---
title: "List attack scenarios for a scan"
method: GET
path: "/scans/{scanId}/scenarios"
tags: ["Scans", "Beta"]
---

# List attack scenarios for a scan

`GET /scans/{scanId}/scenarios`

## Request

- Base URL: `https://public.escape.tech/v3`
- URL: `https://public.escape.tech/v3/scans/{scanId}/scenarios`
- Auth: API key in header `X-ESCAPE-API-KEY`

Returns the attack scenarios explored during an AI pentest scan, each mapped to its attack vector. Filter by vector to build the vector/scenario matrix, or search scenario titles and surfaces. Credentials and secrets in scenario descriptions are redacted.

## Path parameters

- `scanId` string, uuid, required: The scan ID

## Query parameters

- `cursor` string: The cursor to start the pagination from. Returned by the previous page response. If not provided, the first page will be returned.
- `size` integer: The number of items to return per page
- `vector` 'AUTHENTICATION_BYPASS' | 'AUTHENTICATION_ENUMERATION' | 'BUSINESS_LOGIC' | 'DATA_INTEGRITY' | 'DEFAULT_CREDENTIALS' | 'EXPOSED_SERVICES' | 'IDENTITY_AND_ACCESS_CONTROL' | 'INJECTION' | 'INJECTIONS' | 'INSECURE_CONFIGURATION' | 'INSECURE_DATA_HANDLING' | 'LLM_AND_AI' | 'PLATFORM_AND_FRAMEWORK' | 'PROTOCOL_AND_API' | 'RATE_LIMIT_WEAKNESSES' | 'REMOTE_ADMINISTRATOR_EXPOSURE' | 'SECRETS_AND_CRYPTOGRAPHY' | 'SSRF_AND_FILE_INCLUSION' | 'TLS_CONFIGURATION' | 'UNPATCHED_KNOWN_VULNERABILITIES' | 'WEAK_CREDENTIALS' | 'WEB_AND_BROWSER': Filter scenarios by attack vector
- `search` string: Filter scenarios by text found in the title or surfaces

## Response `200`

OK

- object
  - `nextCursor` string, nullable, required
  - `totalCount` integer
  - `data` object[], required
    - `id` string, uuid, required: The id of the scenario
    - `title` string, required: The title of the scenario
    - `description` string, required: The description of the scenario
    - `status` 'BLOCKED' | 'CANCELLED' | 'DONE' | 'PLANNED' | 'RUNNING', required: The status of the scenario
    - `vector` 'AUTHENTICATION_BYPASS' | 'AUTHENTICATION_ENUMERATION' | 'BUSINESS_LOGIC' | 'DATA_INTEGRITY' | 'DEFAULT_CREDENTIALS' | 'EXPOSED_SERVICES' | 'IDENTITY_AND_ACCESS_CONTROL' | 'INJECTION' | 'INJECTIONS' | 'INSECURE_CONFIGURATION' | 'INSECURE_DATA_HANDLING' | 'LLM_AND_AI' | 'PLATFORM_AND_FRAMEWORK' | 'PROTOCOL_AND_API' | 'RATE_LIMIT_WEAKNESSES' | 'REMOTE_ADMINISTRATOR_EXPOSURE' | 'SECRETS_AND_CRYPTOGRAPHY' | 'SSRF_AND_FILE_INCLUSION' | 'TLS_CONFIGURATION' | 'UNPATCHED_KNOWN_VULNERABILITIES' | 'WEAK_CREDENTIALS' | 'WEB_AND_BROWSER', required: The attack vector the scenario belongs to
    - `surfaces` string[], required: The attack surfaces covered by the scenario

## Other responses

- `400`: Pagination error
- `404`: Not found

---

[API](https://skmtc.dev/escape/apis/escape-public-api.md) - [All operations](https://skmtc.dev/escape/apis/escape-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/escape/apis/escape-public-api/revisions/2eab35df40c7?raw)