired.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`403`

The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

Headers

Name	Type	Description
`WWW-Authenticate`	`string`	Present on `INSUFFICIENT_SCOPE`: `Bearer error="insufficient_scope", scope="<required scope>"`.

`404`

The requested resource was not found.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`429`

The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`500`

An unexpected internal error occurred.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

REST API overview: Every operation in this API.

Examples

const response = await fetch("https://api.inth.com/v1/code-audit/scans/scan_123/issues", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  },
});
const data = await response.json();

Response · 200

Example: default

{
  "success": true,
  "data": {
    "scanId": "scan_123",
    "access": "free-preview",
    "totalCount": 9,
    "lockedCount": 6,
    "unlockCredits": 25,
    "priorityCounts": {
      "P0": 0,
      "P1": 2,
      "P2": 5,
      "P3": 2
    },
    "issues": [
      {
        "id": "issue_123",
        "title": "Email addresses written to application logs",
        "description": "The checkout handler logs the full request body, which includes the customer email.",
        "priority": "P1",
        "reviewPriority": "high",
        "potentialImpact": "high",
        "recommendation": "Redact personal data before logging the request body.",
        "files": [
          "apps/web/src/checkout/handler.ts"
        ],
        "category": "pii-in-logs",
        "resolution": "active",
        "evidence": {
          "filePath": "apps/web/src/checkout/handler.ts",
          "lineNumbers": [
            42
          ]
        }
      }
    ]
  }
}

Response · 400

Example: default

{
  "success": false,
  "error": {
    "code": "INVALID_PAYLOAD",
    "message": "Invalid request payload",
    "details": [
      {
        "code": "too_small",
        "message": "Too small: expected string to have >=1 characters",
        "path": [
          "name"
        ]
      }
    ]
  }
}

Response · 401

Example: default

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}

Response · 403

Example: insufficientScope

{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "This token was not granted the projects.write scope",
    "details": {
      "requiredScope": "projects.write"
    }
  }
}

Example: forbidden

{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "Organization membership is required"
  }
}

Response · 404

Example

{
  "success": true,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "details": {}
  }
}

Response · 429

Example: default

{
  "success": false,
  "error": {
    "code": "RATE_LIMITED",
    "message": "API key rate limit exceeded"
  }
}

Response · 500

Example: default

{
  "success": false,
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Internal server error"
  }
}

Authentication

Request

Path Parameters

Responses

200

400

401

403

Headers

404

429

500

Related

`200`

`400`

`401`

`403`

`404`

`429`

`500`