--- title: Get scan description: One scan with its status, progress, counts, and whether its report is locked. Requires code-audit.read. type: api-reference source: ./openapi/inth-api.json method: get path: /v1/code-audit/scans/{scanId} operationId: getCodeAuditScan server: https://api.inth.com apiVersion: 1.0.0 tags: - Code Audit canonicalUrl: https://inth.com/docs/api/rest-api/code-audit/get-code-audit-scan lastModified: "2026-09-08T10:41:29.401Z" --- ```http GET /v1/code-audit/scans/{scanId} ``` Server: `https://api.inth.com` Operation ID: `getCodeAuditScan` ## Authentication * bearerAuth ### Schemes * bearerAuth: http / bearer - Use an Inth API key or OAuth access token in the Authorization header. Every operation needs a capability. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (\`organizations.read\`, \`projects.read\`, \`projects.write\`, \`api-keys.read\`, \`inbox.read\`, \`billing.read\`). A credential without the capability an operation needs is answered with \`403 INSUFFICIENT\_SCOPE\`. \`GET /v1/me\` reports the capabilities of the calling credential. OAuth scopes: - \`organizations.read\`: List the organizations you belong to. - \`organizations.write\`: Create organizations you will own. - \`projects.read\`: Read projects and their consent configuration. - \`projects.write\`: Create, update, and delete projects and their consent configuration. - \`members.read\`: Read member names, email addresses, profile images, roles, and pending invitation email addresses. - \`members.write\`: Invite members, change member roles, remove members, and cancel invitations. - \`api-keys.read\`: List organization API keys. - \`api-keys.write\`: Create, roll, and delete organization API keys. - \`code-audit.read\`: Read Code Audit scans, their findings, and connected repositories. - \`code-audit.write\`: Start Code Audit scans and unlock their reports. - \`inbox.read\`: Read Inbox findings. - \`inbox.write\`: Change the status of Inbox findings and open GitHub issues for them. - \`billing.read\`: Read the plan and credit balance of an organization. ## Request ### Path Parameters |Name|Type|Required|Description| |:--|:--|:--|:--| |`scanId`|string|required|Scan ID.| ## Code Examples ### cURL ```bash curl -X GET "https://api.inth.com/v1/code-audit/scans/scan_123" \ -H "Authorization: Bearer " ``` ### JavaScript ```ts const response = await fetch("https://api.inth.com/v1/code-audit/scans/scan_123", { method: "GET", headers: { "Authorization": "Bearer " }, }); const data = await response.json(); ``` ## Responses ### 200 Requested scan. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`data`|object|required|| |`data.id`|string|required|| |`data.organizationId`|string|required|| |`data.repositoryId`|string|required|| |`data.repositoryName`|string|required|| |`data.branch`|string \|null|required|| |`data.headCommitSha`|string \|null|required|| |`data.pullRequestNumber`|integer \|null|required|| |`data.scope`|string|required|What was scanned: repository, pull\_request, and so on.| |`data.trigger`|string|required|What started the scan: manual, pull\_request, scheduled.| |`data.status`|string|required|| |`data.access`|"full" \|"free-preview" \|"locked"|required|Whether every finding is readable. A free preview shows a subset until unlocked.| |`data.unlockCredits`|integer \|null|required|| |`data.findingCount`|integer \|null|required|| |`data.issueCount`|integer \|null|required|| |`data.progress`|object \|null|required|| |`data.createdAt`|string (date-time)|required|| |`data.startedAt`|string \|null|required|| |`data.completedAt`|string \|null|required|| Example: default ```json { "success": true, "data": { "id": "scan_123", "organizationId": "org_123", "repositoryId": "repo_123", "repositoryName": "website", "branch": "main", "headCommitSha": "9fceb02d0ae598e95dc970b74767f19372d61af8", "pullRequestNumber": null, "scope": "repository", "trigger": "manual", "status": "completed", "access": "free-preview", "unlockCredits": 25, "findingCount": 14, "issueCount": 9, "progress": null, "createdAt": "2026-01-05T09:30:00.000Z", "startedAt": "2026-01-05T09:30:05.000Z", "completedAt": "2026-01-05T09:41:12.000Z" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "data" ], "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "object", "required": [ "id", "organizationId", "repositoryId", "repositoryName", "branch", "headCommitSha", "pullRequestNumber", "scope", "trigger", "status", "access", "unlockCredits", "findingCount", "issueCount", "progress", "createdAt", "startedAt", "completedAt" ], "properties": { "id": { "type": "string" }, "organizationId": { "type": "string" }, "repositoryId": { "type": "string" }, "repositoryName": { "type": "string" }, "branch": { "oneOf": [ { "type": "string" }, { "type": "null" } ] }, "headCommitSha": { "oneOf": [ { "type": "string" }, { "type": "null" } ] }, "pullRequestNumber": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] }, "scope": { "type": "string", "description": "What was scanned: repository, pull_request, and so on." }, "trigger": { "type": "string", "description": "What started the scan: manual, pull_request, scheduled." }, "status": { "type": "string" }, "access": { "type": "string", "enum": [ "full", "free-preview", "locked" ], "description": "Whether every finding is readable. A free preview shows a subset until unlocked." }, "unlockCredits": { "oneOf": [ { "type": "integer", "description": "Credits needed to unlock a free preview." }, { "type": "null" } ] }, "findingCount": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] }, "issueCount": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] }, "progress": { "oneOf": [ { "type": "object", "required": [ "stage", "stageStatus", "completedStages", "totalStages" ], "properties": { "stage": { "type": "string" }, "stageStatus": { "oneOf": [ { "type": "string" }, { "type": "null" } ] }, "completedStages": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] }, "totalStages": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] } } }, { "type": "null" } ] }, "createdAt": { "type": "string", "format": "date-time" }, "startedAt": { "oneOf": [ { "type": "string", "format": "date-time" }, { "type": "null" } ] }, "completedAt": { "oneOf": [ { "type": "string", "format": "date-time" }, { "type": "null" } ] } } } } } ``` ### 400 The request payload or parameters are invalid. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: default ```json { "success": false, "error": { "code": "INVALID_PAYLOAD", "message": "Invalid request payload", "details": [ { "code": "too_small", "message": "Too small: expected string to have >=1 characters", "path": [ "name" ] } ] } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ### 401 Authentication is missing, invalid, or expired. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: default ```json { "success": false, "error": { "code": "UNAUTHORIZED", "message": "Authentication required" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ### 403 The credential is valid but may not perform the operation. \`INSUFFICIENT\_SCOPE\`: the credential was never granted the capability the operation needs. \`details.requiredScope\` names it, and the \`WWW-Authenticate\` header carries \`Bearer error="insufficient\_scope"\`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. \`FORBIDDEN\`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: insufficientScope ```json { "success": false, "error": { "code": "INSUFFICIENT_SCOPE", "message": "This token was not granted the projects.write scope", "details": { "requiredScope": "projects.write" } } } ``` Example: forbidden ```json { "success": false, "error": { "code": "FORBIDDEN", "message": "Organization membership is required" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` #### Headers |Name|Type|Required|Description| |:--|:--|:--|:--| |`WWW-Authenticate`|string|optional|Present on \`INSUFFICIENT\_SCOPE\`: \`Bearer error="insufficient\_scope", scope="\"\`.| ### 404 The requested resource was not found. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: ```json { "success": true, "error": { "code": "UNAUTHORIZED", "message": "string", "details": {} } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ### 429 The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: default ```json { "success": false, "error": { "code": "RATE_LIMITED", "message": "API key rate limit exceeded" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ### 500 An unexpected internal error occurred. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: default ```json { "success": false, "error": { "code": "INTERNAL_ERROR", "message": "Internal server error" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ## Related * [REST API overview](/docs/api/rest-api): Every operation in this API.