# Get a scan

`GET /app/scans/{id}`

One scan with its status, timing, scanners and finding counts; a failed scan says why when the host was the reason.

Scope: `scans:read`.

## Parameters

- `id` (path, integer, required)

## Example

```bash
curl -X GET "https://api.fortwatch.ai/app/scans/42" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

## Response 200

The request succeeded.

- `scan` (object, required)
  - `id` (number, required)
  - `assetId` (number, required)
  - `status` (string, required)
  - `triggeredBy` (string, required)
  - `triggeredByUserId` (number | null, required)
  - `failureCode` (string | null, required)
  - `failureDetail` (string | null, required)
  - `scannerIp` (string | null, required)
  - `startedAt` (string (date-time) | null, required)
  - `completedAt` (string (date-time) | null, required)
  - `createdAt` (string (date-time), required)
  - `updatedAt` (string (date-time), required)
  - `asset` (object, required)
    - `id` (number, required)
    - `name` (object | null, required)
    - `value` (string, required)
    - `type` (string, required)
    - `project` (object, required)
  - `_count` (object, required)
    - `findings` (number, required)
- `summary` (object, required)
  - `critical` (number, required)
  - `high` (number, required)
  - `medium` (number, required)
  - `low` (number, required)
  - `info` (number, required)

```json
{
  "scan": {
    "id": 42,
    "assetId": 42,
    "status": "string",
    "triggeredBy": "string",
    "triggeredByUserId": 42,
    "failureCode": "string",
    "failureDetail": "string",
    "scannerIp": "string",
    "startedAt": "2026-10-16T12:00:00.000Z",
    "completedAt": "2026-10-16T12:00:00.000Z",
    "createdAt": "2026-10-16T12:00:00.000Z",
    "updatedAt": "2026-10-16T12:00:00.000Z",
    "asset": {
      "id": 42,
      "name": {},
      "value": "app.example.com",
      "type": "string",
      "project": {
        "id": null,
        "name": null
      }
    },
    "_count": {
      "findings": 1
    }
  },
  "summary": {
    "critical": 1,
    "high": 1,
    "medium": 1,
    "low": 1,
    "info": 1
  }
}
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 404: Not found in your workspace.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.