---
title: "List client reports"
method: GET
path: "/api/agent/agency/reports"
tags: ["Agency"]
---

# List client reports

`GET /api/agent/agency/reports`

## Request

- Base URL: `https://preuve.ai`
- URL: `https://preuve.ai/api/agent/agency/reports`
- Auth: API key in header `x-preuve-key`

Every client report in the workspace, newest first - including reports created in the Agency dashboard rather than through this API. Paginated with limit/offset; nextOffset is null on the last page.

## Query parameters

- `limit` integer
- `offset` integer

## Response `200`

One page of client reports.

- AgencyReportList
  - `reports` AgencyReportListItem[]
    - `reportId` string
    - `title` string, nullable
    - `status` string
    - `scanType` 'starter' | 'deep'
    - `createdAt` string, date-time
    - `reportUrl` string, uri
  - `nextOffset` integer, nullable: Offset of the next page, or null on the last page.

## Other responses

- `400`: limit must be 1-50 and offset 0-10000 (INVALID_PAGINATION).
- `401`: Missing x-preuve-key header (MISSING_API_KEY), or a malformed, unknown or revoked key (INVALID_AGENT_KEY - the same envelope for all three, on purpose). Repeated failures are throttled per IP and answer 429.
- `403`: The key is valid but does not carry the one Agency scope the route it called requires (INSUFFICIENT_SCOPE). The two are enforced per route and neither implies the other: POST /api/agent/agency/analyses requires agency:write, and every other Agency route - the workspace context, the report list, the report poll and the export - requires agency:read, so there is no separate export scope on this surface and a key carrying only the other Agency scope is refused here too. Note that every key created before 2026-09-09 hits this: these routes previously accepted the personal analysis:read / export:read scopes, and scopes are fixed at creation rather than backfilled, so an older key needs a new grant. Neither route to one is unconditional. Reconnecting the client works on any plan, free included, but /authorize only ever intersects the scopes the client requests, so a client replaying the scope list it cached at registration mints another Agency-less key and revokes the working one on the way - check the consent screen lists the Agency permissions before approving. Creating a key by hand cannot silently fail, but it needs "Include Agency workspace access" ticked AND an account that may create keys by hand: a paid personal plan, or membership of a Consultant or Agency workspace with an active subscription or a one-time unlock.
- `404`: No Agency workspace on this account, or workspace membership was removed (AGENCY_NOT_FOUND). Membership is resolved live on every call.
- `429`: Rate limited (RATE_LIMITED or DAILY_LIMIT_REACHED). RATE_LIMITED carries a Retry-After header with the seconds until the window resets; the quota-shaped codes clear on a different clock and put resetAt in the body instead.
- `500`: Unexpected server error (INTERNAL_ERROR, or TRIGGER_DISPATCH_FAILED when a deep scan could not be handed to the job runner). Never tell the user their quota is safe: on a deep scan the spend can already have happened when the failure hit, and an ambiguous dispatch deliberately keeps the report and its funding because the job may have been accepted before its response was lost. Treat consumption as unknown and retry with backoff. On an operation that takes a clientRunId, retry with the SAME one - that reconciles the original run, whatever state it reached, instead of starting and charging for a second one. On every other operation there is nothing to reconcile: the read or export simply failed, so a plain backed-off retry is the whole recovery.
- `503`: A dependency was unavailable or deliberately paused (SERVICE_DISABLED, LLM_PAUSED, PROFILE_LOOKUP_FAILED, and the fail-closed answer when the rate-limit backend is down). Any authenticated route can answer this one: authentication meters itself through the same fail-closed limiter, so an outage there refuses the request before the handler runs. Retryable, and no paid quota, tokens, or scans were consumed - a pause that lands mid-run refunds the claim it had already made. Back off and try again rather than falling back to a different endpoint.

---

[API](https://skmtc.dev/preuve/apis/preuve-agent-api.md) · [All operations](https://skmtc.dev/preuve/apis/preuve-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/preuve/apis/preuve-agent-api/revisions/b8e99c2a4fc7?raw)