--- title: List scans description: Scans of the organization, newest first. Requires code-audit.read. type: api-reference source: ./openapi/inth-api.json method: get path: /v1/code-audit/scans operationId: listCodeAuditScans server: https://api.inth.com apiVersion: 1.0.0 tags: - Code Audit canonicalUrl: https://inth.com/docs/api/rest-api/code-audit/list-code-audit-scans lastModified: "2026-09-08T10:41:29.401Z" --- ```http GET /v1/code-audit/scans ``` Server: `https://api.inth.com` Operation ID: `listCodeAuditScans` ## Authentication * bearerAuth ### Schemes * bearerAuth: http / bearer - Use an Inth API key or OAuth access token in the Authorization header. Every operation needs a capability. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (\`organizations.read\`, \`projects.read\`, \`projects.write\`, \`api-keys.read\`, \`inbox.read\`, \`billing.read\`). A credential without the capability an operation needs is answered with \`403 INSUFFICIENT\_SCOPE\`. \`GET /v1/me\` reports the capabilities of the calling credential. OAuth scopes: - \`organizations.read\`: List the organizations you belong to. - \`organizations.write\`: Create organizations you will own. - \`projects.read\`: Read projects and their consent configuration. - \`projects.write\`: Create, update, and delete projects and their consent configuration. - \`members.read\`: Read member names, email addresses, profile images, roles, and pending invitation email addresses. - \`members.write\`: Invite members, change member roles, remove members, and cancel invitations. - \`api-keys.read\`: List organization API keys. - \`api-keys.write\`: Create, roll, and delete organization API keys. - \`code-audit.read\`: Read Code Audit scans, their findings, and connected repositories. - \`code-audit.write\`: Start Code Audit scans and unlock their reports. - \`inbox.read\`: Read Inbox findings. - \`inbox.write\`: Change the status of Inbox findings and open GitHub issues for them. - \`billing.read\`: Read the plan and credit balance of an organization. ## Request ### Query Parameters |Name|Type|Required|Description| |:--|:--|:--|:--| |`organizationId`|string|optional|Organization to act in. Defaults to the active organization of the credential; organization API keys always act in their own.| |`repositoryId`|string|optional|Only scans of this repository.| |`status`|string|optional|Only scans in this status.| |`limit`|integer|required|Page size, between 1 and 100.| |`cursor`|string|optional|Opaque cursor from the previous page’s pagination.nextCursor.| ## Code Examples ### cURL ```bash curl -X GET "https://api.inth.com/v1/code-audit/scans?limit=50" \ -H "Authorization: Bearer " ``` ### JavaScript ```ts const response = await fetch("https://api.inth.com/v1/code-audit/scans?limit=50", { method: "GET", headers: { "Authorization": "Bearer " }, }); const data = await response.json(); ``` ## Responses ### 200 Scans. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`data`|object\[]|required|| |`data[].id`|string|required|| |`data[].organizationId`|string|required|| |`data[].repositoryId`|string|required|| |`data[].repositoryName`|string|required|| |`data[].branch`|string \|null|required|| |`data[].headCommitSha`|string \|null|required|| |`data[].pullRequestNumber`|integer \|null|required|| |`data[].scope`|string|required|What was scanned: repository, pull\_request, and so on.| |`data[].trigger`|string|required|What started the scan: manual, pull\_request, scheduled.| |`data[].status`|string|required|| |`data[].access`|"full" \|"free-preview" \|"locked"|required|Whether every finding is readable. A free preview shows a subset until unlocked.| |`data[].unlockCredits`|integer \|null|required|| |`data[].findingCount`|integer \|null|required|| |`data[].issueCount`|integer \|null|required|| |`data[].progress`|object \|null|required|| |`data[].createdAt`|string (date-time)|required|| |`data[].startedAt`|string \|null|required|| |`data[].completedAt`|string \|null|required|| |`pagination`|object|required|| |`pagination.nextCursor`|string \|null|required|| |`pagination.hasMore`|boolean|required|| Example: default ```json { "success": true, "data": [ { "id": "scan_123", "organizationId": "org_123", "repositoryId": "repo_123", "repositoryName": "website", "branch": "main", "headCommitSha": "9fceb02d0ae598e95dc970b74767f19372d61af8", "pullRequestNumber": null, "scope": "repository", "trigger": "manual", "status": "completed", "access": "free-preview", "unlockCredits": 25, "findingCount": 14, "issueCount": 9, "progress": null, "createdAt": "2026-01-05T09:30:00.000Z", "startedAt": "2026-01-05T09:30:05.000Z", "completedAt": "2026-01-05T09:41:12.000Z" } ], "pagination": { "nextCursor": null, "hasMore": false } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "data", "pagination" ], "properties": { "success": { "type": "boolean", "const": true }, "data": { "type": "array", "items": { "type": "object", "required": [ "id", "organizationId", "repositoryId", "repositoryName", "branch", "headCommitSha", "pullRequestNumber", "scope", "trigger", "status", "access", "unlockCredits", "findingCount", "issueCount", "progress", "createdAt", "startedAt", "completedAt" ], "properties": { "id": { "type": "string" }, "organizationId": { "type": "string" }, "repositoryId": { "type": "string" }, "repositoryName": { "type": "string" }, "branch": { "oneOf": [ { "type": "string" }, { "type": "null" } ] }, "headCommitSha": { "oneOf": [ { "type": "string" }, { "type": "null" } ] }, "pullRequestNumber": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] }, "scope": { "type": "string", "description": "What was scanned: repository, pull_request, and so on." }, "trigger": { "type": "string", "description": "What started the scan: manual, pull_request, scheduled." }, "status": { "type": "string" }, "access": { "type": "string", "enum": [ "full", "free-preview", "locked" ], "description": "Whether every finding is readable. A free preview shows a subset until unlocked." }, "unlockCredits": { "oneOf": [ { "type": "integer", "description": "Credits needed to unlock a free preview." }, { "type": "null" } ] }, "findingCount": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] }, "issueCount": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] }, "progress": { "oneOf": [ { "type": "object", "required": [ "stage", "stageStatus", "completedStages", "totalStages" ], "properties": { "stage": { "type": "string" }, "stageStatus": { "oneOf": [ { "type": "string" }, { "type": "null" } ] }, "completedStages": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] }, "totalStages": { "oneOf": [ { "type": "integer" }, { "type": "null" } ] } } }, { "type": "null" } ] }, "createdAt": { "type": "string", "format": "date-time" }, "startedAt": { "oneOf": [ { "type": "string", "format": "date-time" }, { "type": "null" } ] }, "completedAt": { "oneOf": [ { "type": "string", "format": "date-time" }, { "type": "null" } ] } } } }, "pagination": { "type": "object", "required": [ "nextCursor", "hasMore" ], "properties": { "nextCursor": { "oneOf": [ { "type": "string", "description": "Cursor for the next page; null on the last page." }, { "type": "null" } ] }, "hasMore": { "type": "boolean" } } } } } ``` ### 400 The request payload or parameters are invalid. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: default ```json { "success": false, "error": { "code": "INVALID_PAYLOAD", "message": "Invalid request payload", "details": [ { "code": "too_small", "message": "Too small: expected string to have >=1 characters", "path": [ "name" ] } ] } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ### 401 Authentication is missing, invalid, or expired. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: default ```json { "success": false, "error": { "code": "UNAUTHORIZED", "message": "Authentication required" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ### 403 The credential is valid but may not perform the operation. \`INSUFFICIENT\_SCOPE\`: the credential was never granted the capability the operation needs. \`details.requiredScope\` names it, and the \`WWW-Authenticate\` header carries \`Bearer error="insufficient\_scope"\`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. \`FORBIDDEN\`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: insufficientScope ```json { "success": false, "error": { "code": "INSUFFICIENT_SCOPE", "message": "This token was not granted the projects.write scope", "details": { "requiredScope": "projects.write" } } } ``` Example: forbidden ```json { "success": false, "error": { "code": "FORBIDDEN", "message": "Organization membership is required" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` #### Headers |Name|Type|Required|Description| |:--|:--|:--|:--| |`WWW-Authenticate`|string|optional|Present on \`INSUFFICIENT\_SCOPE\`: \`Bearer error="insufficient\_scope", scope="\"\`.| ### 429 The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: default ```json { "success": false, "error": { "code": "RATE_LIMITED", "message": "API key rate limit exceeded" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ### 500 An unexpected internal error occurred. Content type: application/json |Property|Type|Required|Description| |:--|:--|:--|:--| |`success`|boolean|required|| |`error`|object|required|| |`error.code`|"UNAUTHORIZED" \|"FORBIDDEN" \|"INSUFFICIENT\_SCOPE" \|"PLAN\_LIMIT\_REACHED" \|"PLAN\_REQUIRED" \|"INVALID\_ORIGIN" \|"INVALID\_REGION" \|"INVALID\_PAYLOAD" \|"NOT\_FOUND" \|"CONFLICT" \|"KEY\_LIMIT\_REACHED" \|"INSUFFICIENT\_CREDITS" \|"SCAN\_IN\_PROGRESS" \|"UNLOCK\_REQUIRED" \|"REPOSITORY\_NOT\_LINKED" \|"PAYLOAD\_TOO\_LARGE" \|"RATE\_LIMITED" \|"SERVICE\_UNAVAILABLE" \|"INTERNAL\_ERROR"|required|| |`error.message`|string|required|| |`error.details`|unknown|optional|Optional structured error details.| Example: default ```json { "success": false, "error": { "code": "INTERNAL_ERROR", "message": "Internal server error" } } ``` JSON Schema: ```json { "type": "object", "required": [ "success", "error" ], "properties": { "success": { "type": "boolean", "const": false }, "error": { "type": "object", "required": [ "code", "message" ], "properties": { "code": { "type": "string", "enum": [ "UNAUTHORIZED", "FORBIDDEN", "INSUFFICIENT_SCOPE", "PLAN_LIMIT_REACHED", "PLAN_REQUIRED", "INVALID_ORIGIN", "INVALID_REGION", "INVALID_PAYLOAD", "NOT_FOUND", "CONFLICT", "KEY_LIMIT_REACHED", "INSUFFICIENT_CREDITS", "SCAN_IN_PROGRESS", "UNLOCK_REQUIRED", "REPOSITORY_NOT_LINKED", "PAYLOAD_TOO_LARGE", "RATE_LIMITED", "SERVICE_UNAVAILABLE", "INTERNAL_ERROR" ] }, "message": { "type": "string" }, "details": { "description": "Optional structured error details." } } } } } ``` ## Related * [REST API overview](/docs/api/rest-api): Every operation in this API.