> ## Documentation Index > Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt > Use this file to discover all available pages before exploring further. # Get Skill Scan Report > Returns only the report document for a completed scan — the same object as the `report` field of Get Skill Scan, without the surrounding record. Use this when you already have the metadata and want just the findings. The shape is the scanner's own report document and is not guaranteed stable field-for-field; treat it as a document to render or archive rather than a fixed schema. Readable by any member of the organization that ran the scan; a scan belonging to a different organization is `403` with `reason: "owner_mismatch"`. ## OpenAPI ````yaml GET /skill-hub/scans/{scan_id}/report openapi: 3.0.0 info: title: Enkrypt AI APIs version: 2.0.0 servers: - url: https://api.enkryptai.com security: - apiKeyAuth: [] tags: - name: Guardrails - name: Code of Conduct - name: Endpoints - name: Redteam description: >- Red Team API: submit red-team / threat-modeling / playground / eval runs, then poll run status, records, results and compliance. Also two-phase threat modeling (categories + data), dataset retrieval, model health, findings and risk mitigation. The previous task-based Red Team API is under **Archived**. - name: Deployments - name: AI Proxy - name: Leaderboard - name: Archived - name: MCP Hub description: >- MCP Hub vulnerability scanning APIs. Submitting scans (the POST endpoints) is open to all authenticated callers. The scan **retrieval** APIs — Get Scan Job Status, Get Complete Scan Results, List Scans, and Get MCP Hub Scan Statistics (the GET endpoints) — are an **enterprise data-license feature**: they require your organization to have MCP Hub API access enabled by Enkrypt, otherwise they return `403`. Contact us at support@enkryptai.com to enable access. - name: MCP Registry Servers - name: MCP Gateways - name: MCP Playground - name: Skill Scanner description: >- Skill Scanner APIs: submit an agent skill (a directory inside a git repository) for security scanning, then read the verdict, the risk level and the full report. Scanning is asynchronous — a scan takes roughly 30–90 seconds, so `POST /skill-hub/scan` returns a `scan_id` you poll. You see your organization's scans and nobody else's. The identity comes from your API key, never from your request — sending `user_email` is a `400`. For an organization or project API key, scans are filed under the **organization**, so every member sees every scan the organization has run, whichever project or member submitted it. For an individual account it is simply your own scans. Either way List Skill Scans needs no parameter to say who you are. paths: /skill-hub/scans/{scan_id}/report: get: tags: - Skill Scanner summary: Get Skill Scan Report description: >- Returns only the report document for a completed scan — the same object as the `report` field of Get Skill Scan, without the surrounding record. Use this when you already have the metadata and want just the findings. The shape is the scanner's own report document and is not guaranteed stable field-for-field; treat it as a document to render or archive rather than a fixed schema. Readable by any member of the organization that ran the scan; a scan belonging to a different organization is `403` with `reason: "owner_mismatch"`. operationId: skill_scanner_get_scan_report parameters: - name: scan_id in: path required: true schema: type: string description: The `scan_id` returned by Submit a Skill Scan. responses: '200': description: The report JSON content: application/json: schema: type: object additionalProperties: true description: The scanner's report document. Free-form by design. '401': $ref: '#/components/responses/SkillScannerUnauthorized' '403': $ref: '#/components/responses/SkillScannerForbidden' '404': $ref: '#/components/responses/SkillScannerNotFound' '422': $ref: '#/components/responses/SkillScannerValidationError' components: responses: SkillScannerUnauthorized: description: Unauthorized — missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/SkillScannerErrorResponse' SkillScannerForbidden: description: >- Forbidden — the scan belongs to a different organization than your API key resolves to. content: application/json: schema: $ref: '#/components/schemas/SkillScannerForbiddenOwnershipResponse' SkillScannerNotFound: description: Not Found — no scan with that `scan_id` content: application/json: schema: $ref: '#/components/schemas/SkillScannerErrorResponse' SkillScannerValidationError: description: >- Validation Error — raised by the scanner itself and passed through, so the body is the FastAPI `detail` envelope rather than the gateway error envelope the 400/401/403 responses use. A missing or malformed field the gateway owns cannot reach this: `user_email` is always supplied by the gateway, and a client-supplied one is a `400` before the request is forwarded. content: application/json: schema: $ref: '#/components/schemas/SkillScannerUpstreamValidationError' schemas: SkillScannerErrorResponse: title: SkillScannerErrorResponse type: object description: Error envelope returned by the Skill Scanner gateway. properties: code: type: integer example: 403 error: type: string example: Forbidden message: type: string example: >- Skill Scanner APIs are an enterprise feature not enabled for your organization. Contact us at support@enkryptai.com for access. request_id: type: string time: type: number SkillScannerForbiddenOwnershipResponse: title: SkillScannerForbiddenOwnershipResponse type: object description: >- Returned when the scan exists but belongs to a different account than your API key resolves to. The body echoes only your own identity — never anything about the scan or its owner. properties: error: type: string example: Forbidden reason: type: string enum: - owner_mismatch - owner_unknown description: >- `owner_mismatch`: the scan belongs to another account. `owner_unknown`: the scan has no recorded owner, so it cannot be read through the API. message: type: string example: >- This scan belongs to a different account than the authenticated consumer consumer: type: object description: The identity your API key resolved to. properties: org_id: type: string user_id: type: string user_email: type: string SkillScannerUpstreamValidationError: title: SkillScannerUpstreamValidationError type: object description: >- FastAPI validation-error envelope from the scanner, passed through by the gateway. properties: detail: type: array items: type: object properties: type: type: string example: value_error loc: type: array items: type: string example: - body - git_url msg: type: string example: Value error, git_url must be a full http(s) clone URL securitySchemes: apiKeyAuth: type: apiKey in: header name: apikey ````