---
title: "List scan results"
method: GET
path: "/api/v1/scan/{orgId}"
tags: ["Scan Results"]
---

# List scan results

`GET /api/v1/scan/{orgId}`

## List Scans

This endpoint lists the latest scan results that belong to this organization. This endpoint is used to populate
the [scans page](https://app.stackhawk.com/scans) in the StackHawk Platform.

Scan Results are reported relative to a scanned application, and by default are sorted in order of the scan date.

Scan Results are returned paginated and can be requested with the pagination parameters.

The returned list of scans is filtered by the User's API Token Team membership.

### Application Scan Results

Calling this endpoint will return paginated `applicationScanResults`. These scan results additionally correspond
historically to the scanned application.
Each object includes the `scan` object with details of the underlying point-in-time scan.

The `applicationAlerts` field is always an empty when returned by this endpoint.

The results of a run of HawkScan, contextual to a scanned application, and other previously triaged findings.

| Parameter | Default | Description |
|:---:|:---:|:---:|
|scan|{}|The results of the finished scan.|
|scanDuration|0|Time in seconds the scan took to run.|
|urlCount|0|The number of urls scanned.|
|alertStats|{}|Alert statistics of this scan.|
|severityStats|[]|Recordings of scan counts made by severity and statistic.|
|configHash|""|A hash of the configuration used for this run of HawkScan.|
|appHost|""|The scanned host endpoint.|
|applicationAlerts|[]|Scan findings contextual to this application and run of HawkScan.|
|timestamp|0|Seconds since unix epoch time of when this was run.|
|scanErrors|[]|Errors encountered from this run of HawkScan.|
|scanProgress|{}|Populated progress and scan detail.|
|percentComplete|0|Indicates completeness of a STARTED scan in the scan list. ERROR and COMPLETED scans report 100.|
|policyName|""|Named scan policy used for this run of HawkScan.|
|externalAlertStats|[]|External finding statistics contextual to this scan result.|
|tags|[]|Any tags associated with this scan result.|
|metadata|{}|Any metadata associated with the scan.|

### Scan

Represents the core elements of a single HawkScan run. Finished scans will include ScanResults, including alerts of findings contextual to the scanned application.
The Scan also represents its current operational state (STARTED / COMPLETED / ERROR).
For more information, see [Scans](https://docs.stackhawk.com/web-app/scans.html).

| Parameter | Default | Description |
|:---:|:---:|:---:|
|id|""|the UUID identifier of this scan|
|repoId|""|a hash of the scanned repo git name|
|version|""|the version of HawkScan used to scan this application|
|applicationId|""|the UUID applicationId corresponding to the scanned application|
|externalUserId|""|the UUID identifier of the StackHawk user that started this scan|
|env|""|the name of the scanned environment|
|status|"UNKNOWN"|the current state of the running scan (STARTED / COMPLETED / ERROR)|
|applicationName|""|the name of the corresponding scanned application|
|timestamp|0|seconds since unix epoch timestamp of when the scan was started|
|envId|""|the UUID environmentId corresponding to the scanned environment|
|parentScanId|""|If this scan is a result of a retest, this is the id of the scan it retested|
|metadata|{}|Metadata pertaining to the scan.|
|hawkScanType|"UNKNOWN"|The type of HawkScan execution (traditional, hosted, etc.)|

See the [Scan Results Analysis](https://apidocs.stackhawk.com/docs/scan-results-analysis) guide for further details on how to use these endpoints.


> Requires `read:scan` permission.

## Path parameters

- `orgId` string, uuid, required

## Query parameters

- `appIds` string[]
- `envs` string[]
- `teamIds` string[]
- `start` integer
- `end` integer
- `pageSize` integer
- `pageToken` integer
- `sortField` 'id' | 'name'
- `sortDir` 'asc' | 'desc'
- `applicationTypes` string[]
- `tag` string[]

## Response `200`

Paginated response of scan results.

- ApplicationListScanResultsResponse — Paginated response of scan results.
  - `applicationScanResults` ApplicationApplicationScanResult[] — found list of application scan results.
    - `alertStats` ApplicationScanAlertStats — A summary of alert statistics from a run of HawkScan.
      - `alertStatusStats` ApplicationAlertStatusStats[] — Statistics for findings of this scan by severity and triage status.
        - `alertStatus` 'UNKNOWN' | 'FALSE_POSITIVE' | 'RISK_ACCEPTED' | 'PROMOTED' | 'ADD_COMMENT' — Triage status of this scan alert.
        - `severityStats` object — A map of finding counts by severity ("High" "Medium" "Low")
        - `totalCount` integer — Total number of findings on paths
      - `totalAlerts` integer — The total number of findings from the scan.
      - `uniqueAlerts` integer — The total number of unique findings across all paths in the scan.
    - `appHost` string — The scanned host endpoint.
    - `applicationAlerts` ApplicationApplicationAlert[] — Scan findings contextual to this application and run of HawkScan.
      - `alertStatusStats` ApplicationAlertStatusStats[] — Statistical snapshot of alerts by status.
        - `alertStatus` 'UNKNOWN' | 'FALSE_POSITIVE' | 'RISK_ACCEPTED' | 'PROMOTED' | 'ADD_COMMENT' — Triage status of this scan alert.
        - `severityStats` object — A map of finding counts by severity ("High" "Medium" "Low")
        - `totalCount` integer — Total number of findings on paths
      - `cweId` string — The cwe id of this alert.
      - `description` string — A markdown flavored description of this alert.
      - `externalAlertsResult` SastExternalAlertsResult[] — External findings associated with this alert.
        - `externalAlerts` SastExternalAlert[]
          - `codeRegion` SastCodeRegion
            - `endColumn` integer
            - `endLine` integer
            - `startColumn` integer
            - `startLine` integer
          - `codeSnippet` SastCodeSnippet
            - `lines` SastCodeLine[]
              - …
          - `cweId` string
          - `description` string
          - `filePath` string
          - `fileUrl` string
          - `id` string
          - `integrationType` 'UNKNOWN' | 'SLACK' | 'JIRA' | 'DATADOG' | 'MSTEAMS' | 'WEBHOOK' | 'JIRA_SERVER' | 'SNYK' | 'GITHUB' | 'MERGE_AZURE_DEVOPS_BOARDS' | 'VANTA' | 'AZURE_DEVOPS' | 'BITBUCKET' | 'GITLAB' | 'EMAIL' | 'GITHUB_ENTERPRISE' | 'GITLAB_SELF_HOSTED' | 'BITBUCKET_SELF_HOSTED' | 'AZURE_DEVOPS_SELF_HOSTED' | 'SEMGREP' | 'ENDOR_LABS' | 'WIZ'
          - `issueUrl` string
          - `origin` 'UNKNOWN' | 'GITHUB' | 'GITLAB' | 'AZURE_REPOS' | 'BITBUCKET' | 'SEMGREP' | 'ENDOR_LABS'
          - `severity` string
          - `title` string
        - `integrationType` 'UNKNOWN' | 'SLACK' | 'JIRA' | 'DATADOG' | 'MSTEAMS' | 'WEBHOOK' | 'JIRA_SERVER' | 'SNYK' | 'GITHUB' | 'MERGE_AZURE_DEVOPS_BOARDS' | 'VANTA' | 'AZURE_DEVOPS' | 'BITBUCKET' | 'GITLAB' | 'EMAIL' | 'GITHUB_ENTERPRISE' | 'GITLAB_SELF_HOSTED' | 'BITBUCKET_SELF_HOSTED' | 'AZURE_DEVOPS_SELF_HOSTED' | 'SEMGREP' | 'ENDOR_LABS' | 'WIZ'
        - `isAllExternalAlerts` boolean
        - `projectUrl` string
      - `name` string — The name of the Zap plugin this alert triggered for.
      - `pluginId` string — The id of the Zap plugin that triggered this alert.
      - `references` string[] — External urls and study references to understand this findings.
      - `requestMethod` string — **Deprecated** - 4/25/22
      - `scan` ScanresultsScan — Represents the core elements of a single HawkScan run. Finished scans will include ScanResults, including alerts of findings contextual to the scanned application. The Scan also represents its current operational state (STARTED / COMPLETED / ERROR). For more information, see [Scans](https://docs.stackhawk.com/web-app/scans.html).
        - `applicationId` string — the UUID applicationId corresponding to the scanned application
        - `applicationName` string — the name of the corresponding scanned application
        - `env` string — the name of the scanned environment
        - `envId` string — the UUID environmentId corresponding to the scanned environment
        - `externalUserId` string — the UUID identifier of the StackHawk user that started this scan
        - `hawkScanType` 'HAWKSCAN_TYPE_SCAN' | 'HAWKSCAN_TYPE_FLIGHTPATH' | 'HAWKSCAN_TYPE_HOSTED' | 'HAWKSCAN_TYPE_CONFIGURATION' — The type of HawkScan execution (traditional, hosted, etc.)
        - `id` string — the UUID identifier of this scan
        - `metadata` ScanresultsMetaData
          - `tags` object
        - `parentScanId` string — If this scan is a result of a retest, this is the id of the scan it retested
        - `repoId` string — a hash of the scanned repo git name
        - `status` 'UNKNOWN' | 'COMPLETED' | 'ERROR' | 'STARTED' — the current state of the running scan (STARTED / COMPLETED / ERROR)
        - `timestamp` integer — seconds since unix epoch timestamp of when the scan was started
        - `version` string — the version of HawkScan used to scan this application
      - `severity` string — The severity of this finding. One of "High" "Medium" or "Low".
      - `uriCount` integer — The number of scanned urls that report this alert.
    - `configHash` string — A hash of the configuration used for this run of HawkScan.
    - `externalAlertStats` SastExternalAlertStats[] — External finding statistics contextual to this scan result.
      - `integrationType` 'UNKNOWN' | 'SLACK' | 'JIRA' | 'DATADOG' | 'MSTEAMS' | 'WEBHOOK' | 'JIRA_SERVER' | 'SNYK' | 'GITHUB' | 'MERGE_AZURE_DEVOPS_BOARDS' | 'VANTA' | 'AZURE_DEVOPS' | 'BITBUCKET' | 'GITLAB' | 'EMAIL' | 'GITHUB_ENTERPRISE' | 'GITLAB_SELF_HOSTED' | 'BITBUCKET_SELF_HOSTED' | 'AZURE_DEVOPS_SELF_HOSTED' | 'SEMGREP' | 'ENDOR_LABS' | 'WIZ'
      - `projectUrl` string
    - `metadata` ScanresultsMetaData
      - `tags` object
    - `percentComplete` integer — Indicates completeness of a STARTED scan in the scan list. ERROR and COMPLETED scans report 100.
    - `policyName` string — Named scan policy used for this run of HawkScan.
    - `scan` ScanresultsScan — Represents the core elements of a single HawkScan run. Finished scans will include ScanResults, including alerts of findings contextual to the scanned application. The Scan also represents its current operational state (STARTED / COMPLETED / ERROR). For more information, see [Scans](https://docs.stackhawk.com/web-app/scans.html).
      - `applicationId` string — the UUID applicationId corresponding to the scanned application
      - `applicationName` string — the name of the corresponding scanned application
      - `env` string — the name of the scanned environment
      - `envId` string — the UUID environmentId corresponding to the scanned environment
      - `externalUserId` string — the UUID identifier of the StackHawk user that started this scan
      - `hawkScanType` 'HAWKSCAN_TYPE_SCAN' | 'HAWKSCAN_TYPE_FLIGHTPATH' | 'HAWKSCAN_TYPE_HOSTED' | 'HAWKSCAN_TYPE_CONFIGURATION' — The type of HawkScan execution (traditional, hosted, etc.)
      - `id` string — the UUID identifier of this scan
      - `metadata` ScanresultsMetaData
        - `tags` object
      - `parentScanId` string — If this scan is a result of a retest, this is the id of the scan it retested
      - `repoId` string — a hash of the scanned repo git name
      - `status` 'UNKNOWN' | 'COMPLETED' | 'ERROR' | 'STARTED' — the current state of the running scan (STARTED / COMPLETED / ERROR)
      - `timestamp` integer — seconds since unix epoch timestamp of when the scan was started
      - `version` string — the version of HawkScan used to scan this application
    - `scanDuration` integer — Time in seconds the scan took to run.
    - `scanErrors` ScanresultsErrorScan[] — Errors encountered from this run of HawkScan.
      - `category` string — category of error identified in the scan
      - `created` integer — seconds since unix epoch of when the errorScan was found
      - `error` string — a short message of the exception that occurred running HawkScan
      - `errorDetail` string — expanded details and stacktrace surrounding the thrown exception in HawkScan
      - `rawConf` string — the raw HawkScan configuration string, employed when this error occurred
    - `scanProgress` ScanresultsScanProgress — Scan progress instance object.
      - `globalStats` object
      - `plugins` ScanresultsPluginProgress[]
        - `alertCount` integer
        - `durationMillis` integer
        - `messageCount` integer
        - `numberRequests` integer
        - `pluginId` string
        - `pluginName` string
        - `progress` integer
        - `skippedReason` string
        - `status` 'UNKNOWN' | 'PENDING' | 'RUNNING' | 'COMPLETED' | 'SKIPPED'
      - `scanId` string
      - `siteStats` object
    - `severityStats` object — Recordings of scan counts made by severity and statistic.
    - `tags` HawkscanTag[] — Any tags associated with this scan result.
      - `name` string — The keyword name.
      - `value` string — An arbitrary value to associate with the keyword.
    - `timestamp` integer — Seconds since unix epoch time of when this was run.
    - `urlCount` integer — The number of urls scanned.
  - `nextPageToken` string — pageToken to provide for the next page of results.
  - `totalCount` integer — total number of results.

## Other responses

- `401` — Unauthorized

---

[API](https://skmtc.net/stackhawk/apis/stackhawk-public-api.md) · [All operations](https://skmtc.net/stackhawk/apis/stackhawk-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stackhawk/stackhawk-public-api/versions/ad3dfd54cb63/schema)