---
title: "List pentest scope"
method: GET
path: "/v1/pentests/{pentest_slug}/scope/"
tags: ["pentests"]
---

# List pentest scope

`GET /v1/pentests/{pentest_slug}/scope/`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/pentests/{pentest_slug}/scope/`
- Auth: none declared

Return the pentest's in- and out-of-scope assets.

Returns the full in- and out-of-scope collections (use
``/scope/assets/`` for paginated access). Beacon details for the
in-scope assets are included only for machine callers. An in-scope
asset with an uploaded app bundle (APK / IPA) carries a short-lived
signed ``attachment_url`` to download it.

Args:
    pentest_id (int): The parent pentest, resolved and access-checked
        by the router's gate.
    db (AsyncSession): Request-scoped database session.
    context (ActiveContext): Resolved caller identity and scope.
    query (PentestScopeQuery): Pagination query params, applied to
        each collection independently.
    pager (Paginator): Fills the response's navigation metadata.

Returns:
    PentestScopeResponse: The pentest scope split into in- and
        out-of-scope assets.

## Path parameters

- `pentest_slug` string, required

## Query parameters

- `page` integer
- `per_page` integer: Page size. Values above 500 are clamped to it (or rejected, per REST__PAGINATION__PER_PAGE_OVER_MAX).

## Response `200`

Successful Response

- PentestScopeResponse: Combined in-scope and out-of-scope asset lists for a pentest. Attributes: in_scope (PentestAssetListResponse): Assets marked as in-scope. out_of_scope (PentestAssetListResponse): Assets marked as out-of-scope. beacons (list[BeaconResponse] | None): Beacons linked to in-scope assets. Only populated for machine users.
  - `total` integer, nullable
  - `page` integer, nullable
  - `per_page` integer, nullable
  - `_links` object, nullable: RFC 8288 rel to URL. Always first; last unless the route opted out of counting; prev and next when applicable.
  - `in_scope` PentestAssetListResponse, required: Paginated list of pentest assets. Shared by the paginated ``list_pentest_scope_assets`` read and, as a nested field, by ``PentestScopeResponse`` (the non-paginated ``GET``/``PATCH /scope/`` combined in/out-of-scope view). Those two routes exclude ``total``/``page``/``per_page``/``links`` on each nested list via ``response_model_exclude`` so they keep their pre-pagination shape. Attributes: assets (list[PentestAssetResponse]): Pentest-asset objects.
    - `total` integer, nullable
    - `page` integer, nullable
    - `per_page` integer, nullable
    - `_links` object, nullable: RFC 8288 rel to URL. Always first; last unless the route opted out of counting; prev and next when applicable.
    - `assets` PentestAssetResponse[], required
      - `id` integer, required
      - `value` string, required
      - `type` string, required
      - `in_scope` boolean, required
      - `private` boolean, nullable
      - `description` string, nullable
      - `wildcard` boolean
      - `beacon_id` integer, nullable
      - `attachment_url` string, nullable
  - `out_of_scope` PentestAssetListResponse, required: Paginated list of pentest assets. Shared by the paginated ``list_pentest_scope_assets`` read and, as a nested field, by ``PentestScopeResponse`` (the non-paginated ``GET``/``PATCH /scope/`` combined in/out-of-scope view). Those two routes exclude ``total``/``page``/``per_page``/``links`` on each nested list via ``response_model_exclude`` so they keep their pre-pagination shape. Attributes: assets (list[PentestAssetResponse]): Pentest-asset objects.
    - `total` integer, nullable
    - `page` integer, nullable
    - `per_page` integer, nullable
    - `_links` object, nullable: RFC 8288 rel to URL. Always first; last unless the route opted out of counting; prev and next when applicable.
    - `assets` PentestAssetResponse[], required
      - `id` integer, required
      - `value` string, required
      - `type` string, required
      - `in_scope` boolean, required
      - `private` boolean, nullable
      - `description` string, nullable
      - `wildcard` boolean
      - `beacon_id` integer, nullable
      - `attachment_url` string, nullable
  - `beacons` BeaconResponse[], nullable
    - `id` integer, required
    - `name` string, required
    - `status` integer, required
    - `last_seen` string, date-time, nullable, required
    - `created` string, date-time, required
    - `url` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)