---
title: "Retrieve Endpoint Detail"
method: GET
path: "/targets/{target_id}/scans/{id}/endpoints/{endpoint_id}/"
tags: ["Scans"]
---

# Retrieve Endpoint Detail

`GET /targets/{target_id}/scans/{id}/endpoints/{endpoint_id}/`

## Request

- Base URL: `https://api.probely.com`
- URL: `https://api.probely.com/targets/{target_id}/scans/{id}/endpoints/{endpoint_id}/`
- Auth: API key in header `Authorization`

Returns detailed information about a specific endpoint including the parsed and obfuscated HTTP request.

## Path parameters

- `endpoint_id` string, required
- `id` string, required: A unique Base58 value identifying this object.
- `target_id` string, required

## Response `200`

- EndpointDetail
  - `id` string, required: Unique identifier of the endpoint.
  - `request_method` string, required: HTTP method of the request (e.g. `GET`, `POST`).
  - `host` string, required: Origin of the endpoint's URL: scheme, host and, when it is not the scheme's default, port (e.g. `"https://example.com"`, `"https://example.com:8443"`). Lowercased. Empty string when the URL has no scheme or host.
  - `url` string, required: Full URL of the endpoint, including query string.
  - `status_code` string, required: HTTP status code returned by the target.
  - `authenticated` boolean, nullable, required: Whether the endpoint was discovered while the crawler was authenticated. * `true` — discovered after login (authenticated phase). * `false` — discovered before login (unauthenticated phase). * `null` — authentication state is unknown.
  - `result` string, required: `accepted` if the endpoint was kept in the coverage report, `rejected` if it was deduplicated.
  - `reason` string, required: Reason for deduplication when `result` is `rejected`. Empty string otherwise.
  - `info` string, required: Additional information about the endpoint reported by the crawler. Empty string when there is none.
  - `raw_request_size` integer, nullable: Size of the raw HTTP request in bytes.
  - `raw_response_size` integer, nullable: Size of the raw HTTP response in bytes.
  - `request_parameters_count` integer, nullable, required: Total number of request parameters (query string + body). `null` when the count is unavailable.
  - `response_time_ms` integer, nullable, required: Time from sending the request to receiving the last byte of the response, in milliseconds, measured while crawling -- not during the scan, which loads the target more and usually sees slower responses. `null` when no request was sent (e.g. the URL was rejected before fetching) or the crawler did not report it.
  - `page_load_ms` integer, nullable, required: Time from navigation start to the end of the page's load event, in milliseconds. Set on page navigations only, never on XHR or fetch requests. Present on web scans only.
  - `changed` string, date-time, required: When this endpoint's row was last written, which today is when the crawler reported it — nothing else updates the row. The column is `auto_now`, so anything that re-saves an endpoint later would move it. A crawl can run for days, so this is what orders the list.
  - `content_type` string, nullable, required: Value of the `Content-Type` request header, or `null` when the header is absent or the request cannot be parsed.
  - `parsed_request` ParsedRequest, required: Structured representation of the raw HTTP request the crawler sent.
    - `url` string, required: Base URL (scheme + host + port) of the request.
    - `method` string, required: HTTP method.
    - `path` string, required: Path component of the request URL.
    - `http_version` string, required: HTTP version (e.g. `"1.1"`).
    - `headers` array[], required: Request headers as `[name, value]` pairs, each element base64-encoded. Header values are replaced with a masked placeholder before encoding when the header is configured on the target as an authentication header or its value references a Probely secret. Cookie values follow the same rule, applied per cookie name inside the `Cookie` header.
      - string[]
    - `body` string, required: Base64-encoded request body. Empty string (`""`) when the request has no body.
    - `params` object, required: Query string parameters, parsed into a map of `name` to a list of values.
  - `parsed_response` ParsedResponse, required: Structured representation of the raw HTTP response.
    - `status_code` integer, required: HTTP status code (e.g. `200`, `404`).
    - `status_message` string, required: HTTP reason phrase (e.g. `"OK"`, `"Not Found"`). Empty string when the server omits it.
    - `http_version` string, required: HTTP version (e.g. `"1.1"`, `"2"`).
    - `headers` array[], required: Response headers as `[name, value]` pairs, each element base64-encoded. Sensitive header values are replaced with a masked placeholder. Sensitive cookies inside `Set-Cookie` headers are masked per cookie name.
      - string[]
    - `body` string, required: Base64-encoded response body (only the body is truncated to the profile-configured cap, default 4 KB; headers are preserved in full). Empty string (`""`) when the response has no body.

## Other responses

- `401`
- `404`
- `500`

## Changes

- **2026-11-03** `0b2f6cbe644d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/changes/targets/:target_id/scans/:id/endpoints/:endpoint_id/get.md)

---

[API](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation.md) - [All operations](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/llms.txt) - [OpenAPI document](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/revisions/0b2f6cbe644d?raw)