---
title: "Get a scan run"
method: GET
path: "/api/projects/{projectId}/security/scan-runs/{runId}"
tags: ["Security"]
---

# Get a scan run

`GET /api/projects/{projectId}/security/scan-runs/{runId}`

## Request

- Base URL: `https://api.routebase.dev`
- URL: `https://api.routebase.dev/api/projects/{projectId}/security/scan-runs/{runId}`
- Auth: API key in header `X-API-Key`

Returns the state of a scan, including how many scanners have finished and which
one is running. Once `status` is `completed`, `securityScore` and
`openFindingsCount` are final and a pipeline can gate on them.

## Path parameters

- `ProjectId` string, uuid, required
- `runId` string, uuid, required

## Headers

- `X-RB-Region` string

## Response `200`

The scan run.

- ScanRun: A security scan, from queued through running to its final score and finding count.
  - `id` string, uuid, required: Public id of the scan run.
  - `scanProfilePublicId` string, uuid, required: Profile the run was started from.
  - `status` 'queued' | 'running' | 'completed' | 'failed' | 'cancelled', required: The lifecycle state of a scan run.
  - `trigger` 'manual' | 'scheduled' | 'api' | 'ciCd', required: What started a scan run.
  - `startedAt` string, date-time, required: When the run was queued, in UTC.
  - `completedAt` string, date-time, nullable: When the run finished, in UTC. Null while it is still going.
  - `totalChecks` integer, required: How many individual checks the enabled scanners performed.
  - `checksPassed` integer, required: Checks that found nothing.
  - `checksFailed` integer, required: Checks that produced a finding.
  - `checksSkipped` integer, required: Checks that could not run, for example because an endpoint needs authentication the profile does not carry.
  - `securityScore` integer, required: Score between 0 and 100, final once the status is `completed`.
  - `errorMessage` string, nullable: Set when the run failed.
  - `openFindingsCount` integer, required: Findings still open after this run.
  - `enabledScannerCount` integer: Scanners the profile enables.
  - `scannersCompleted` integer: Scanners finished so far.
  - `currentScannerId` string, nullable: Scanner running right now.
  - `cancelRequestedAt` string, date-time, nullable: Set when a cancel was asked for but the run has not stopped yet.

## Other responses

- `401`: The API key is missing, invalid, expired or revoked. A US organization calling without `X-RB-Region: us` also lands here, because the request reached the wrong region.
- `403`: The key is valid but lacks the permission or the project scope for this call. A scoped key is also refused on organization level operations by design.
- `404`: The resource does not exist, or it belongs to another organization or project. Both cases answer the same way on purpose, so the API cannot be used to probe for foreign identifiers.
- `429`: The rate limit was exceeded. The `Retry-After` header gives the seconds to wait.

---

[API](https://skmtc.dev/routebase/apis/routebase-public-api.md) · [All operations](https://skmtc.dev/routebase/apis/routebase-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/routebase/apis/routebase-public-api/revisions/7187df489f27?raw)