---
title: "Get a runtime validation run"
method: POST
path: "/api/v2/runtimeValidation/getValidationRun"
tags: ["Runtime Validation"]
---

# Get a runtime validation run

`POST /api/v2/runtimeValidation/getValidationRun`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/runtimeValidation/getValidationRun`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Return the validation run lifecycle state and persisted per-issue runtime validation results. This route returns validation evidence, not decrypted application input values.

## Request body

- RuntimeValidationGetValidationRunRequest
  - `organizationId` string
  - `runId` string, required

## Response `200`

Runtime validation run detail

- RuntimeValidationRunDetail
  - `id` string, required
  - `profileId` string, required
  - `codeScanId` string, required
  - `status` 'PENDING' | 'PROCESSING' | 'COMPLETED' | 'FAILED' | 'CANCELLED', required: Queue and lifecycle status for a runtime validation run.
  - `triggerReason` 'USER_REQUESTED' | 'AUTO_AFTER_SCAN', required: Why the validation run was created.
  - `triggeredByUserId` string, nullable, required
  - `startedAt` string, date-time, nullable, required
  - `completedAt` string, date-time, nullable, required
  - `cancelledAt` string, date-time, nullable, required
  - `summary` string, nullable, required
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `organizationId` string, required
  - `lockedAt` string, date-time, nullable, required
  - `lockedBy` string, nullable, required
  - `genericErrorId` string, nullable, required
  - `applicationInfo` object, required
    - `id` string, required
    - `name` string, required
    - `directoryPath` string, required
    - `repositoryId` string, required
  - `codeScan` object, required
    - `id` string, required
    - `repositoryId` string, required
    - `codeScanType` 'FullScan' | 'PrScan', required
    - `scanTargetBranch` string, nullable, required
    - `scanTargetBranchCommitSha` string, nullable, required
    - `scanFinishedAt` string, date-time, nullable, required
    - `createdAt` string, date-time, required
  - `results` RuntimeValidationRunResult[], required
    - `id` string, required
    - `codeScanVulnerabilityId` string, required
    - `detectedVulnerabilityId` string, nullable, required
    - `issue` RuntimeValidationIssueSummary, required
      - `id` string, required
      - `title` string, required
      - `severity` number, required
      - `vulnClass` string, required
      - `affectedFile` string, required
      - `startLine` integer, required
      - `endLine` integer, required
      - `issueStatus` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
    - `verdict` 'CONFIRMED' | 'DISCONFIRMED' | 'UNTESTABLE' | 'AGENT_ERROR', required: Result of dynamically testing a single issue.
    - `isDynamicallyTestable` boolean, required
    - `testabilityReasoning` string, required
    - `validationReasoning` string, nullable, required
    - `evidenceSummary` string, nullable, required
    - `validationSteps` object[], required
      - `target` string, nullable, required
      - `action` string, required
      - `expectedResult` string, nullable, required
      - `observedResult` string, required
      - `conclusion` string, required
    - `attackReproductionSteps` string[], required: Researcher-facing natural-language steps for reproducing a confirmed runtime exploit in an authorized test environment.
    - `testedTargets` string[], required: Concrete runtime surfaces exercised by the agent: URLs, WebSocket routes, gRPC methods, socket targets, queue/topic names, or test harness identifiers.
    - `testedRoles` string[], required
    - `pocPython` string, nullable, required
    - `pocInstructions` string, nullable, required
    - `error` string, nullable, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
  - `issues` RuntimeValidationRunIssue[], required
    - `id` string, required
    - `title` string, required
    - `severity` number, required
    - `vulnClass` string, required
    - `affectedFile` string, required
    - `startLine` integer, required
    - `endLine` integer, required
    - `issueStatus` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
    - `result` RuntimeValidationRunResult, required
      - `id` string, required
      - `codeScanVulnerabilityId` string, required
      - `detectedVulnerabilityId` string, nullable, required
      - `issue` RuntimeValidationIssueSummary, required
        - `id` string, required
        - `title` string, required
        - `severity` number, required
        - `vulnClass` string, required
        - `affectedFile` string, required
        - `startLine` integer, required
        - `endLine` integer, required
        - `issueStatus` 'PENDING_REVIEW' | 'REVIEWING' | 'PATCHING' | 'NON_EXPLOITABLE' | 'FALSE_POSITIVE' | 'ACCEPTED_RISK' | 'RESOLVED' | 'BACKLOG' | 'INFORMATIONAL', required
      - `verdict` 'CONFIRMED' | 'DISCONFIRMED' | 'UNTESTABLE' | 'AGENT_ERROR', required: Result of dynamically testing a single issue.
      - `isDynamicallyTestable` boolean, required
      - `testabilityReasoning` string, required
      - `validationReasoning` string, nullable, required
      - `evidenceSummary` string, nullable, required
      - `validationSteps` object[], required
        - `target` string, nullable, required
        - `action` string, required
        - `expectedResult` string, nullable, required
        - `observedResult` string, required
        - `conclusion` string, required
      - `attackReproductionSteps` string[], required: Researcher-facing natural-language steps for reproducing a confirmed runtime exploit in an authorized test environment.
      - `testedTargets` string[], required: Concrete runtime surfaces exercised by the agent: URLs, WebSocket routes, gRPC methods, socket targets, queue/topic names, or test harness identifiers.
      - `testedRoles` string[], required
      - `pocPython` string, nullable, required
      - `pocInstructions` string, nullable, required
      - `error` string, nullable, required
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required

## Other responses

- `400`: Error Response
- `401`: Error Response
- `403`: Error Response
- `404`: Error Response
- `409`: Error Response
- `412`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)