---
title: "Fetch a staged artifact for scanning"
method: GET
path: "/_internal/scan-fetch"
tags: ["scanning"]
---

# Fetch a staged artifact for scanning

`GET /_internal/scan-fetch`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/_internal/scan-fetch`
- Auth: none declared

Streams the exact bytes staged in storage for a pre-cache security scan.
Requires a short-lived HMAC-signed token minted by the proxy itself and
delivered via the fetch_url field of the scan notify request (see the
Artifact Scanning section of docs/configuration.md). Not part of the
public API; restrict access to the scanner network at the ingress layer.

## Query parameters

- `path` string, required
- `exp` integer, required
- `sig` string, required

## Response `200`

OK

## Other responses

- `403`: invalid, expired, or tampered token
- `404`: object not found in storage, or scanning is not configured

## Changes

- **2026-09-03** `d76b1a21e885`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/git-pkgs/apis/git-pkgs-proxy-api/changes/_internal/scan-fetch/get.md)

---

[API](https://skmtc.dev/git-pkgs/apis/git-pkgs-proxy-api.md) - [All operations](https://skmtc.dev/git-pkgs/apis/git-pkgs-proxy-api/llms.txt) - [OpenAPI document](https://skmtc.dev/git-pkgs/apis/git-pkgs-proxy-api/revisions/17b399ab97cc?raw)