Get Skill Scan

curl --request GET \
  --url https://api.enkryptai.com/skill-hub/scans/{scan_id} \
  --header 'apikey: <api-key>'

const options = {method: 'GET', headers: {apikey: '<api-key>'}};

fetch('https://api.enkryptai.com/skill-hub/scans/{scan_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.enkryptai.com/skill-hub/scans/{scan_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "apikey: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.enkryptai.com/skill-hub/scans/{scan_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("apikey", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.enkryptai.com/skill-hub/scans/{scan_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["apikey"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "scan_id": "123e4567-e89b-12d3-a456-426614174000",
  "status": "succeeded",
  "user_email": "user@example.com",
  "repo": "affaan-m/ECC",
  "git_url": "https://github.com/affaan-m/ECC.git",
  "skill_path": ".agents/skills/api-design",
  "skill_name": "api-design",
  "commit": "2bc924aa11bb22cc33dd44ee55ff6677889900aa",
  "model": "gpt-5.4-mini",
  "stars": 128,
  "content_hash": "9f2b1c...",
  "verdict": "SAFE",
  "risk_level": "SAFE",
  "findings_count": 0,
  "scan_duration_seconds": 42.5,
  "token_usage": {
    "prompt_tokens": 18422,
    "completion_tokens": 1204
  },
  "report": {},
  "created_at": "2026-08-24T10:00:00Z",
  "started_at": "2026-08-24T10:00:03Z",
  "finished_at": "2026-08-24T10:00:46Z"
}

📜 Skill Scanner API

Get Skill Scan

Returns one scan: its status, the inputs, and — once status is succeeded — the verdict, risk level, findings count, token usage and the full report.

Poll this after Submit a Skill Scan. status is queued or running while the worker is busy and settles on succeeded or failed; on failed, error says why. A failed scan is a normal 200 response, not an error.

Readable by any member of the organization that ran the scan, across all projects; a scan belonging to a different organization is 403 with reason: "owner_mismatch".

GET

skill-hub

scans

{scan_id}

Get Skill Scan

curl --request GET \
  --url https://api.enkryptai.com/skill-hub/scans/{scan_id} \
  --header 'apikey: <api-key>'

const options = {method: 'GET', headers: {apikey: '<api-key>'}};

fetch('https://api.enkryptai.com/skill-hub/scans/{scan_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.enkryptai.com/skill-hub/scans/{scan_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "apikey: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.enkryptai.com/skill-hub/scans/{scan_id}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("apikey", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.enkryptai.com/skill-hub/scans/{scan_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["apikey"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "scan_id": "123e4567-e89b-12d3-a456-426614174000",
  "status": "succeeded",
  "user_email": "user@example.com",
  "repo": "affaan-m/ECC",
  "git_url": "https://github.com/affaan-m/ECC.git",
  "skill_path": ".agents/skills/api-design",
  "skill_name": "api-design",
  "commit": "2bc924aa11bb22cc33dd44ee55ff6677889900aa",
  "model": "gpt-5.4-mini",
  "stars": 128,
  "content_hash": "9f2b1c...",
  "verdict": "SAFE",
  "risk_level": "SAFE",
  "findings_count": 0,
  "scan_duration_seconds": 42.5,
  "token_usage": {
    "prompt_tokens": 18422,
    "completion_tokens": 1204
  },
  "report": {},
  "created_at": "2026-08-24T10:00:00Z",
  "started_at": "2026-08-24T10:00:03Z",
  "finished_at": "2026-08-24T10:00:46Z"
}

Authorizations

apikey

string

header

required

Path Parameters

scan_id

string

required

The scan_id returned by Submit a Skill Scan.

Response

Successful Response

One scan job/result. Fields are omitted rather than nulled, so most of them appear only once status is succeeded. Note error belongs to the RECORD — it is set when the scan itself failed, and the HTTP response is still 200.

scan_id

string

required

status

enum<string>

required

queued/running mean the worker is still going; succeeded/failed are terminal.

Available options:

queued,

running,

succeeded,

failed

cached

boolean

default:false

true when this record copied an existing successful scan of an identical pinned input instead of re-scanning.

user_email

string

The user the scan is attributed to, lower-cased. Set by the gateway from the submitting API key.

repo

string

owner/name, derived from git_url for github.com URLs.

git_url

string

skill_path

string

skill_name

string

The skill's own declared name, read out of the skill.

commit

string

ref

string

model

string

The model the scan actually ran on.

stars

integer

The repository's GitHub star count, fetched live at scan time.

content_hash

string

Hash of the scanned skill content.

source_content_hash

string

verdict

string

The scanner's overall verdict for the skill, passed through from the report's overall_risk_assessment.skill_verdict. UPPERCASE, e.g. SAFE or SUSPICIOUS. Deliberately not typed as an enum here: the vocabulary belongs to the analysis engine, so treat it as an opaque string and compare case-sensitively.

Example:

"SAFE"

risk_level

string

Severity band for the findings, passed through from the report. UPPERCASE, e.g. SAFE, MEDIUM or HIGH. Same caveat as verdict — an opaque, engine-defined string.

Example:

"SAFE"

findings_count

integer

scan_duration_seconds

number

token_usage

object

Token accounting for the scan.

report

object

The full report document. Also available on its own from Get Skill Scan Report.

error

string

Why the scan failed. Present only when status is failed.

attempts

integer

How many times the worker has attempted this scan.

created_at

string

started_at

string

finished_at

string

⌘I