# List assets

`GET /app/assets`

Every asset of the workspace (domains, subdomains, IP addresses, cloud buckets) with its issue counts, ownership state and scan status. Filter by project, type or status.

Scope: `assets:read`. Paged: `page`, `limit` (100 by default, at most 500); `X-Total-Count`, `X-Page`, `X-Limit` headers.

## Parameters

- `projectId` (query, number)
- `type` (query, string)
- `status` (query, string)
- `page` (query, integer): The page, from 1.
- `limit` (query, integer): Rows per page: an API key or OAuth token gets 100 when it sends none, at most 500.

## Example

```bash
curl -X GET "https://api.fortwatch.ai/app/assets?limit=100" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

## Response 200

The request succeeded.

- `id` (number, required)
- `projectId` (number, required)
- `name` (string | null, required)
- `type` (string, required)
- `value` (string, required)
- `status` (string, required)
- `canonicalUrl` (string | null, required)
- `resolvedIp` (string | null, required)
- `cdnProvider` (string | null, required)
- `bucketProvider` (string | null, required)
- `lastCheckedAt` (string (date-time) | null, required)
- `failReason` (string | null, required)
- `skippedRedirectHost` (string | null, required)
- `disabledScannerTypes` (string[], required)
- `portScanMode` (string, required)
- `nucleiMinSeverity` (string, required)
- `ownershipVerifiedAt` (string (date-time) | null, required)
- `ownershipToken` (string, required)
- `ownershipMethod` (string | null, required)
- `createdAt` (string (date-time), required)
- `updatedAt` (string (date-time), required)
- `project` (object, required)
  - `id` (number, required)
  - `name` (string, required)
  - `color` (string, required)
- `scans` (object[], required)
  - `id` (number, required)
  - `status` (string, required)
  - `createdAt` (string (date-time), required)
- `_count` (object, required)
- `rootDomain` (object | null, required)
- `findingCount` (number, required)
- `issueCount` (number, required)
- `openBySeverity` (object, required)
  - `critical` (number, required)
  - `high` (number, required)
  - `medium` (number, required)
  - `low` (number, required)
- `highestIssueSeverity` (object | null, required)
- `attentionReasons` (string[], required)
- `lastCompletedScanAt` (string (date-time) | null, required)
- `staleAfterDays` (number, required)

```json
[
  {
    "id": 42,
    "projectId": 42,
    "name": "Production",
    "type": "string",
    "value": "app.example.com",
    "status": "string",
    "canonicalUrl": "string",
    "resolvedIp": "string",
    "cdnProvider": "string",
    "bucketProvider": "string",
    "lastCheckedAt": "2026-10-16T12:00:00.000Z",
    "failReason": "string",
    "skippedRedirectHost": "string",
    "disabledScannerTypes": [
      "string"
    ],
    "portScanMode": "string",
    "nucleiMinSeverity": "string",
    "ownershipVerifiedAt": "2026-10-16T12:00:00.000Z",
    "ownershipToken": "string",
    "ownershipMethod": "string",
    "createdAt": "2026-10-16T12:00:00.000Z",
    "updatedAt": "2026-10-16T12:00:00.000Z",
    "project": {
      "id": 42,
      "name": "Production",
      "color": "string"
    },
    "scans": [
      {
        "id": null,
        "status": null,
        "createdAt": null
      }
    ],
    "_count": {},
    "rootDomain": {},
    "findingCount": 1,
    "issueCount": 1,
    "openBySeverity": {
      "critical": 1,
      "high": 1,
      "medium": 1,
      "low": 1
    },
    "highestIssueSeverity": {},
    "attentionReasons": [
      "string"
    ],
    "lastCompletedScanAt": "2026-10-16T12:00:00.000Z",
    "staleAfterDays": 1
  }
]
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.