---
title: "Get a pentest scope asset"
method: GET
path: "/v1/pentests/{pentest_slug}/scope/assets/{asset_id}"
tags: ["pentests"]
---

# Get a pentest scope asset

`GET /v1/pentests/{pentest_slug}/scope/assets/{asset_id}`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/pentests/{pentest_slug}/scope/assets/{asset_id}`
- Auth: none declared

Return one scope asset (404 if not found or not authorized).

Args:
    pentest_id (int): The parent pentest, resolved and access-checked
        by the router's gate.
    asset_id (int): Identifier of the scope asset (the asset id).
    db (AsyncSession): Request-scoped database session.
    context (ActiveContext): Resolved caller identity and scope.

Returns:
    PentestAssetResponse: The requested scope asset.

## Path parameters

- `asset_id` integer, required
- `pentest_slug` string, required

## Response `200`

Successful Response

- PentestAssetResponse: Flattened pentest-asset representation. Combines fields from both ``PentestAssets`` (link record) and ``Asset`` (the actual asset). The ``id`` field is the **asset** ID, matching the api-3 contract. Attributes: id (int): Asset ID. value (str): Asset value (FQDN, IP, etc.). Wildcard domains are prefixed with ``*.``. type (str): Asset type (fqdn, ip, …). in_scope (bool): Whether the asset is in scope. private (bool | None): Whether the asset is private. description (str | None): Scope description. wildcard (bool): Whether wildcard matching is enabled. beacon_id (int | None): Associated beacon ID. attachment_url (str | None): Short-lived signed URL to download the asset's uploaded app bundle (APK / IPA). Null when the asset is out of scope or has no bundle, and also when storage reports the bundle missing or its stored location cannot be signed. The scanner skips an app whose URL is null. The scope routes fill it in from :class:`~phoenix.services.workflows.scope_attachments.ScopeAttachmentWorkflow`.
  - `id` integer, required
  - `value` string, required
  - `type` string, required
  - `in_scope` boolean, required
  - `private` boolean, nullable
  - `description` string, nullable
  - `wildcard` boolean
  - `beacon_id` integer, nullable
  - `attachment_url` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)