---
title: "Get scan request"
method: GET
path: "/v1/code-audit/scan-requests/{preparationId}"
tags: ["Code Audit"]
---

# Get scan request

`GET /v1/code-audit/scan-requests/{preparationId}`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/code-audit/scan-requests/{preparationId}`
- Auth: HTTP bearer

Polls a scan request that answered `starting`. Requires code-audit.read or code-audit.write.

## Path parameters

- `preparationId` string, required

## Query parameters

- `repositoryId` string, required

## Response `200`

The scan request state.

- object
  - `success` true, required
  - `data` union, required
    - object
      - `status` 'started', required
      - `scan` CodeAuditScan, required
        - `id` string, required
        - `organizationId` string, required
        - `repositoryId` string, required
        - `repositoryName` string, required
        - `branch` string, nullable, required
        - `headCommitSha` string, nullable, required
        - `pullRequestNumber` integer, nullable, required
        - `scope` string, required: What was scanned: repository, pull_request, and so on.
        - `trigger` string, required: What started the scan: manual, pull_request, scheduled.
        - `status` string, required
        - `access` 'full' | 'free-preview' | 'locked', required: Whether every finding is readable. A free preview shows a subset until unlocked.
        - `unlockCredits` integer, nullable, required: Credits needed to unlock a free preview.
        - `findingCount` integer, nullable, required
        - `issueCount` integer, nullable, required
        - `progress` object, nullable, required
          - `stage` string, required
          - `stageStatus` string, nullable, required
          - `completedStages` integer, nullable, required
          - `totalStages` integer, nullable, required
        - `createdAt` string, date-time, required
        - `startedAt` string, date-time, nullable, required
        - `completedAt` string, date-time, nullable, required
    - object
      - `status` 'starting', required
      - `preparationId` string, required
      - `repositoryId` string, required
    - object
      - `status` 'failed', required
      - `message` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `429`: The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.
- `500`: An unexpected internal error occurred.

## Changes

- **2026-09-08** `66c8f6ac2730`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/code-audit/scan-requests/:preparationId/get.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)