Get an asset

GEThttps://api.fortwatch.ai/app/assets/{id}

Scope assets:readOperation ID getAsset

One asset with its severity breakdown, open issues, scan schedules, detected technologies and, when its site sends visitors to a host its proof does not cover, which host.

Parameters

Name	In	Type	Description
`id`required	path	integer

Example request

curl -X GET "https://api.fortwatch.ai/app/assets/42" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"

Response 200

The request succeeded.

Field	Type	Description
`id`required	number
`projectId`required	number
`name`required	string \| null
`type`required	string
`value`required	string
`status`required	string
`canonicalUrl`required	string \| null
`resolvedIp`required	string \| null
`cdnProvider`required	string \| null
`bucketProvider`required	string \| null
`lastCheckedAt`required	string (date-time) \| null
`failReason`required	string \| null
`skippedRedirectHost`required	string \| null
`disabledScannerTypes`required	string[]
`portScanMode`required	string
`nucleiMinSeverity`required	string
`ownershipVerifiedAt`required	string (date-time) \| null
`ownershipToken`required	string
`ownershipMethod`required	string \| null
`createdAt`required	string (date-time)
`updatedAt`required	string (date-time)
`project`required	object
`scans`required	object[]
`scanSchedules`required	object[]
`attentionReasons`required	string[]
`lastCompletedScanAt`required	string (date-time) \| null
`staleAfterDays`required	number
`severityCounts`required	object
`critical`required	number
`high`required	number
`medium`required	number
`low`required	number
`info`required	number
`issues`required	object[]
`totalFindings`required	number
`openPorts`required	object[]
`port`required	number
`protocol`required	string
`service`required	string
`version`required	object \| null
`severity`required	string
`name`required	string
`latestFindings`required	object[]
`technologies`required	object[]
`findingTrend`required	object[]
`scanId`required	number
`date`required	string (date-time)
`total`required	number
`critical`required	number
`high`required	number
`medium`required	number
`low`required	number
`detectedOs`required	object \| null
`issueSummary`required	object
`open`required	number
`resolved`required	number
`dismissed`required	number
`total`required	number
`lowOpen`required	number
`lowResolved`required	number
`daysMonitored`required	number
`latestScreenshot`required	object \| null
`scannerSummary`required	object[]
`scanner`required	string
`count`required	number
`remediationProgress`required	object[]
`week`required	string (date)
`opened`required	number
`resolved`required	number
`skippedRedirect`required	object
`host`required	string
`assetId`required	number \| null	The workspace's asset for that host or its www twin
`assetValue`required	string \| null	That asset's value: the host or its www twin
`assetVerified`required	boolean	That asset is proven, so it is scanned on its own
`signInService`required	boolean	A well-known sign-in service, which the customer cannot add
`underAsset`required	boolean	A name under the asset, which a DNS proof of the asset covers

json

{
  "id": 42,
  "projectId": 42,
  "name": "Production",
  "type": "string",
  "value": "app.example.com",
  "status": "string",
  "canonicalUrl": "string",
  "resolvedIp": "string",
  "cdnProvider": "string",
  "bucketProvider": "string",
  "lastCheckedAt": "2026-10-16T12:00:00.000Z",
  "failReason": "string",
  "skippedRedirectHost": "string",
  "disabledScannerTypes": [
    "string"
  ],
  "portScanMode": "string",
  "nucleiMinSeverity": "string",
  "ownershipVerifiedAt": "2026-10-16T12:00:00.000Z",
  "ownershipToken": "string",
  "ownershipMethod": "string",
  "createdAt": "2026-10-16T12:00:00.000Z",
  "updatedAt": "2026-10-16T12:00:00.000Z",
  "project": {},
  "scans": [
    {}
  ],
  "scanSchedules": [
    {}
  ],
  "attentionReasons": [
    "string"
  ],
  "lastCompletedScanAt": "2026-10-16T12:00:00.000Z",
  "staleAfterDays": 1,
  "severityCounts": {
    "critical": 1,
    "high": 1,
    "medium": 1,
    "low": 1,
    "info": 1
  },
  "issues": [
    {}
  ],
  "totalFindings": 1,
  "openPorts": [
    {
      "port": 1,
      "protocol": "string",
      "service": "string",
      "version": {},
      "severity": "string",
      "name": "Production"
    }
  ],
  "latestFindings": [
    {}
  ],
  "technologies": [
    {}
  ],
  "findingTrend": [
    {
      "scanId": 42,
      "date": "2026-10-16T12:00:00.000Z",
      "total": 1,
      "critical": 1,
      "high": 1,
      "medium": 1,
      "low": 1
    }
  ],
  "detectedOs": {},
  "issueSummary": {
    "open": 1,
    "resolved": 1,
    "dismissed": 1,
    "total": 1,
    "lowOpen": 1,
    "lowResolved": 1
  },
  "daysMonitored": 1,
  "latestScreenshot": {},
  "scannerSummary": [
    {
      "scanner": "string",
      "count": 1
    }
  ],
  "remediationProgress": [
    {
      "week": "string",
      "opened": 1,
      "resolved": 1
    }
  ],
  "skippedRedirect": {
    "host": "app.example.com",
    "assetId": 42,
    "assetValue": "string",
    "assetVerified": true,
    "signInService": true,
    "underAsset": true
  }
}

Errors

`400`	The request is not valid: a field is missing or has the wrong shape (the message names it).
`401`	No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
`403`	Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
`404`	Not found in your workspace.
`429`	Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.

Every code is explained in Errors.

This page as Markdown