Inbox

Get Inbox item

Last updated September 8, 2026

get/v1/inbox/{itemId}

Authentication

bearerAuth

bearerAuth: http / bearer — Use an Inth API key or OAuth access token in the Authorization header. Every operation needs a capability. An OAuth access token carries the capabilities it was granted as scopes; an organization API key carries a fixed set (`organizations.read`, `projects.read`, `projects.write`, `api-keys.read`, `inbox.read`, `billing.read`). A credential without the capability an operation needs is answered with `403 INSUFFICIENT_SCOPE`. `GET /v1/me` reports the capabilities of the calling credential. OAuth scopes: - `organizations.read`: List the organizations you belong to. - `organizations.write`: Create organizations you will own. - `projects.read`: Read projects and their consent configuration. - `projects.write`: Create, update, and delete projects and their consent configuration. - `members.read`: Read member names, email addresses, profile images, roles, and pending invitation email addresses. - `members.write`: Invite members, change member roles, remove members, and cancel invitations. - `api-keys.read`: List organization API keys. - `api-keys.write`: Create, roll, and delete organization API keys. - `code-audit.read`: Read Code Audit scans, their findings, and connected repositories. - `code-audit.write`: Start Code Audit scans and unlock their reports. - `inbox.read`: Read Inbox findings. - `inbox.write`: Change the status of Inbox findings and open GitHub issues for them. - `billing.read`: Read the plan and credit balance of an organization.

Request

Path Parameters

Name	Type	Required	Description
`itemId`	`string`	Required	Inbox item ID.

Responses

`200`

Requested item.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`data`	`object & object`	Required	—
`data.id`	`string`	Required	—
`data.organizationId`	`string`	Required	—
`data.title`	`string`	Required	—
`data.summary`	`string \| null`	Required	—
`data.priority`	`"P0" \| "P1" \| "P2" \| "P3" \| null`	Required	—
`data.status`	`"open" \| "accepted" \| "dismissed" \| "resolved"`	Required	—
`data.source`	`"advisory" \| "code-audit" \| "runtime"`	Required	—
`data.projectId`	`string \| null`	Required	—
`data.repositoryName`	`string \| null`	Required	—
`data.githubIssue`	`object \| null`	Required	—
`data.updatedAt`	`string (date-time)`	Required	—
`data.version`	`string`	Required	Send back as `version` when changing the status.
`data.codeEvidence`	`object \| null`	Required	—

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "data"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": true
    },
    "data": {
      "allOf": [
        {
          "type": "object",
          "required": [
            "id",
            "organizationId",
            "title",
            "summary",
            "priority",
            "status",
            "source",
            "projectId",
            "repositoryName",
            "githubIssue",
            "updatedAt",
            "version"
          ],
          "properties": {
            "id": {
              "type": "string"
            },
            "organizationId": {
              "type": "string"
            },
            "title": {
              "type": "string"
            },
            "summary": {
              "oneOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ]
            },
            "priority": {
              "oneOf": [
                {
                  "type": "string",
                  "enum": [
                    "P0",
                    "P1",
                    "P2",
                    "P3"
                  ]
                },
                {
                  "type": "null"
                }
              ]
            },
            "status": {
              "type": "string",
              "enum": [
                "open",
                "accepted",
                "dismissed",
                "resolved"
              ]
            },
            "source": {
              "type": "string",
              "enum": [
                "advisory",
                "code-audit",
                "runtime"
              ]
            },
            "projectId": {
              "oneOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ]
            },
            "repositoryName": {
              "oneOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ]
            },
            "githubIssue": {
              "oneOf": [
                {
                  "type": "object",
                  "required": [
                    "number",
                    "url",
                    "createdAt"
                  ],
                  "properties": {
                    "number": {
                      "type": "integer"
                    },
                    "url": {
                      "type": "string",
                      "format": "uri"
                    },
                    "createdAt": {
                      "type": "string",
                      "format": "date-time"
                    }
                  }
                },
                {
                  "type": "null"
                }
              ]
            },
            "updatedAt": {
              "type": "string",
              "format": "date-time"
            },
            "version": {
              "type": "string",
              "description": "Send back as `version` when changing the status."
            }
          }
        },
        {
          "type": "object",
          "required": [
            "codeEvidence"
          ],
          "properties": {
            "codeEvidence": {
              "oneOf": [
                {
                  "type": "object",
                  "required": [
                    "filePath",
                    "lineNumbers",
                    "rule",
                    "recommendation",
                    "reportId",
                    "repositoryHtmlUrl",
                    "snippet"
                  ],
                  "properties": {
                    "filePath": {
                      "type": "string"
                    },
                    "lineNumbers": {
                      "type": "array",
                      "items": {
                        "type": "integer"
                      }
                    },
                    "rule": {
                      "type": "string"
                    },
                    "recommendation": {
                      "oneOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "reportId": {
                      "oneOf": [
                        {
                          "type": "string",
                          "description": "The scan that produced the finding."
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "repositoryHtmlUrl": {
                      "oneOf": [
                        {
                          "type": "string",
                          "format": "uri"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "snippet": {
                      "oneOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "snippetStartLine": {
                      "type": "integer"
                    },
                    "snippetEndLine": {
                      "type": "integer"
                    }
                  }
                },
                {
                  "type": "null"
                }
              ]
            }
          }
        }
      ]
    }
  }
}

`400`

The request payload or parameters are invalid.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`401`

Authentication is missing, invalid, or expired.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`403`

The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

Headers

Name	Type	Description
`WWW-Authenticate`	`string`	Present on `INSUFFICIENT_SCOPE`: `Bearer error="insufficient_scope", scope="<required scope>"`.

`404`

The requested resource was not found.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`429`

The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

`500`

An unexpected internal error occurred.

Content type application/json

Property	Type	Required	Description
`success`	`boolean`	Required	—
`error`	`object`	Required	—
`error.code`	`"UNAUTHORIZED" \| "FORBIDDEN" \| "INSUFFICIENT_SCOPE" \| "PLAN_LIMIT_REACHED" \| "PLAN_REQUIRED" \| "INVALID_ORIGIN" \| "INVALID_REGION" \| "INVALID_PAYLOAD" \| "NOT_FOUND" \| "CONFLICT" \| "KEY_LIMIT_REACHED" \| "INSUFFICIENT_CREDITS" \| "SCAN_IN_PROGRESS" \| "UNLOCK_REQUIRED" \| "REPOSITORY_NOT_LINKED" \| "PAYLOAD_TOO_LARGE" \| "RATE_LIMITED" \| "SERVICE_UNAVAILABLE" \| "INTERNAL_ERROR"`	Required	—
`error.message`	`string`	Required	—
`error.details`	`unknown`	Optional	Optional structured error details.

View JSON schema

{
  "type": "object",
  "required": [
    "success",
    "error"
  ],
  "properties": {
    "success": {
      "type": "boolean",
      "const": false
    },
    "error": {
      "type": "object",
      "required": [
        "code",
        "message"
      ],
      "properties": {
        "code": {
          "type": "string",
          "enum": [
            "UNAUTHORIZED",
            "FORBIDDEN",
            "INSUFFICIENT_SCOPE",
            "PLAN_LIMIT_REACHED",
            "PLAN_REQUIRED",
            "INVALID_ORIGIN",
            "INVALID_REGION",
            "INVALID_PAYLOAD",
            "NOT_FOUND",
            "CONFLICT",
            "KEY_LIMIT_REACHED",
            "INSUFFICIENT_CREDITS",
            "SCAN_IN_PROGRESS",
            "UNLOCK_REQUIRED",
            "REPOSITORY_NOT_LINKED",
            "PAYLOAD_TOO_LARGE",
            "RATE_LIMITED",
            "SERVICE_UNAVAILABLE",
            "INTERNAL_ERROR"
          ]
        },
        "message": {
          "type": "string"
        },
        "details": {
          "description": "Optional structured error details."
        }
      }
    }
  }
}

REST API overview: Every operation in this API.

Examples

const response = await fetch("https://api.inth.com/v1/inbox/inbox_123", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <token>"
  },
});
const data = await response.json();

Response · 200

Example: default

{
  "success": true,
  "data": {
    "id": "inbox_123",
    "organizationId": "org_123",
    "title": "Email addresses written to application logs",
    "summary": "The checkout handler logs the full request body.",
    "priority": "P1",
    "status": "open",
    "source": "code-audit",
    "projectId": "prj_123",
    "repositoryName": "website",
    "githubIssue": null,
    "updatedAt": "2026-01-05T09:41:12.000Z",
    "version": "3",
    "codeEvidence": {
      "filePath": "apps/web/src/checkout/handler.ts",
      "lineNumbers": [
        42
      ],
      "rule": "pii-in-logs",
      "recommendation": "Redact personal data before logging the request body.",
      "reportId": "scan_123",
      "repositoryHtmlUrl": "https://github.com/acme/website",
      "snippet": null
    }
  }
}

Response · 400

Example: default

{
  "success": false,
  "error": {
    "code": "INVALID_PAYLOAD",
    "message": "Invalid request payload",
    "details": [
      {
        "code": "too_small",
        "message": "Too small: expected string to have >=1 characters",
        "path": [
          "name"
        ]
      }
    ]
  }
}

Response · 401

Example: default

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required"
  }
}

Response · 403

Example: insufficientScope

{
  "success": false,
  "error": {
    "code": "INSUFFICIENT_SCOPE",
    "message": "This token was not granted the projects.write scope",
    "details": {
      "requiredScope": "projects.write"
    }
  }
}

Example: forbidden

{
  "success": false,
  "error": {
    "code": "FORBIDDEN",
    "message": "Organization membership is required"
  }
}

Response · 404

Example

{
  "success": true,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "string",
    "details": {}
  }
}

Response · 429

Example: default

{
  "success": false,
  "error": {
    "code": "RATE_LIMITED",
    "message": "API key rate limit exceeded"
  }
}

Response · 500

Example: default

{
  "success": false,
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "Internal server error"
  }
}

Authentication

Request

Path Parameters

Responses

200

400

401

403

Headers

404

429

500

Related

`200`

`400`

`401`

`403`

`404`

`429`

`500`