> ## Documentation Index > Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt > Use this file to discover all available pages before exploring further. # List Skill Scans > Lists your skill scans as summaries, without the full reports. Page with `limit` / `offset`. The listing is always scoped to the user behind your API key. There is no `user_email` parameter — the gateway sets it, and sending one returns `400`. Scoped to your organization: every scan any member of it has run, across all projects. (An individual account sees its own.) There is no `user_email` parameter — the gateway applies the scope, and sending one is a `400`. ## OpenAPI ````yaml GET /skill-hub/scans openapi: 3.0.0 info: title: Enkrypt AI APIs version: 2.0.0 servers: - url: https://api.enkryptai.com security: - apiKeyAuth: [] tags: - name: Guardrails - name: Code of Conduct - name: Endpoints - name: Redteam description: >- Red Team API: submit red-team / threat-modeling / playground / eval runs, then poll run status, records, results and compliance. Also two-phase threat modeling (categories + data), dataset retrieval, model health, findings and risk mitigation. The previous task-based Red Team API is under **Archived**. - name: Deployments - name: AI Proxy - name: Leaderboard - name: Archived - name: MCP Hub description: >- MCP Hub vulnerability scanning APIs. Submitting scans (the POST endpoints) is open to all authenticated callers. The scan **retrieval** APIs — Get Scan Job Status, Get Complete Scan Results, List Scans, and Get MCP Hub Scan Statistics (the GET endpoints) — are an **enterprise data-license feature**: they require your organization to have MCP Hub API access enabled by Enkrypt, otherwise they return `403`. Contact us at support@enkryptai.com to enable access. - name: MCP Registry Servers - name: MCP Gateways - name: MCP Playground - name: Skill Scanner description: >- Skill Scanner APIs: submit an agent skill (a directory inside a git repository) for security scanning, then read the verdict, the risk level and the full report. Scanning is asynchronous — a scan takes roughly 30–90 seconds, so `POST /skill-hub/scan` returns a `scan_id` you poll. You see your organization's scans and nobody else's. The identity comes from your API key, never from your request — sending `user_email` is a `400`. For an organization or project API key, scans are filed under the **organization**, so every member sees every scan the organization has run, whichever project or member submitted it. For an individual account it is simply your own scans. Either way List Skill Scans needs no parameter to say who you are. paths: /skill-hub/scans: get: tags: - Skill Scanner summary: List Skill Scans description: >- Lists your skill scans as summaries, without the full reports. Page with `limit` / `offset`. The listing is always scoped to the user behind your API key. There is no `user_email` parameter — the gateway sets it, and sending one returns `400`. Scoped to your organization: every scan any member of it has run, across all projects. (An individual account sees its own.) There is no `user_email` parameter — the gateway applies the scope, and sending one is a `400`. operationId: skill_scanner_list_scans parameters: - name: status in: query required: false schema: type: string enum: - queued - running - succeeded - failed description: Only return scans in this state. - name: repo in: query required: false schema: type: string description: >- Only return scans of this repository, as `owner/name` (derived server-side from `git_url` for github.com URLs). example: affaan-m/ECC - name: verdict in: query required: false schema: type: string description: >- Only return scans with this verdict. Matched exactly and case-sensitively against the stored UPPERCASE value, so `SAFE` matches and `safe` matches nothing. example: SAFE - name: limit in: query required: false schema: type: integer minimum: 1 maximum: 200 default: 50 description: Page size. - name: offset in: query required: false schema: type: integer minimum: 0 default: 0 description: Number of rows to skip. responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/SkillScannerScanListResponse' examples: page: summary: First page value: items: - scan_id: 123e4567-e89b-12d3-a456-426614174000 status: succeeded repo: affaan-m/ECC skill_name: api-design verdict: SAFE risk_level: SAFE findings_count: 0 stars: 128 created_at: '2026-08-24T10:00:00Z' total: 1 limit: 50 offset: 0 '400': $ref: '#/components/responses/SkillScannerBadRequest' '401': $ref: '#/components/responses/SkillScannerUnauthorized' '422': $ref: '#/components/responses/SkillScannerValidationError' components: schemas: SkillScannerScanListResponse: title: SkillScannerScanListResponse type: object required: - items - total - limit - offset description: >- Offset-paginated list of your scans. Items are summaries — the `report` is not included; fetch it per scan. properties: items: type: array items: $ref: '#/components/schemas/SkillScannerScanRecord' total: type: integer description: Total rows matching the filters. limit: type: integer description: The page size used. offset: type: integer description: The offset used. SkillScannerScanRecord: title: SkillScannerScanRecord type: object required: - scan_id - status description: >- One scan job/result. Fields are omitted rather than nulled, so most of them appear only once `status` is `succeeded`. Note `error` belongs to the RECORD — it is set when the scan itself failed, and the HTTP response is still `200`. properties: scan_id: type: string status: type: string enum: - queued - running - succeeded - failed description: >- `queued`/`running` mean the worker is still going; `succeeded`/`failed` are terminal. cached: type: boolean default: false description: >- `true` when this record copied an existing successful scan of an identical pinned input instead of re-scanning. user_email: type: string description: >- The user the scan is attributed to, lower-cased. Set by the gateway from the submitting API key. repo: type: string description: '`owner/name`, derived from `git_url` for github.com URLs.' git_url: type: string skill_path: type: string skill_name: type: string description: The skill's own declared name, read out of the skill. commit: type: string ref: type: string model: type: string description: The model the scan actually ran on. stars: type: integer description: The repository's GitHub star count, fetched live at scan time. content_hash: type: string description: Hash of the scanned skill content. source_content_hash: type: string verdict: type: string description: >- The scanner's overall verdict for the skill, passed through from the report's `overall_risk_assessment.skill_verdict`. UPPERCASE, e.g. `SAFE` or `SUSPICIOUS`. Deliberately not typed as an enum here: the vocabulary belongs to the analysis engine, so treat it as an opaque string and compare case-sensitively. example: SAFE risk_level: type: string description: >- Severity band for the findings, passed through from the report. UPPERCASE, e.g. `SAFE`, `MEDIUM` or `HIGH`. Same caveat as `verdict` — an opaque, engine-defined string. example: SAFE findings_count: type: integer scan_duration_seconds: type: number token_usage: type: object additionalProperties: true description: Token accounting for the scan. report: type: object additionalProperties: true description: >- The full report document. Also available on its own from Get Skill Scan Report. error: type: string description: Why the scan failed. Present only when `status` is `failed`. attempts: type: integer description: How many times the worker has attempted this scan. created_at: type: string started_at: type: string finished_at: type: string SkillScannerErrorResponse: title: SkillScannerErrorResponse type: object description: Error envelope returned by the Skill Scanner gateway. properties: code: type: integer example: 403 error: type: string example: Forbidden message: type: string example: >- Skill Scanner APIs are an enterprise feature not enabled for your organization. Contact us at support@enkryptai.com for access. request_id: type: string time: type: number SkillScannerUpstreamValidationError: title: SkillScannerUpstreamValidationError type: object description: >- FastAPI validation-error envelope from the scanner, passed through by the gateway. properties: detail: type: array items: type: object properties: type: type: string example: value_error loc: type: array items: type: string example: - body - git_url msg: type: string example: Value error, git_url must be a full http(s) clone URL responses: SkillScannerBadRequest: description: >- Bad Request — most often a gateway-owned field was supplied (`user_email`, `user_id`, `org_id`, `project_name`) or an unexposed scanner field was (`model`, `source_content_hash`). content: application/json: schema: $ref: '#/components/schemas/SkillScannerErrorResponse' SkillScannerUnauthorized: description: Unauthorized — missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/SkillScannerErrorResponse' SkillScannerValidationError: description: >- Validation Error — raised by the scanner itself and passed through, so the body is the FastAPI `detail` envelope rather than the gateway error envelope the 400/401/403 responses use. A missing or malformed field the gateway owns cannot reach this: `user_email` is always supplied by the gateway, and a client-supplied one is a `400` before the request is forwarded. content: application/json: schema: $ref: '#/components/schemas/SkillScannerUpstreamValidationError' securitySchemes: apiKeyAuth: type: apiKey in: header name: apikey ````