Skip to main content
GET
List Code Scans

Permissions

Requires a service user or personal access token with the ViewCodeScans permission at the organization level.

Behavior

Returns the organization’s code scans, newest first. Use it to poll the status of a scan started with Start Code Scan: waiting → pending → running → completed (or failed / cancelled). awaiting_user_input applies only to interactive scans: a security scan started with interactive: true (or interactively from the web app) pauses in that status for user review between threat modeling and investigation. To list scans across every organization in an enterprise, use List Code Scans (Enterprise).

Filters

  • time_after / time_before: Unix timestamps in seconds (UTC) bounding the scan creation time.
  • repo_name: only scans that scanned this repository. Matches multi-repo scans that include it.
Results are paginated with an opaque cursor (after / first).

Authorizations

Authorization
string
header
required

Service User credential (prefix: cog_)

Path Parameters

org_id
string
required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Query Parameters

time_before
integer | null
time_after
integer | null
after
string | null
first
integer
default:100
Required range: 1 <= x <= 200
repo_name
string | null

Filter to scans that scanned this repository. Matches multi-repo scans even when the repository is not the scan's primary repo, so returned items may report a different repo_name.

Response

Successful Response

items
CodeScanResponse · object[]
required
end_cursor
string | null

Cursor to fetch the next page, or None if this is the last page.

has_next_page
boolean
default:false

Whether there are more items available after this page.

total
integer | null

Optional total count (can be omitted for performance).