---
title: "Get Inbox item"
method: GET
path: "/v1/inbox/{itemId}"
tags: ["Inbox"]
---

# Get Inbox item

`GET /v1/inbox/{itemId}`

## Request

- Base URL: `https://api.inth.com`
- URL: `https://api.inth.com/v1/inbox/{itemId}`
- Auth: HTTP bearer

One finding with its code evidence. A runtime finding also carries `runtimeVendor`: the project and vendor IDs, and evidence of how the vendor loaded, such as the script URL and Google Tag Manager container. Requires inbox.read.

## Path parameters

- `itemId` string, required

## Response `200`

Requested item.

- object
  - `success` true, required
  - `data` InboxItemDetail, required
    - `assignedToUserId` string, nullable, required
    - `githubIssue` object, nullable, required
      - `createdAt` string, required
      - `number` integer, required
      - `url` string, required
    - `id` string, required
    - `organizationId` string, required
    - `priority` 'P0' | 'P1' | 'P2' | 'P3', nullable, required
    - `projectId` string, nullable, required
    - `repositoryName` string, nullable, required
    - `source` 'advisory' | 'code-audit' | 'runtime' | 'website-audit', required
    - `status` 'accepted' | 'dismissed' | 'open' | 'resolved', required
    - `summary` string, nullable, required
    - `title` string, required
    - `updatedAt` string, required
    - `version` string, required
    - `codeEvidence` object, nullable, required
      - `filePath` string, required
      - `lineNumbers` integer[], required
      - `recommendation` string, nullable, required
      - `reportId` string, nullable, required
      - `repositoryHtmlUrl` string, required
      - `rule` string, required
      - `snippet` string, nullable, required
      - `snippetEndLine` integer
      - `snippetStartLine` integer
    - `codeEvidenceBlocks` object[], required
      - `filePath` string, required
      - `lineNumbers` integer[], required
      - `recommendation` string, nullable, required
      - `reportId` string, nullable, required
      - `repositoryHtmlUrl` string, required
      - `rule` string, required
      - `snippet` string, nullable, required
      - `snippetEndLine` integer
      - `snippetStartLine` integer
    - `websiteEvidence` object, nullable, required
      - `targetId` string, required
      - `resolution` 'open' | 'manual' | 'verified_fixed', required
      - `verification` object, nullable
        - `scanId` string, required
        - `engineRunId` string, required
        - `verifiedAt` string, required
        - `references` string[], required
      - `ruleId` string, required
      - `ruleVersion` string, required
      - `scanId` string, required
      - `engineRunId` string, required
      - `pageUrl` string, required
      - `region` string, required
      - `scenario` string, required
      - `subject` string, required
      - `evidenceStatus` 'confirmed_technical' | 'needs_review', required
      - `recommendation` string, required
      - `references` string[], required
      - `notice` string, required
    - `assignmentOptionsPath` string, required
    - `runtimeVendor` object, nullable, required
      - `consentCategory` string, nullable, required
      - `evidence` object[], required
        - `kind` string, required
        - `loadedBy` object, nullable, required
          - `initiator` string, nullable, required
          - `scriptUrl` string, nullable, required
          - `tagManagerContainerId` string, nullable, required
          - `viaGoogleTagManager` boolean, required
        - `observedAt` string, required
        - `pageUrl` string, nullable, required
        - `source` string, required
        - `value` string, required
      - `firstSeenAt` string, required
      - `hosts` string[], required
      - `lastSeenAt` string, required
      - `name` string, required
      - `privacyPolicyUrl` string, nullable, required
      - `projectId` string, required
      - `projectSlug` string, required
      - `reviewState` 'accepted' | 'suggested' | 'rejected' | 'needs_review', required
      - `sources` string[], required
      - `state` 'active' | 'not_seen_recently' | 'ignored' | 'approved' | 'blocked', required
      - `vendorId` string, required

## Other responses

- `400`: The request payload or parameters are invalid.
- `401`: Authentication is missing, invalid, or expired.
- `403`: The credential is valid but may not perform the operation. `INSUFFICIENT_SCOPE`: the credential was never granted the capability the operation needs. `details.requiredScope` names it, and the `WWW-Authenticate` header carries `Bearer error="insufficient_scope"`. An OAuth client fixes this by requesting the scope; an organization API key cannot gain it. `FORBIDDEN`: the capability is present but the membership behind the credential lacks the role, or the resource belongs to another organization.
- `404`: The requested resource was not found.
- `429`: The rate limit was exceeded. API key limits are set by plan tier (Starter 600/min, Pro 1500/min, Enterprise 3000/min). Check the Retry-After header before retrying.
- `500`: An unexpected internal error occurred.

## Changes

- **2026-10-31** `a3f4100e14c9`: 1 breaking, 19 info
  - the `data` response's property type changed from no type to `object` for status `200`
  - removed `#/components/schemas/InboxItem, subschema #2` from the `data` response property `allOf` list for the response status `200`
  - added the required property `data/assignedToUserId` to the response with the `200` status
  - added the required property `data/assignmentOptionsPath` to the response with the `200` status
  - …16 more
- **2026-10-19** `8ebea9777d0c`: 1 info
  - added the required property `data/allOf[subschema #2]/runtimeVendor` to the response with the `200` status
- **2026-09-08** `66c8f6ac2730`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/inth/apis/inth-api/changes/v1/inbox/:itemId/get.md)

---

[API](https://skmtc.dev/inth/apis/inth-api.md) - [All operations](https://skmtc.dev/inth/apis/inth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/inth/apis/inth-api/revisions/8741280c3463?raw)