---
title: "Retrieve what a completed run covered, per category"
method: GET
path: "/api/v1/run/{run_id}/coverage"
tags: ["assessment"]
---

# Retrieve what a completed run covered, per category

`GET /api/v1/run/{run_id}/coverage`

## Request

- Base URL: `https://api.enokilabs.ai`
- URL: `https://api.enokilabs.ai/api/v1/run/{run_id}/coverage`
- Auth: none declared

One row per category the run probed: attacks blocked, attacks that got through, the category's OWASP and ATLAS codes, and the worst severity it produced. The complement of `/run/{run_id}/findings`. Returns 409 while the run is still going: a missing row would then mean 'not yet' rather than 'clean'. A category the run never probed has no row, so check `run_status` -- a cancelled or errored run reports what it reached, not what it planned.

## Path parameters

- `run_id` string, required

## Headers

- `Authorization` string, nullable: Bearer token with API key

## Response `200`

Successful Response

- ApiRunCoverageResponse: Response for GET /api/v1/run/{run_id}/coverage.
  - `run_id` string, required
  - `run_status` string, required: The run's terminal status. Anything but 'completed' means the rows below are what the run reached, not what it planned.
  - `categories` CategoryCoverage[], required: One row per category the run probed, ordered by category key. Empty where the workspace's plan withholds the run's breakdown, while the totals below still count every attack.
    - `category` string, required: The category's key, as GET /api/v1/category lists it.
    - `display_name` string, required
    - `owasp_mapping` string[]
    - `atlas_mapping` string[]
    - `attacks_blocked` integer, required: Attacks the target refused.
    - `attacks_got_through` integer, required: Attacks that produced a finding.
    - `worst_severity` 'critical' | 'high' | 'medium' | 'low': Business-impact severity levels, ordered from most to least severe.
  - `categories_probed` integer, required: Number of categories the run probed.
  - `attacks_blocked` integer, required: Attacks the target refused, across every category.
  - `attacks_got_through` integer, required: Attacks that produced a finding.

## Other responses

- `404`: Run not found
- `409`: Run still in progress
- `422`: Validation Error

---

[API](https://skmtc.dev/enokilabs/apis/enoki-external-api.md) · [All operations](https://skmtc.dev/enokilabs/apis/enoki-external-api/llms.txt) · [OpenAPI document](https://skmtc.dev/enokilabs/apis/enoki-external-api/revisions/9b13fb6ab124?raw)