# Get an asset

`GET /app/assets/{id}`

One asset with its severity breakdown, open issues, scan schedules, detected technologies and, when its site sends visitors to a host its proof does not cover, which host.

Scope: `assets:read`.

## Parameters

- `id` (path, integer, required)

## Example

```bash
curl -X GET "https://api.fortwatch.ai/app/assets/42" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

## Response 200

The request succeeded.

- `id` (number, required)
- `projectId` (number, required)
- `name` (string | null, required)
- `type` (string, required)
- `value` (string, required)
- `status` (string, required)
- `canonicalUrl` (string | null, required)
- `resolvedIp` (string | null, required)
- `cdnProvider` (string | null, required)
- `bucketProvider` (string | null, required)
- `lastCheckedAt` (string (date-time) | null, required)
- `failReason` (string | null, required)
- `skippedRedirectHost` (string | null, required)
- `disabledScannerTypes` (string[], required)
- `portScanMode` (string, required)
- `nucleiMinSeverity` (string, required)
- `ownershipVerifiedAt` (string (date-time) | null, required)
- `ownershipToken` (string, required)
- `ownershipMethod` (string | null, required)
- `createdAt` (string (date-time), required)
- `updatedAt` (string (date-time), required)
- `project` (object, required)
- `scans` (object[], required)
- `scanSchedules` (object[], required)
- `attentionReasons` (string[], required)
- `lastCompletedScanAt` (string (date-time) | null, required)
- `staleAfterDays` (number, required)
- `severityCounts` (object, required)
  - `critical` (number, required)
  - `high` (number, required)
  - `medium` (number, required)
  - `low` (number, required)
  - `info` (number, required)
- `issues` (object[], required)
- `totalFindings` (number, required)
- `openPorts` (object[], required)
  - `port` (number, required)
  - `protocol` (string, required)
  - `service` (string, required)
  - `version` (object | null, required)
  - `severity` (string, required)
  - `name` (string, required)
- `latestFindings` (object[], required)
- `technologies` (object[], required)
- `findingTrend` (object[], required)
  - `scanId` (number, required)
  - `date` (string (date-time), required)
  - `total` (number, required)
  - `critical` (number, required)
  - `high` (number, required)
  - `medium` (number, required)
  - `low` (number, required)
- `detectedOs` (object | null, required)
- `issueSummary` (object, required)
  - `open` (number, required)
  - `resolved` (number, required)
  - `dismissed` (number, required)
  - `total` (number, required)
  - `lowOpen` (number, required)
  - `lowResolved` (number, required)
- `daysMonitored` (number, required)
- `latestScreenshot` (object | null, required)
- `scannerSummary` (object[], required)
  - `scanner` (string, required)
  - `count` (number, required)
- `remediationProgress` (object[], required)
  - `week` (string (date), required)
  - `opened` (number, required)
  - `resolved` (number, required)
- `skippedRedirect` (object, required)
  - `host` (string, required)
  - `assetId` (number | null, required): The workspace's asset for that host or its www twin
  - `assetValue` (string | null, required): That asset's value: the host or its www twin
  - `assetVerified` (boolean, required): That asset is proven, so it is scanned on its own
  - `signInService` (boolean, required): A well-known sign-in service, which the customer cannot add
  - `underAsset` (boolean, required): A name under the asset, which a DNS proof of the asset covers

```json
{
  "id": 42,
  "projectId": 42,
  "name": "Production",
  "type": "string",
  "value": "app.example.com",
  "status": "string",
  "canonicalUrl": "string",
  "resolvedIp": "string",
  "cdnProvider": "string",
  "bucketProvider": "string",
  "lastCheckedAt": "2026-10-16T12:00:00.000Z",
  "failReason": "string",
  "skippedRedirectHost": "string",
  "disabledScannerTypes": [
    "string"
  ],
  "portScanMode": "string",
  "nucleiMinSeverity": "string",
  "ownershipVerifiedAt": "2026-10-16T12:00:00.000Z",
  "ownershipToken": "string",
  "ownershipMethod": "string",
  "createdAt": "2026-10-16T12:00:00.000Z",
  "updatedAt": "2026-10-16T12:00:00.000Z",
  "project": {},
  "scans": [
    {}
  ],
  "scanSchedules": [
    {}
  ],
  "attentionReasons": [
    "string"
  ],
  "lastCompletedScanAt": "2026-10-16T12:00:00.000Z",
  "staleAfterDays": 1,
  "severityCounts": {
    "critical": 1,
    "high": 1,
    "medium": 1,
    "low": 1,
    "info": 1
  },
  "issues": [
    {}
  ],
  "totalFindings": 1,
  "openPorts": [
    {
      "port": 1,
      "protocol": "string",
      "service": "string",
      "version": {},
      "severity": "string",
      "name": "Production"
    }
  ],
  "latestFindings": [
    {}
  ],
  "technologies": [
    {}
  ],
  "findingTrend": [
    {
      "scanId": 42,
      "date": "2026-10-16T12:00:00.000Z",
      "total": 1,
      "critical": 1,
      "high": 1,
      "medium": 1,
      "low": 1
    }
  ],
  "detectedOs": {},
  "issueSummary": {
    "open": 1,
    "resolved": 1,
    "dismissed": 1,
    "total": 1,
    "lowOpen": 1,
    "lowResolved": 1
  },
  "daysMonitored": 1,
  "latestScreenshot": {},
  "scannerSummary": [
    {
      "scanner": "string",
      "count": 1
    }
  ],
  "remediationProgress": [
    {
      "week": "string",
      "opened": 1,
      "resolved": 1
    }
  ],
  "skippedRedirect": {
    "host": "app.example.com",
    "assetId": 42,
    "assetValue": "string",
    "assetVerified": true,
    "signInService": true,
    "underAsset": true
  }
}
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 404: Not found in your workspace.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.