---
title: "Get an issue"
method: GET
path: "/issues/{issueId}"
tags: ["Issues"]
---

# Get an issue

`GET /issues/{issueId}`

## Request

- Base URL: `https://public.escape.tech/v3`
- URL: `https://public.escape.tech/v3/issues/{issueId}`
- Auth: API key in header `X-ESCAPE-API-KEY`

Get an issue by ID

## Path parameters

- `issueId` string, required: The issue ID

## Response `200`

OK

- object
  - `id` string, uuid, required: The id of the issue
  - `name` string, required: The name of the issue
  - `fullName` string, required: The full name of the issue
  - `category` 'ACCESS_CONTROL' | 'CONFIGURATION' | 'CUSTOM' | 'INFORMATION_DISCLOSURE' | 'INJECTION' | 'PROTOCOL' | 'REQUEST_FORGERY' | 'RESOURCE_LIMITATION' | 'SCHEMA' | 'SENSITIVE_DATA', required: The category of the issue
  - `severity` 'CRITICAL' | 'HIGH' | 'INFO' | 'LOW' | 'MEDIUM', required: The severity level of the issue
  - `manualSeverity` boolean, required: Whether the severity has been manually overridden
  - `status` 'FALSE_POSITIVE' | 'IGNORED' | 'MANUAL_REVIEW' | 'OPEN' | 'RESOLVED', required: The current status of the issue
  - `context` string, nullable, required: AI-generated contextual overview for the issue
  - `risks` string[], required: Array of risk types associated with the issue
  - `alertUid` string, required: Unique identifier for the alert
  - `createdAt` string, required: When the issue was first created
  - `asset` object, required: The asset of the issue
    - `id` string, uuid, required: The id of the asset
    - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required
    - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required
    - `name` string, required: The name of the asset
    - `externalUrl` string, nullable, required: The external url of the asset
    - `faviconUrl` string, nullable, required: The favicon url of the asset
    - `description` string, nullable, required: The description of the asset
    - `createdAt` string, required: The date and time the asset was created
    - `lastSeenAt` string, required: The date and time the asset was last seen
    - `scheduledForDeletionAt` string, nullable, required: The date and time the asset is scheduled for deletion
    - `status` 'DEPRECATED' | 'FALSE_POSITIVE' | 'MONITORED' | 'OUT_OF_SCOPE' | 'THIRD_PARTY', required: The status of the asset
    - `owners` string[]: The owners of the asset
    - `tags` object[], required: The tags of the asset
      - `id` string, uuid, required: The id of the tag
      - `name` string, required: The name of the tag
      - `color` string, required: The color of the tag
    - `risks` string[], required: The risks of the asset
    - `projectIds` string[], required: IDs of the projects this asset is assigned to
    - `firstSeenScan` object, nullable, required: The first seen scan of the asset
      - `id` string, uuid, required: The id of the scan
      - `profileId` string, uuid, nullable, required: The id of the profile that ran the scan
      - `assetId` string, uuid, nullable, required: The id of the asset that was scanned, if any
      - `status` string, required: The status of the scan
      - `createdAt` string, required: The date and time the scan was created
      - `finishedAt` string, nullable, required: The date and time the scan was finished
      - `score` number, nullable, required: The score of the scan
      - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data
      - `duration` number, required: The duration of the scan
      - `progressRatio` number, required: The progress ratio of the scan
      - `initiator` string, required: The initiator of the scan
      - `kind` string, required: The kind of the scan
      - `commitHash` string, nullable, required: The commit hash of the scan
      - `commitBranch` string, nullable, required: The commit branch of the scan
      - `links` object, required: The links of the scan
        - `scanIssues` string, required: The url to view the scan issues in the platform
    - `lastSeenScan` object, nullable, required: The last seen scan of the asset
      - `id` string, uuid, required: The id of the scan
      - `profileId` string, uuid, nullable, required: The id of the profile that ran the scan
      - `assetId` string, uuid, nullable, required: The id of the asset that was scanned, if any
      - `status` string, required: The status of the scan
      - `createdAt` string, required: The date and time the scan was created
      - `finishedAt` string, nullable, required: The date and time the scan was finished
      - `score` number, nullable, required: The score of the scan
      - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data
      - `duration` number, required: The duration of the scan
      - `progressRatio` number, required: The progress ratio of the scan
      - `initiator` string, required: The initiator of the scan
      - `kind` string, required: The kind of the scan
      - `commitHash` string, nullable, required: The commit hash of the scan
      - `commitBranch` string, nullable, required: The commit branch of the scan
      - `links` object, required: The links of the scan
        - `scanIssues` string, required: The url to view the scan issues in the platform
    - `service` object, nullable, required: The service of the asset
      - `type` 'GRAPHQL' | 'GRPC' | 'MCP' | 'REST' | 'SOAP' | 'WEBSOCKET', required
      - `url` string, required
      - `framework` string, nullable, required
      - `authProtocol` string, nullable, required
      - `authTechnology` 'AUTH0' | 'AWS_IAM' | 'AZURE_ACTIVE_DIRECTORY' | 'COGNITO' | 'KEYCLOAK' | 'UNKNOWN' | 'null', nullable, required
      - `cloudProvider` 'AKAMAI' | 'ALIBABA' | 'AWS' | 'AZURE' | 'CLOUDFLARE' | 'DIGITALOCEAN' | 'FASTLY' | 'GCP' | 'GRAVITEE' | 'HEROKU' | 'IBM' | 'LINODE' | 'ORACLE' | 'OVH' | 'SCALEWAY' | 'TENCENT' | 'UCLOUD' | 'UNKNOWN' | 'VERCEL' | 'null', nullable, required
      - `wafProvider` 'ACE_XML_GATEWAY' | 'AESECURE' | 'AIREECDN' | 'AIRLOCK' | 'ALERT_LOGIC' | 'ALIYUNDUN' | 'ANQUANBAO' | 'ANYU' | 'APPROACH' | 'APPWALL' | 'ARMOR_DEFENSE' | 'ARVANCLOUD' | 'ASPA_FIREWALL' | 'ASP_NET_GENERIC' | 'ASP_NET_WAF' | 'ASTRA' | 'AWS_ELASTIC_LOAD_BALANCER' | 'AZIONCDN' | 'AZURE_FRONT_DOOR' | 'BARIKODE' | 'BARRACUDA' | 'BEKCHY' | 'BELUGA_CDN' | 'BINARYSEC' | 'BITNINJA' | 'BLOCKDOS' | 'BLUEDON' | 'BULLETPROOF_SECURITY_PRO' | 'CACHEFLY_CDN' | 'CACHEWALL' | 'CDNNS_APPLICATION_GATEWAY' | 'CHINACACHE_LOAD_BALANCER' | 'CHUANG_YU_SHIELD' | 'CLOUDBRIC' | 'CLOUDFLARE' | 'CLOUDFLOOR' | 'CLOUDFRONT' | 'COMODO_CWATCH' | 'CRAWLPROTECT' | 'DATADOME' | 'DATAPOWER' | 'DENYALL' | 'DISTIL' | 'DOSARREST' | 'DOTDEFENDER' | 'DYNAMICWEB_INJECTION_CHECK' | 'EDGECAST' | 'EEYE_SECUREIIS' | 'EISOO_CLOUD_FIREWALL' | 'EXPRESSION_ENGINE' | 'F5_NETWORKS' | 'FASTLY' | 'FIREPASS' | 'FORTIWEB' | 'GODADDY_WEBSITE_PROTECTION' | 'GOOGLE_CLOUD_APP_ARMOR' | 'GREYWIZARD' | 'HUAWEI_CLOUD_FIREWALL' | 'HYPERGUARD' | 'IMUNIFY360' | 'INCAPSULA' | 'INDUSGUARD' | 'INSTART_DX' | 'ISA_SERVER' | 'JANUSEC_APPLICATION_GATEWAY' | 'JIASULE' | 'KEYCDN' | 'KONA_SITEDEFENDER' | 'KS_WAF' | 'LIMELIGHT_CDN' | 'LITESPEED' | 'MALCARE' | 'MAXCDN' | 'MISSION_CONTROL_SHIELD' | 'MODSECURITY' | 'NAXSI' | 'NEMESIDA' | 'NETCONTINUUM' | 'NETSCALER_APPFIREWALL' | 'NEVISPROXY' | 'NEWDEFEND' | 'NEXUSGUARD_FIREWALL' | 'NINJAFIREWALL' | 'NSFOCUS' | 'NULLDDOS_PROTECTION' | 'ONMESSAGE_SHIELD' | 'OPEN_RESTY_LUA_NGINX' | 'ORACLE_CLOUD' | 'PALO_ALTO_NEXT_GEN_FIREWALL' | 'PENTAWAF' | 'PERIMETERX' | 'PKSECURITY_IDS' | 'POWERCDN' | 'PROFENSE' | 'PT_APPLICATION_FIREWALL' | 'PUHUI' | 'QCLOUD' | 'QINIU' | 'RAYWAF' | 'REBLAZE' | 'RSFIREWALL' | 'SABRE_FIREWALL' | 'SAFE3_WEB_FIREWALL' | 'SAFEDOG' | 'SAFELINE' | 'SECKING' | 'SECUPRESS_WP_SECURITY' | 'SECURESPHERE' | 'SECURE_ENTRY' | 'SENGINX' | 'SERVERDEFENDER_VP' | 'SHADOW_DAEMON' | 'SHIELD_SECURITY' | 'SITEGROUND' | 'SITEGUARD' | 'SITELOCK' | 'SONICWALL' | 'SQUARESPACE' | 'SQUIDPROXY_IDS' | 'STACKPATH' | 'SUCURI_CLOUDPROXY' | 'TENCENT_CLOUD_FIREWALL' | 'TEROS' | 'TRAFFICSHIELD' | 'TRANSIP_WEB_FIREWALL' | 'UEWAF' | 'UNKNOWN' | 'URLMASTER_SECURITYCHECK' | 'URLSCAN' | 'UTM_WEB_PROTECTION' | 'VARNISH' | 'VIETTEL' | 'VIRUSDIE' | 'WALLARM' | 'WATCHGUARD' | 'WEBARX' | 'WEBKNIGHT' | 'WEBLAND' | 'WEBSEAL' | 'WEBTOTEM' | 'WEST263_CDN' | 'WORDFENCE' | 'WPMUDEV_WAF' | 'WP_CERBER_SECURITY' | 'WTS_WAF' | 'XLABS_SECURITY_WAF' | 'XUANWUDUN' | 'YUNDUN' | 'YUNJIASU' | 'YUNSUO' | 'YXLINK' | 'ZENEDGE' | 'ZSCALER' | 'null', nullable, required
      - `environment` 'DEVELOPMENT' | 'PRODUCTION' | 'STAGING' | 'UNKNOWN' | 'null', nullable, required
      - `tls` boolean, required
      - `ips` string[], required
    - `frontend` object, nullable, required: The frontend of the asset
      - `type` 'WEBAPP', required
      - `url` string, required
      - `framework` string, nullable, required
      - `APIFramework` string, nullable, required
      - `authProtocol` string, nullable, required
      - `authTechnology` 'AUTH0' | 'AWS_IAM' | 'AZURE_ACTIVE_DIRECTORY' | 'COGNITO' | 'KEYCLOAK' | 'UNKNOWN' | 'null', nullable, required
      - `cloudProvider` 'AKAMAI' | 'ALIBABA' | 'AWS' | 'AZURE' | 'CLOUDFLARE' | 'DIGITALOCEAN' | 'FASTLY' | 'GCP' | 'GRAVITEE' | 'HEROKU' | 'IBM' | 'LINODE' | 'ORACLE' | 'OVH' | 'SCALEWAY' | 'TENCENT' | 'UCLOUD' | 'UNKNOWN' | 'VERCEL' | 'null', nullable, required
      - `wafProvider` 'ACE_XML_GATEWAY' | 'AESECURE' | 'AIREECDN' | 'AIRLOCK' | 'ALERT_LOGIC' | 'ALIYUNDUN' | 'ANQUANBAO' | 'ANYU' | 'APPROACH' | 'APPWALL' | 'ARMOR_DEFENSE' | 'ARVANCLOUD' | 'ASPA_FIREWALL' | 'ASP_NET_GENERIC' | 'ASP_NET_WAF' | 'ASTRA' | 'AWS_ELASTIC_LOAD_BALANCER' | 'AZIONCDN' | 'AZURE_FRONT_DOOR' | 'BARIKODE' | 'BARRACUDA' | 'BEKCHY' | 'BELUGA_CDN' | 'BINARYSEC' | 'BITNINJA' | 'BLOCKDOS' | 'BLUEDON' | 'BULLETPROOF_SECURITY_PRO' | 'CACHEFLY_CDN' | 'CACHEWALL' | 'CDNNS_APPLICATION_GATEWAY' | 'CHINACACHE_LOAD_BALANCER' | 'CHUANG_YU_SHIELD' | 'CLOUDBRIC' | 'CLOUDFLARE' | 'CLOUDFLOOR' | 'CLOUDFRONT' | 'COMODO_CWATCH' | 'CRAWLPROTECT' | 'DATADOME' | 'DATAPOWER' | 'DENYALL' | 'DISTIL' | 'DOSARREST' | 'DOTDEFENDER' | 'DYNAMICWEB_INJECTION_CHECK' | 'EDGECAST' | 'EEYE_SECUREIIS' | 'EISOO_CLOUD_FIREWALL' | 'EXPRESSION_ENGINE' | 'F5_NETWORKS' | 'FASTLY' | 'FIREPASS' | 'FORTIWEB' | 'GODADDY_WEBSITE_PROTECTION' | 'GOOGLE_CLOUD_APP_ARMOR' | 'GREYWIZARD' | 'HUAWEI_CLOUD_FIREWALL' | 'HYPERGUARD' | 'IMUNIFY360' | 'INCAPSULA' | 'INDUSGUARD' | 'INSTART_DX' | 'ISA_SERVER' | 'JANUSEC_APPLICATION_GATEWAY' | 'JIASULE' | 'KEYCDN' | 'KONA_SITEDEFENDER' | 'KS_WAF' | 'LIMELIGHT_CDN' | 'LITESPEED' | 'MALCARE' | 'MAXCDN' | 'MISSION_CONTROL_SHIELD' | 'MODSECURITY' | 'NAXSI' | 'NEMESIDA' | 'NETCONTINUUM' | 'NETSCALER_APPFIREWALL' | 'NEVISPROXY' | 'NEWDEFEND' | 'NEXUSGUARD_FIREWALL' | 'NINJAFIREWALL' | 'NSFOCUS' | 'NULLDDOS_PROTECTION' | 'ONMESSAGE_SHIELD' | 'OPEN_RESTY_LUA_NGINX' | 'ORACLE_CLOUD' | 'PALO_ALTO_NEXT_GEN_FIREWALL' | 'PENTAWAF' | 'PERIMETERX' | 'PKSECURITY_IDS' | 'POWERCDN' | 'PROFENSE' | 'PT_APPLICATION_FIREWALL' | 'PUHUI' | 'QCLOUD' | 'QINIU' | 'RAYWAF' | 'REBLAZE' | 'RSFIREWALL' | 'SABRE_FIREWALL' | 'SAFE3_WEB_FIREWALL' | 'SAFEDOG' | 'SAFELINE' | 'SECKING' | 'SECUPRESS_WP_SECURITY' | 'SECURESPHERE' | 'SECURE_ENTRY' | 'SENGINX' | 'SERVERDEFENDER_VP' | 'SHADOW_DAEMON' | 'SHIELD_SECURITY' | 'SITEGROUND' | 'SITEGUARD' | 'SITELOCK' | 'SONICWALL' | 'SQUARESPACE' | 'SQUIDPROXY_IDS' | 'STACKPATH' | 'SUCURI_CLOUDPROXY' | 'TENCENT_CLOUD_FIREWALL' | 'TEROS' | 'TRAFFICSHIELD' | 'TRANSIP_WEB_FIREWALL' | 'UEWAF' | 'UNKNOWN' | 'URLMASTER_SECURITYCHECK' | 'URLSCAN' | 'UTM_WEB_PROTECTION' | 'VARNISH' | 'VIETTEL' | 'VIRUSDIE' | 'WALLARM' | 'WATCHGUARD' | 'WEBARX' | 'WEBKNIGHT' | 'WEBLAND' | 'WEBSEAL' | 'WEBTOTEM' | 'WEST263_CDN' | 'WORDFENCE' | 'WPMUDEV_WAF' | 'WP_CERBER_SECURITY' | 'WTS_WAF' | 'XLABS_SECURITY_WAF' | 'XUANWUDUN' | 'YUNDUN' | 'YUNJIASU' | 'YUNSUO' | 'YXLINK' | 'ZENEDGE' | 'ZSCALER' | 'null', nullable, required
      - `environment` 'DEVELOPMENT' | 'PRODUCTION' | 'STAGING' | 'UNKNOWN' | 'null', nullable, required
      - `ips` string[], required
      - `tls` boolean, required
    - `host` object, nullable, required: The host of the asset
      - `type` 'DNS' | 'IPV4' | 'IPV6', required
      - `address` string, required
      - `ips` string[], required
      - `ports` object[], required
        - `port` integer, required
        - `protocols` string[], required
      - `records` object[], required
        - `type` string, required
        - `value` string, required
    - `technology` object, nullable, required: Technology metadata for PACKAGE and SOFTWARE assets
      - `type` 'PACKAGE' | 'SOFTWARE', required: Whether this is a PACKAGE or SOFTWARE asset
      - `technologyKey` string, required: Versionless technology identifier (e.g. vendor/product or ecosystem/name)
      - `version` string, nullable, required: Detected version, if known
      - `cpe` string, nullable, required: Common Platform Enumeration identifier, if known
      - `referenceUrl` string, nullable, required: Reference URL for the technology
      - `purl` string, nullable, required: Package URL, for PACKAGE assets
      - `packageType` 'ALPM' | 'APK' | 'BAZEL' | 'BITBUCKET' | 'BITNAMI' | 'CARGO' | 'COCOAPODS' | 'COMPOSER' | 'CONAN' | 'CONDA' | 'CPAN' | 'CRAN' | 'DEB' | 'DOCKER' | 'GEM' | 'GENERIC' | 'GITHUB' | 'GO' | 'HACKAGE' | 'HEX' | 'HUGGINGFACE' | 'JULIA' | 'LUAROCKS' | 'MAVEN' | 'MLFLOW' | 'NPM' | 'NUGET' | 'OCI' | 'OPAM' | 'OTP' | 'PUB' | 'PYPI' | 'QPKG' | 'RPM' | 'SWID' | 'SWIFT' | 'VSCODE_EXTENSION' | 'YOCTO' | 'null', nullable, required: Package ecosystem, for PACKAGE assets
      - `wellKnownTechnology` 'ANGULAR' | 'APACHE' | 'NGINX' | 'REACT' | 'REDIS' | 'SVELTE' | 'VUE' | 'null', nullable, required: Well-known technology label, when applicable
    - `mobileApp` object, nullable, required: Mobile app metadata for APK assets
      - `type` 'APK', required: The type of the mobile app
      - `filename` string, nullable, required: Original uploaded filename
      - `hash` string, nullable, required: Hash of the uploaded binary
      - `bundleId` string, nullable, required: Android package name, if known
    - `schemaUrl` string, nullable, required: Time-limited HTTPS URL for schema-class assets; null for other asset classes
    - `parents` object[]: Parent assets in the relationship graph (first 20)
      - `id` string, uuid, required: The id of the related asset
      - `name` string, required: The name of the related asset
      - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required: The class of the related asset
      - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required: The type of the related asset
    - `children` object[]: Child assets in the relationship graph (first 20)
      - `id` string, uuid, required: The id of the related asset
      - `name` string, required: The name of the related asset
      - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required: The class of the related asset
      - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required: The type of the related asset
    - `sources` union[]: The sources of the asset
      - union: The source of an asset
        - object
          - `type` 'asset', required
          - `assetId` string, required: The id of the source asset
        - object
          - `type` 'integration', required
          - `integrationId` string, required: The id of the source integration
          - `name` string, nullable, required: The name of the source integration
        - object
          - `type` 'manuallyCreated', required
          - `manuallyCreated` boolean, required: Whether the asset was manually created
    - `statistics` object: Per-asset statistics
      - `issues` object, required
        - `severities` object[], required
          - `count` integer, required: The number of issues with this severity
          - `severity` 'CRITICAL' | 'HIGH' | 'INFO' | 'LOW' | 'MEDIUM', required: The severity level
      - `events` object, required
        - `attachments` integer, required: The number of event attachments
    - `rawData` unknown
    - `metadata` string[]: Metadata flags for the asset
    - `links` object, required: The links of the asset
      - `assetOverview` string, required: The url to view the asset overview in the platform
  - `lastSeenScanId` string, nullable, required: ID of the last scan where this issue was seen
  - `lastSeenScan` object, nullable, required: The last scan in which this issue was observed
    - `id` string, uuid, required: The id of the scan
    - `profileId` string, uuid, nullable, required: The id of the profile that ran the scan
    - `assetId` string, uuid, nullable, required: The id of the asset that was scanned, if any
    - `status` string, required: The status of the scan
    - `createdAt` string, required: The date and time the scan was created
    - `finishedAt` string, nullable, required: The date and time the scan was finished
    - `score` number, nullable, required: The score of the scan
    - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data
    - `duration` number, required: The duration of the scan
    - `progressRatio` number, required: The progress ratio of the scan
    - `initiator` string, required: The initiator of the scan
    - `kind` string, required: The kind of the scan
    - `commitHash` string, nullable, required: The commit hash of the scan
    - `commitBranch` string, nullable, required: The commit branch of the scan
    - `links` object, required: The links of the scan
      - `scanIssues` string, required: The url to view the scan issues in the platform
  - `firstSeenScanId` string, nullable, required: ID of the first scan where this issue was seen
  - `customRuleId` string, nullable, required: ID of the custom rule if this is a custom issue
  - `securityTest` object, required: The security test that detected the issue
    - `id` string, required: The uid of the security test
    - `name` string, required: The human readable name of the security test
  - `aiRemediationFramework` string, required: Framework used for AI remediation
  - `aiRemediationFeedback` boolean, nullable, required: Whether the full AI remediation (`remediation`) was rated useful. Null when no feedback was given
  - `remediation` string, nullable, required: AI-generated remediation for the issue. Session credentials are redacted.
  - `aiRemediationSummary` string, nullable, required: Short AI-generated remediation summary shown in the issue overview. Session credentials are redacted.
  - `aiRemediationSummaryFeedback` boolean, nullable, required: Whether the AI remediation summary (`aiRemediationSummary`) was rated useful. Null when no feedback was given
  - `cvss` object, nullable, required: CVSS information for the issue
    - `score` number, nullable, required: CVSS score of the issue
    - `vector` string, nullable, required: CVSS vector of the issue
  - `compliances` object[]: Compliances associated with the issue
    - `framework` string, required: The compliance framework name
    - `item` string, required: The compliance item identifier
  - `links` object, required
    - `issueOverview` string, required: URL to view the issue overview in the platform
  - `latestEventIds` string[]: IDs of up to 5 events from the issue's last-seen scan, newest-first. Hydrate with GET /v3/events/:id for full payload (Exchange, etc.). Only populated by GET /v3/issues/:issueId. IDs are opaque strings (GraphQL `ID` scalars), not guaranteed UUIDs.
  - `latestEventsTruncated` boolean: True when the last-seen scan has more than 5 events. Use GET /v3/events?issueIds=<id>&scanIds=<lastSeenScanId> for the full list.
  - `targets` object[], required: Scan targets associated with the issue, deduplicated
    - `kind` 'API_ROUTE' | 'CODE_FILE' | 'CVE' | 'GRAPHQL_RESOLVER' | 'PORT' | 'WEB_CRAWLED_URL' | 'WEB_PAGE', required: The kind of scan target
    - `left` string, required: Short label for the target (e.g. HTTP method or asset kind)
    - `right` string, required: Primary target identifier (e.g. route path or URL)
  - `summary` string, nullable, required: Summary of the finding (AI pentest findings)
  - `impact` string, nullable, required: Impact of the finding
  - `agentic` boolean, required: Whether the finding was produced by an AI pentest agent
  - `reproductionSteps` object[], required: Steps to reproduce the finding, in order
    - `order` integer, required: Position of the step, starting at 0
    - `title` string, required: Short title of the step
    - `content` string, required: Details of the step. Session credentials are redacted.
  - `exploits` string[], required: Exploit or proof-of-concept payloads. Session credentials are redacted.
  - `causes` object[], required: Root causes of the finding, in order
    - `type` 'WHAT' | 'WHY', required: WHAT happened or WHY it happened
    - `content` string, required: Description of the cause
  - `attackChain` object[], required: Attack chain steps (AI pentest findings), in order
    - `order` integer, required: Position of the step in the attack chain
    - `stage` 'CONFIGURATION_ANALYSIS' | 'CREDENTIAL_ACCESS' | 'DISCOVERY' | 'EXFILTRATION' | 'EXPLOITATION' | 'IMPACT' | 'INITIAL_ACCESS' | 'LATERAL_MOVEMENT' | 'OTHER' | 'PERSISTENCE' | 'PRIVILEGE_ESCALATION' | 'RECONNAISSANCE' | 'VALIDATION', required: Attack stage of the step
    - `title` string, required: Short title of the step
    - `description` string, required: Summary of the step
    - `content` string, required: Details of the step. Session credentials are redacted.
  - `aiFalsePositive` object, required: Verdict of the AI false-positive review
    - `isFalsePositive` boolean, required: Whether the AI review judged the finding a false positive
    - `reasoning` string, nullable, required: Full reasoning of the AI review
    - `reasoningSummary` string, nullable, required: Short summary of the AI reasoning
  - `ticket` object, nullable, required: Ticket linked to the issue, if any
    - `externalId` string, required: Key of the ticket in the external tracker (e.g. Jira key)
    - `externalUrl` string, required: URL of the ticket in the external tracker
    - `createdAt` string, required: When the ticket was linked to the issue
  - `fixPrompt` string, required: Ready-to-use prompt that asks a coding agent to fix this finding
  - `retestValidationId` string, nullable, required: ID of the retest validation tied to this issue, if any

## Other responses

- `404`: Not found

---

[API](https://skmtc.dev/escape/apis/escape-public-api.md) - [All operations](https://skmtc.dev/escape/apis/escape-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/escape/apis/escape-public-api/revisions/2eab35df40c7?raw)