> ## Documentation Index > Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt > Use this file to discover all available pages before exploring further. # Get Skill Scan > Returns one scan: its status, the inputs, and — once `status` is `succeeded` — the verdict, risk level, findings count, token usage and the full `report`. Poll this after Submit a Skill Scan. `status` is `queued` or `running` while the worker is busy and settles on `succeeded` or `failed`; on `failed`, `error` says why. A failed scan is a normal `200` response, not an error. Readable by any member of the organization that ran the scan, across all projects; a scan belonging to a different organization is `403` with `reason: "owner_mismatch"`. ## OpenAPI ````yaml GET /skill-hub/scans/{scan_id} openapi: 3.0.0 info: title: Enkrypt AI APIs version: 2.0.0 servers: - url: https://api.enkryptai.com security: - apiKeyAuth: [] tags: - name: Guardrails - name: Code of Conduct - name: Endpoints - name: Redteam description: >- Red Team API: submit red-team / threat-modeling / playground / eval runs, then poll run status, records, results and compliance. Also two-phase threat modeling (categories + data), dataset retrieval, model health, findings and risk mitigation. The previous task-based Red Team API is under **Archived**. - name: Deployments - name: AI Proxy - name: Leaderboard - name: Archived - name: MCP Hub description: >- MCP Hub vulnerability scanning APIs. Submitting scans (the POST endpoints) is open to all authenticated callers. The scan **retrieval** APIs — Get Scan Job Status, Get Complete Scan Results, List Scans, and Get MCP Hub Scan Statistics (the GET endpoints) — are an **enterprise data-license feature**: they require your organization to have MCP Hub API access enabled by Enkrypt, otherwise they return `403`. Contact us at support@enkryptai.com to enable access. - name: MCP Registry Servers - name: MCP Gateways - name: MCP Playground - name: Skill Scanner description: >- Skill Scanner APIs: submit an agent skill (a directory inside a git repository) for security scanning, then read the verdict, the risk level and the full report. Scanning is asynchronous — a scan takes roughly 30–90 seconds, so `POST /skill-hub/scan` returns a `scan_id` you poll. You see your organization's scans and nobody else's. The identity comes from your API key, never from your request — sending `user_email` is a `400`. For an organization or project API key, scans are filed under the **organization**, so every member sees every scan the organization has run, whichever project or member submitted it. For an individual account it is simply your own scans. Either way List Skill Scans needs no parameter to say who you are. paths: /skill-hub/scans/{scan_id}: get: tags: - Skill Scanner summary: Get Skill Scan description: >- Returns one scan: its status, the inputs, and — once `status` is `succeeded` — the verdict, risk level, findings count, token usage and the full `report`. Poll this after Submit a Skill Scan. `status` is `queued` or `running` while the worker is busy and settles on `succeeded` or `failed`; on `failed`, `error` says why. A failed scan is a normal `200` response, not an error. Readable by any member of the organization that ran the scan, across all projects; a scan belonging to a different organization is `403` with `reason: "owner_mismatch"`. operationId: skill_scanner_get_scan parameters: - name: scan_id in: path required: true schema: type: string description: The `scan_id` returned by Submit a Skill Scan. responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/SkillScannerScanRecord' examples: succeeded: summary: Completed scan value: scan_id: 123e4567-e89b-12d3-a456-426614174000 status: succeeded user_email: user@example.com repo: affaan-m/ECC git_url: https://github.com/affaan-m/ECC.git skill_path: .agents/skills/api-design skill_name: api-design commit: 2bc924aa11bb22cc33dd44ee55ff6677889900aa model: gpt-5.4-mini stars: 128 content_hash: 9f2b1c... verdict: SAFE risk_level: SAFE findings_count: 0 scan_duration_seconds: 42.5 token_usage: prompt_tokens: 18422 completion_tokens: 1204 report: {} created_at: '2026-08-24T10:00:00Z' started_at: '2026-08-24T10:00:03Z' finished_at: '2026-08-24T10:00:46Z' failed: summary: Failed scan — still a 200 value: scan_id: 123e4567-e89b-12d3-a456-426614174000 status: failed error: git clone timed out after 120s attempts: 2 '401': $ref: '#/components/responses/SkillScannerUnauthorized' '403': $ref: '#/components/responses/SkillScannerForbidden' '404': $ref: '#/components/responses/SkillScannerNotFound' '422': $ref: '#/components/responses/SkillScannerValidationError' components: schemas: SkillScannerScanRecord: title: SkillScannerScanRecord type: object required: - scan_id - status description: >- One scan job/result. Fields are omitted rather than nulled, so most of them appear only once `status` is `succeeded`. Note `error` belongs to the RECORD — it is set when the scan itself failed, and the HTTP response is still `200`. properties: scan_id: type: string status: type: string enum: - queued - running - succeeded - failed description: >- `queued`/`running` mean the worker is still going; `succeeded`/`failed` are terminal. cached: type: boolean default: false description: >- `true` when this record copied an existing successful scan of an identical pinned input instead of re-scanning. user_email: type: string description: >- The user the scan is attributed to, lower-cased. Set by the gateway from the submitting API key. repo: type: string description: '`owner/name`, derived from `git_url` for github.com URLs.' git_url: type: string skill_path: type: string skill_name: type: string description: The skill's own declared name, read out of the skill. commit: type: string ref: type: string model: type: string description: The model the scan actually ran on. stars: type: integer description: The repository's GitHub star count, fetched live at scan time. content_hash: type: string description: Hash of the scanned skill content. source_content_hash: type: string verdict: type: string description: >- The scanner's overall verdict for the skill, passed through from the report's `overall_risk_assessment.skill_verdict`. UPPERCASE, e.g. `SAFE` or `SUSPICIOUS`. Deliberately not typed as an enum here: the vocabulary belongs to the analysis engine, so treat it as an opaque string and compare case-sensitively. example: SAFE risk_level: type: string description: >- Severity band for the findings, passed through from the report. UPPERCASE, e.g. `SAFE`, `MEDIUM` or `HIGH`. Same caveat as `verdict` — an opaque, engine-defined string. example: SAFE findings_count: type: integer scan_duration_seconds: type: number token_usage: type: object additionalProperties: true description: Token accounting for the scan. report: type: object additionalProperties: true description: >- The full report document. Also available on its own from Get Skill Scan Report. error: type: string description: Why the scan failed. Present only when `status` is `failed`. attempts: type: integer description: How many times the worker has attempted this scan. created_at: type: string started_at: type: string finished_at: type: string SkillScannerErrorResponse: title: SkillScannerErrorResponse type: object description: Error envelope returned by the Skill Scanner gateway. properties: code: type: integer example: 403 error: type: string example: Forbidden message: type: string example: >- Skill Scanner APIs are an enterprise feature not enabled for your organization. Contact us at support@enkryptai.com for access. request_id: type: string time: type: number SkillScannerForbiddenOwnershipResponse: title: SkillScannerForbiddenOwnershipResponse type: object description: >- Returned when the scan exists but belongs to a different account than your API key resolves to. The body echoes only your own identity — never anything about the scan or its owner. properties: error: type: string example: Forbidden reason: type: string enum: - owner_mismatch - owner_unknown description: >- `owner_mismatch`: the scan belongs to another account. `owner_unknown`: the scan has no recorded owner, so it cannot be read through the API. message: type: string example: >- This scan belongs to a different account than the authenticated consumer consumer: type: object description: The identity your API key resolved to. properties: org_id: type: string user_id: type: string user_email: type: string SkillScannerUpstreamValidationError: title: SkillScannerUpstreamValidationError type: object description: >- FastAPI validation-error envelope from the scanner, passed through by the gateway. properties: detail: type: array items: type: object properties: type: type: string example: value_error loc: type: array items: type: string example: - body - git_url msg: type: string example: Value error, git_url must be a full http(s) clone URL responses: SkillScannerUnauthorized: description: Unauthorized — missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/SkillScannerErrorResponse' SkillScannerForbidden: description: >- Forbidden — the scan belongs to a different organization than your API key resolves to. content: application/json: schema: $ref: '#/components/schemas/SkillScannerForbiddenOwnershipResponse' SkillScannerNotFound: description: Not Found — no scan with that `scan_id` content: application/json: schema: $ref: '#/components/schemas/SkillScannerErrorResponse' SkillScannerValidationError: description: >- Validation Error — raised by the scanner itself and passed through, so the body is the FastAPI `detail` envelope rather than the gateway error envelope the 400/401/403 responses use. A missing or malformed field the gateway owns cannot reach this: `user_email` is always supplied by the gateway, and a client-supplied one is a `400` before the request is forwarded. content: application/json: schema: $ref: '#/components/schemas/SkillScannerUpstreamValidationError' securitySchemes: apiKeyAuth: type: apiKey in: header name: apikey ````