---
title: "Read a prepared full-audit quote"
method: GET
path: "/v1/code-audit/scans/{scanId}/quote"
tags: ["Code Audit"]
---

# Read a prepared full-audit quote

`GET /v1/code-audit/scans/{scanId}/quote`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/code-audit/scans/{scanId}/quote`
- Auth: HTTP bearer

Requires code-audit.read. Returns the complete pinned plan, price, expiry and approval state. Absent approval fields are null. Includes persisted workflow ownership and a canonical Dashboard link. No rollout or start brake hides existing quotes. This is separate from unlocking a completed report.

## Path parameters

- `scanId` string, required

## Query parameters

- `organizationId` string

## Response `200`

Success

- object
  - `success` true, required
  - `data` CodeAuditQuote, required
    - `organizationId` string, required
    - `scanId` string, required
    - `runStatus` string, required
    - `status` 'awaiting' | 'approved', required
    - `quote` object, required
      - `baseCredits` integer, required
      - `createdAt` string, required
      - `expiresAt` string, required
      - `investigationFileCredits` integer, required
      - `plan` object, required
        - `candidatePlanChecksum` string, required
        - `plannedFileCount` integer, required
        - `plannerVersion` string, required
        - `sourceHeadCommitSha` string, required
        - `sourceScopeChecksum` string, required
      - `quoteId` string, required
      - `rateCardVersion` string, required
      - `totalCredits` integer, required
    - `approvalRequestId` string, nullable, required
    - `approvedAt` string, nullable, required
    - `approvedByUserId` string, nullable, required
    - `approvalAvailability` 'api' | 'dashboard' | 'unavailable', required
    - `availabilityReason` 'api_workflow' | 'legacy_dashboard_workflow' | 'workflow_binding_missing', required
    - `dashboardUrl` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `409`: The request conflicts with the current resource state.
- `503`: The capability is temporarily paused by an operator. Retry later.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/code-audit/scans/:scanId/quote/get.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/5a1be8d43402?raw)