List assets

GEThttps://api.fortwatch.ai/app/assets

Scope assets:readPagedOperation ID listAssets

Every asset of the workspace (domains, subdomains, IP addresses, cloud buckets) with its issue counts, ownership state and scan status. Filter by project, type or status.

Paged: send page and limit (100 by default, at most 500); the total is in X-Total-Count (paging).

Parameters

Name	In	Type	Description
`projectId`	query	number
`type`	query	string
`status`	query	string
`page`	query	integer	The page, from 1.
`limit`	query	integer	Rows per page: an API key or OAuth token gets 100 when it sends none, at most 500.

Example request

curl -X GET "https://api.fortwatch.ai/app/assets?limit=100" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"

Response 200

The request succeeded.

Field	Type	Description
`id`required	number
`projectId`required	number
`name`required	string \| null
`type`required	string
`value`required	string
`status`required	string
`canonicalUrl`required	string \| null
`resolvedIp`required	string \| null
`cdnProvider`required	string \| null
`bucketProvider`required	string \| null
`lastCheckedAt`required	string (date-time) \| null
`failReason`required	string \| null
`skippedRedirectHost`required	string \| null
`disabledScannerTypes`required	string[]
`portScanMode`required	string
`nucleiMinSeverity`required	string
`ownershipVerifiedAt`required	string (date-time) \| null
`ownershipToken`required	string
`ownershipMethod`required	string \| null
`createdAt`required	string (date-time)
`updatedAt`required	string (date-time)
`project`required	object
`id`required	number
`name`required	string
`color`required	string
`scans`required	object[]
`id`required	number
`status`required	string
`createdAt`required	string (date-time)
`_count`required	object
`rootDomain`required	object \| null
`findingCount`required	number
`issueCount`required	number
`openBySeverity`required	object
`critical`required	number
`high`required	number
`medium`required	number
`low`required	number
`highestIssueSeverity`required	object \| null
`attentionReasons`required	string[]
`lastCompletedScanAt`required	string (date-time) \| null
`staleAfterDays`required	number

json

[
  {
    "id": 42,
    "projectId": 42,
    "name": "Production",
    "type": "string",
    "value": "app.example.com",
    "status": "string",
    "canonicalUrl": "string",
    "resolvedIp": "string",
    "cdnProvider": "string",
    "bucketProvider": "string",
    "lastCheckedAt": "2026-10-16T12:00:00.000Z",
    "failReason": "string",
    "skippedRedirectHost": "string",
    "disabledScannerTypes": [
      "string"
    ],
    "portScanMode": "string",
    "nucleiMinSeverity": "string",
    "ownershipVerifiedAt": "2026-10-16T12:00:00.000Z",
    "ownershipToken": "string",
    "ownershipMethod": "string",
    "createdAt": "2026-10-16T12:00:00.000Z",
    "updatedAt": "2026-10-16T12:00:00.000Z",
    "project": {
      "id": 42,
      "name": "Production",
      "color": "string"
    },
    "scans": [
      {
        "id": null,
        "status": null,
        "createdAt": null
      }
    ],
    "_count": {},
    "rootDomain": {},
    "findingCount": 1,
    "issueCount": 1,
    "openBySeverity": {
      "critical": 1,
      "high": 1,
      "medium": 1,
      "low": 1
    },
    "highestIssueSeverity": {},
    "attentionReasons": [
      "string"
    ],
    "lastCompletedScanAt": "2026-10-16T12:00:00.000Z",
    "staleAfterDays": 1
  }
]

Errors

`400`	The request is not valid: a field is missing or has the wrong shape (the message names it).
`401`	No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
`403`	Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
`429`	Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.

Every code is explained in Errors.

This page as Markdown