Code Audit

List scans

Last updated September 8, 2026

get/v1/code-audit/scans

Authentication

bearerAuth

bearerAuth: http / bearer — Use an Inth API key or OAuth access token in the Authorization header. Every operation needs a capability. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (`organizations.read`, `projects.read`, `projects.write`, `api-keys.read`, `inbox.read`, `billing.read`). A credential without the capability an operation needs is answered with `403 INSUFFICIENT_SCOPE`. `GET /v1/me` reports the capabilities of the calling credential. OAuth scopes: - `organizations.read`: List the organizations you belong to. - `organizations.write`: Create organizations you will own. - `projects.read`: Read projects and their consent configuration. - `projects.write`: Create, update, and delete projects and their consent configuration. - `members.read`: Read member names, email addresses, profile images, roles, and pending invitation email addresses. - `members.write`: Invite members, change member roles, remove members, and cancel invitations. - `api-keys.read`: List organization API keys. - `api-keys.write`: Create, roll, and delete organization API keys. - `code-audit.read`: Read Code Audit scans, their findings, and connected repositories. - `code-audit.write`: Start Code Audit scans and unlock their reports. - `inbox.read`: Read Inbox findings. - `inbox.write`: Change the status of Inbox findings and open GitHub issues for them. - `billing.read`: Read the plan and credit balance of an organization.

Request

Query Parameters

Name	Type	Required	Description
`organizationId`	`string`	Optional	Organization to act in. Defaults to the active organization of the credential; organization API keys always act in their own.
`repositoryId`	`string`	Optional	Only scans of this repository.
`status`	`string`	Optional	Only scans in this status.
`limit`	`integer`	Required	Page size, between 1 and 100.
`cursor`	`string`	Optional	Opaque cursor from the previous page’s pagination.nextCursor.

Responses

`200`

Scans.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`data`	`object[]`	Required	—
`data[].id`	`string`	Required	—
`data[].organizationId`	`string`	Required	—
`data[].repositoryId`	`string`	Required	—
`data[].repositoryName`	`string`	Required	—
`data[].branch`	`string \| null`	Required	—
`data[].headCommitSha`	`string \| null`	Required	—
`data[].pullRequestNumber`	`integer \| null`	Required	—
`data[].scope`	`string`	Required	What was scanned: repository, pull_request, and so on.
`data[].trigger`	`string`	Required	What started the scan: manual, pull_request, scheduled.
`data[].status`	`string`	Required	—
`data[].access`	`"full" \| "free-preview" \| "locked"`	Required	Whether every finding is readable. A free preview shows a subset until unlocked.
`data[].unlockCredits`	`integer \| null`	Required	—
`data[].findingCount`	`integer \| null`	Required	—
`data[].issueCount`	`integer \| null`	Required	—
`data[].progress`	`object \| null`	Required	—
`data[].createdAt`	`string (date-time)`	Required	—
`data[].startedAt`	`string \| null`	Required	—
`data[].completedAt`	`string \| null`	Required	—
`pagination`	`object`	Required	—
`pagination.nextCursor`	`string \| null`	Required	—
`pagination.hasMore`	`boolean`	Required	—

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "data",
    "pagination"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": true
    },
    "data": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "id",
          "organizationId",
          "repositoryId",
          "repositoryName",
          "branch",
          "headCommitSha",
          "pullRequestNumber",
          "scope",
          "trigger",
          "status",
          "access",
          "unlockCredits",
          "findingCount",
          "issueCount",
          "progress",
          "createdAt",
          "startedAt",
          "completedAt"
        ],
        "properties": {
          "id": {
            "type": "string"
          },
          "organizationId": {
            "type": "string"
          },
          "repositoryId": {
            "type": "string"
          },
          "repositoryName": {
            "type": "string"
          },
          "branch": {
            "oneOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ]
          },
          "headCommitSha": {
            "oneOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ]
          },
          "pullRequestNumber": {
            "oneOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ]
          },
          "scope": {
            "type": "string",
            "description": "What was scanned: repository, pull_request, and so on."
          },
          "trigger": {
            "type": "string",
            "description": "What started the scan: manual, pull_request, scheduled."
          },
          "status": {
            "type": "string"
          },
          "access": {
            "type": "string",
            "enum": [
              "full",
              "free-preview",
              "locked"
            ],
            "description": "Whether every finding is readable. A free preview shows a subset until unlocked."
          },
          "unlockCredits": {
            "oneOf": [
              {
                "type": "integer",
                "description": "Credits needed to unlock a free preview."
              },
              {
                "type": "null"
              }
            ]
          },
          "findingCount": {
            "oneOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ]
          },
          "issueCount": {
            "oneOf": [
              {
                "type": "integer"
              },
              {
                "type": "null"
              }
            ]
          },
          "progress": {
            "oneOf": [
              {
                "type": "object",
                "required": [
                  "stage",
                  "stageStatus",
                  "completedStages",
                  "totalStages"
                ],
                "properties": {
                  "stage": {
                    "type": "string"
                  },
                  "stageStatus": {
                    "oneOf": [
                      {
                        "type": "string"
                      },
                      {
                        "type": "null"
                      }
                    ]
                  },
                  "completedStages": {
                    "oneOf": [
                      {
                        "type": "integer"
                      },
                      {
                        "type": "null"
                      }
                    ]
                  },
                  "totalStages": {
                    "oneOf": [
                      {
                        "type": "integer"
                      },
                      {
                        "type": "null"
                      }
                    ]
                  }
                }
              },
              {
                "type": "null"
              }
            ]
          },
          "createdAt": {
            "type": "string",
            "format": "date-time"
          },
          "startedAt": {
            "oneOf": [
              {
                "type": "string",
                "format": "date-time"
              },
              {
                "type": "null"
              }
            ]
          },
          "completedAt": {
            "oneOf": [
              {
                "type": "string",
                "format": "date-time"
              },
              {
                "type": "null"
              }
            ]
          }
        }
      }
    },
    "pagination": {
      "type": "object",
      "required": [
        "nextCursor",
        "hasMore"
      ],
      "properties": {
        "nextCursor": {
          "oneOf": [
            {
              "type": "string",
              "description": "Cursor for the next page; null on the last page."
            },
            {
              "type": "null"
            }
          ]
        },
        "hasMore": {
          "type": "boolean"
        }
      }
    }
  }
}

`400`

The request payload or parameters are invalid.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`401`

Authentication is missing, invalid, or expired.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`403`

The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

Headers

Name	Type	Description
`WWW-Authenticate`	`string`	Present on `INSUFFICIENT_SCOPE`: `Bearer error="insufficient_scope", scope="<required scope>"`.

`429`

The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`500`

An unexpected internal error occurred.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

REST API overview: Every operation in this API.

Examples

const response = await fetch("https://api.inth.com/v1/code-audit/scans?limit=50", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  },
});
const data = await response.json();

Response · 200

Example: default

{
  "success": true,
  "data": [
    {
      "id": "scan_123",
      "organizationId": "org_123",
      "repositoryId": "repo_123",
      "repositoryName": "website",
      "branch": "main",
      "headCommitSha": "9fceb02d0ae598e95dc970b74767f19372d61af8",
      "pullRequestNumber": null,
      "scope": "repository",
      "trigger": "manual",
      "status": "completed",
      "access": "free-preview",
      "unlockCredits": 25,
      "findingCount": 14,
      "issueCount": 9,
      "progress": null,
      "createdAt": "2026-01-05T09:30:00.000Z",
      "startedAt": "2026-01-05T09:30:05.000Z",
      "completedAt": "2026-01-05T09:41:12.000Z"
    }
  ],
  "pagination": {
    "nextCursor": null,
    "hasMore": false
  }
}

Response · 400

Example: default

{
  "success": false,
  "error": {
    "code": "INVALID_PAYLOAD",
    "message": "Invalid request payload",
    "details": [
      {
        "code": "too_small",
        "message": "Too small: expected string to have >=1 characters",
        "path": [
          "name"
        ]
      }
    ]
  }
}

Response · 401

Example: default

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}

Response · 403

Example: insufficientScope

{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "This token was not granted the projects.write scope",
    "details": {
      "requiredScope": "projects.write"
    }
  }
}

Example: forbidden

{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "Organization membership is required"
  }
}

Response · 429

Example: default

{
  "success": false,
  "error": {
    "code": "RATE_LIMITED",
    "message": "API key rate limit exceeded"
  }
}

Response · 500

Example: default

{
  "success": false,
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Internal server error"
  }
}

Authentication

Request

Query Parameters

Responses

200

400

401

403

Headers

429

500

Related

`200`

`400`

`401`

`403`

`429`

`500`