---
title: "Fetch a report"
method: GET
path: "/reports/{id}"
tags: ["Reports"]
---

# Fetch a report

`GET /reports/{id}`

## Request

- Base URL: `https://commareports.com/api/v1`
- URL: `https://commareports.com/api/v1/reports/{id}`
- Auth: HTTP bearer

Report metadata plus the stored HTML. Access is gated by the same rule as the app (`can_view_report`); reports you can't view return 404, not 403. Encrypted (`user_passphrase`) reports return 409 — API tokens cannot decrypt them. Scope: `reports:read`.

## Response `200`

The report.

- Report
  - `id` string, uuid, required
  - `owner_id` string, uuid, required
  - `title` string, required
  - `description` string, nullable
  - `html` string, required: Rendered HTML (falls back to the original upload).
  - `visibility` 'private' | 'team' | 'registered' | 'public' | 'domain', required
  - `public_permission` 'none' | 'view' | 'comment' | 'edit', required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `producer_name` string, nullable
  - `producer_url` string, nullable
  - `producer_icon_url` string, nullable
  - `source_recipe` object, nullable
  - `edit_url` string, required
  - `share_url` string, required

## Other responses

- `401`: Missing, invalid, revoked, or expired token.
- `403`: Token missing the required scope, or no access to the resource.
- `404`: Resource not found (also returned instead of 403 where existence must not leak).
- `409`: Report is end-to-end encrypted; plaintext read is unavailable.
- `429`: Rate limit exceeded. Rate limit: per-token sliding window (plan-aware — Free 60 req/min, Pro 600, Team/Enterprise 6000 by default); 429 responses carry a Retry-After header.
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/commareports/apis/comma-api.md) · [All operations](https://skmtc.dev/commareports/apis/comma-api/llms.txt) · [OpenAPI document](https://skmtc.dev/commareports/apis/comma-api/revisions/cd5263522ade?raw)