---
title: "List Threat Watch Scans"
method: GET
path: "/threathunting/v1/threatwatch/scans"
tags: ["Threat Watch"]
---

# List Threat Watch Scans

`GET /threathunting/v1/threatwatch/scans`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threatwatch/scans`
- Auth: API key in header `Authorization`

Retrieves Threat Watch automated scan details with pagination support.

## Query parameters

- `jobType` 'Scheduled' | 'Retrospective'
- `pageToken` string

## Response `200`

Success

- ThreatWatchScansResponse
  - `nextPageToken` string: Next page pagination token.
  - `threatWatchScans` object[]: List of scan records.
    - `devicesScanned` integer: Number of devices scanned.
    - `filesScanned` integer: Total files scanned.
    - `lastScannedOn` string: ISO 8601 timestamp of scan start time.
    - `nextScheduledOn` string: ISO 8601 timestamp of next scheduled scan.
    - `jobType` 'Scheduled' | 'Retrospective': Type of scan: 'Scheduled' or 'Retrospective'.
    - `iocsUsedForScan` integer: Number of IOCs used in the scan.
    - `iocsAddedInLastSevenDays` integer: Number of IOCs added in last 7 days.
    - `scanStatus` string: Status of the scan: 'Running', 'Completed', or 'Failed'.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)