---
title: "List organization-scoped scan templates"
method: GET
path: "/api/v3.0/redteaming/orgs/{orgUuid}/templates"
tags: ["Red Team - Templates"]
---

# List organization-scoped scan templates

`GET /api/v3.0/redteaming/orgs/{orgUuid}/templates`

## Request

- Base URL: `https://baseUrl`
- URL: `https://baseUrl/api/v3.0/redteaming/orgs/{orgUuid}/templates`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/mend/apis/mend-api/docs/api/v3.0/redteaming/orgs/:orgUuid/templates/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a paginated list of organization-scoped scan templates.

## Path parameters

- `orgUuid` string, uuid, required

## Query parameters

- `pretty` boolean
- `cursor` integer
- `limit` integer

## Headers

- `X-Correlation-ID` string, uuid

## Response `200`

Template collection. `config.probes` and `config.strategies` are human-readable probe and strategy names. On write, either an id or a name is accepted.

- TemplateCollection
  - `supportToken` string, uuid, required: Correlation id used for this request. Same value as the X-Correlation-ID response header.
  - `additionalData` AdditionalData, required
    - `totalItems` string, required: Total number of items, encoded as a string.
    - `cursor` integer
    - `next` string, nullable: URL of the next page, or null when this page is the last.
  - `response` Template[], required
    - `id` string, uuid, required
    - `name` string, required
    - `description` string, required
    - `config` TemplateConfig, required
      - `probes` string[]: Human-readable probe or strategy names. Writes accept an id or a name.
      - `strategies` string[]: Human-readable probe or strategy names. Writes accept an id or a name.
      - `numTests` integer
      - `maxConcurrency` integer
      - `language` union
        - string
        - string[]
      - `probeTimeoutMs` integer
      - `maxCampaignTimeMs` integer
    - `scopeType` 'organization' | 'application' | 'project', required
    - `organization` string, required
    - `application` string, required
    - `project` string, required
    - `createdBy` string, required
    - `updatedBy` string, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `canEdit` boolean, required
    - `canDelete` boolean, required
    - `_links` Links, required

## Other responses

- `400`: X-Correlation-ID is not a UUID (CORRELATION.INVALID), cursor is not a whole number of 0 or greater (PAGE.CURSOR), or limit is not a whole number from 1 to 200 (PARAM.INT_RANGE).
- `401`: Authentication failed. The job report returns this JSON envelope and never a PDF or CSV attachment. Codes: AUTH.REQUIRED, AUTH.FAILED, AUTH.USER_HEADER_MISMATCH, JWT.EXPIRED, JWT.SIGNATURE, JWT.STRUCTURE, JWT.MISSING_CLAIMS, JWT.UNAVAILABLE, JWT.CLAIM_INVALID, JWT.VERIFICATION_FAILED.
- `403`: Authentication succeeded but the call is not allowed. AUTH.SERVICE_BOT: a service-to-service token cannot call this API. AUTH.ORG_MISMATCH: the organization in the URL does not match the access token. AUTH.INSUFFICIENT_PERMISSIONS: the token lacks permission for this action. Template update and delete also return AUTH.INSUFFICIENT_PERMISSIONS when the caller is not the template owner and does not have manage-settings access. TEMPLATE.ORG_SCOPE_DENIED: a template write whose scope is organization without organization-level manage-targets permission.
- `429`: The caller exceeded the per-user request rate (RATE.LIMITED). The default is 600 requests per minute per user. Retry after the number of seconds in Retry-After.
- `500`: INTERNAL.ERROR: an unexpected failure. Retry and include supportToken if it continues. AUTH.PERMISSIONS_UNRESOLVED: permissions could not be resolved.
- `503`: The API is temporarily unavailable and is not accepting this request. This body is not the error envelope.

## Changes

- **2026-10-22** `17de76ee2fb8`: 10 warning, 5 info
  - added the new `CONFIG.NO_ACTIVE_SCANNER` enum value to the `response/error` response property for the response status `400`
  - added the new `CONFIG.NO_ACTIVE_SCANNER` enum value to the `response/error` response property for the response status `401`
  - added the new `CONFIG.NO_ACTIVE_SCANNER` enum value to the `response/error` response property for the response status `403`
  - added the new `CONFIG.NO_ACTIVE_SCANNER` enum value to the `response/error` response property for the response status `429`
  - …11 more
- **2026-10-01** `67a0e59611cd`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/mend/apis/mend-api/changes/api/v3.0/redteaming/orgs/:orgUuid/templates/get.md)

---

[API](https://skmtc.dev/mend/apis/mend-api.md) - [All operations](https://skmtc.dev/mend/apis/mend-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mend/apis/mend-api/revisions/17de76ee2fb8?raw)