---
title: "Get scan alert message"
method: GET
path: "/api/v1/scan/{scanId}/uri/{alertUriId}/messages/{messageId}"
tags: ["Scan Results"]
---

# Get scan alert message

`GET /api/v1/scan/{scanId}/uri/{alertUriId}/messages/{messageId}`

# Scan Alert Messages

Provides the scan alert and message payloads (request and response) identified with the finding.

### Alert Message Response

The overall container with details for this specific scan alert.



| Parameter | Default | Description |
|:---:|:---:|:---:|
|scanMessage|{}|The scan message container that holds request and response details.|
|uri|""|The uri or path of the alert finding.|
|evidence|""|The associated evidence of the alert finding.|
|otherInfo|""|Additional info associated with this alert finding.|
|description|""|The details of the alert finding.|
|param|""|Parameters associated with this alert finding.|
|validationCommand|""|The generated validation command (e.g., curl) to reproduce the request.|
|findingHash|""|The SHA-256 finding hash — a stable identifier for this finding across scans.|

#### Validation Command

To include a validation command in the response, set the `includeValidationCommand` query parameter to `true`:

```
GET /api/v1/scan/{scanId}/uri/{alertUriId}/messages/{messageId}?includeValidationCommand=true
```

When enabled, the `validationCommand` field contains a formatted command that can be used to reproduce the request that triggered this finding. This command includes:
- The HTTP method (GET, POST, etc.)
- The full URL with the application host prepended to relative paths
- All request headers formatted as `-H "Header: Value"` flags
- The request body (if present) with proper shell escaping

This allows you to easily validate and reproduce findings by copying and pasting the command into your terminal.

**Note:** By default, `includeValidationCommand` is `false` and the validation command will not be generated.

### Scan Message

The request sent and response received by the scanner.



| Parameter | Default | Description |
|:---:|:---:|:---:|
|id|""|The unique identifier for the message.|
|requestHeader|""|All request headers.|
|cookieParams|""|All request cookies.|
|requestBody|""|The request body.|
|responseHeader|""|The response headers.|
|responseBody|""|The response body.|

See the [Scan Results Analysis](https://apidocs.stackhawk.com/docs/scan-results-analysis) guide for further details on how to use these endpoints.


> Requires `read:scan` permission.

## Path parameters

- `scanId` string, uuid, required
- `alertUriId` string, required
- `messageId` string, required

## Query parameters

- `includeValidationCommand` boolean

## Response `200`

OK

- ApplicationAlertMsgResponse
  - `description` string — The details of the alert finding.
  - `evidence` string — The associated evidence of the alert finding.
  - `findingHash` string — The SHA-256 finding hash — a stable identifier for this finding across scans.
  - `otherInfo` string — Additional info associated with this alert finding.
  - `param` string — Parameters associated with this alert finding.
  - `scanMessage` HawkscanScanMessage
    - `cookieParams` string — All request cookies.
    - `id` string — The unique identifier for the message.
    - `requestBody` string — The request body.
    - `requestHeader` string — All request headers.
    - `responseBody` string — The response body.
    - `responseHeader` string — The response headers.
  - `uri` string — The uri or path of the alert finding.
  - `validationCommand` string — The generated validation command (e.g., curl) to reproduce the request.

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.dev/stackhawk/apis/stackhawk-public-api.md) · [All operations](https://skmtc.dev/stackhawk/apis/stackhawk-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/stackhawk/stackhawk-public-api/revisions/8252990ac9eb/schema)