---
title: "Get scan"
method: GET
path: "/v1/code-audit/scans/{scanId}"
tags: ["Code Audit"]
---

# Get scan

`GET /v1/code-audit/scans/{scanId}`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/code-audit/scans/{scanId}`
- Auth: HTTP bearer

One scan with its status, progress, counts, and whether its report is locked. Requires code-audit.read.

## Path parameters

- `scanId` string, required

## Response `200`

Requested scan.

- object
  - `success` true, required
  - `data` CodeAuditScan, required
    - `id` string, required
    - `organizationId` string, required
    - `repositoryId` string, required
    - `repositoryName` string, required
    - `branch` string, nullable, required
    - `headCommitSha` string, nullable, required
    - `pullRequestNumber` integer, nullable, required
    - `scope` string, required: What was scanned: repository, pull_request, and so on.
    - `trigger` string, required: What started the scan: manual, pull_request, scheduled.
    - `status` string, required
    - `access` 'full' | 'free-preview' | 'locked', required: Whether every finding is readable. A free preview shows a subset until unlocked.
    - `unlockCredits` integer, nullable, required: Credits needed to unlock a free preview.
    - `findingCount` integer, nullable, required
    - `issueCount` integer, nullable, required
    - `progress` object, nullable, required
      - `stage` string, required
      - `stageStatus` string, nullable, required
      - `completedStages` integer, nullable, required
      - `totalStages` integer, nullable, required
    - `createdAt` string, date-time, required
    - `startedAt` string, date-time, nullable, required
    - `completedAt` string, date-time, nullable, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `429`: The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.
- `500`: An unexpected internal error occurred.

## Changes

- **2026-09-08** `66c8f6ac2730`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/code-audit/scans/:scanId/get.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)