> ## Documentation Index
> Fetch the complete documentation index at: https://docs.antigen.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# List reports

> Returns reports written for your organization. A report captures an engagement at the time it was written. Its vulnerability and evidence metadata remain unchanged as the live vulnerabilities progress. A referenced run or vulnerability outside your organization returns 404.



## OpenAPI

````yaml /reference/openapi.yaml get /reports
openapi: 3.1.0
info:
  title: Antigen API
  version: v1
  description: >-
    Work with the same agents, runs, and resources your team uses in Antigen.
    Requests and responses use camelCase fields. List endpoints return arrays.
    See the [overview](/reference) for authentication, updates, and errors.
servers:
  - url: https://api.antigen.sh/v1
security:
  - ApiKeyAuth: []
tags:
  - name: Agents
    description: Retrieve, compose, and register agent configurations.
  - name: Models
    description: Models available to agents in your organization.
  - name: Targets
    description: Submit testing scope for human approval.
  - name: Runs
    description: Execute agents and control their work.
  - name: Vulnerabilities
    description: Track weaknesses, remediation, status, and assignment.
  - name: Evidence
    description: Read supporting file metadata and retrieve file contents.
  - name: Reports
    description: Read and export captured engagement results.
  - name: Human tasks
    description: Ask people for help and follow their responses.
  - name: Hooks
    description: Connect status and assignment changes to your own service.
  - name: Asset Map
    description: Read your organization’s infrastructure graph.
  - name: Integrations
    description: Inspect and disconnect provider connections.
  - name: API keys
    description: Create and revoke credentials for automation.
paths:
  /reports:
    get:
      tags:
        - Reports
      summary: List reports
      description: >-
        Returns reports written for your organization. A report captures an
        engagement at the time it was written. Its vulnerability and evidence
        metadata remain unchanged as the live vulnerabilities progress. A
        referenced run or vulnerability outside your organization returns 404.
      operationId: listReports
      parameters:
        - name: runId
          in: query
          required: false
          description: Include reports covering this run.
          schema:
            type: string
            minLength: 1
      responses:
        '200':
          description: Successful response.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Report'
              example:
                - id: report_123
                  title: Production API assessment
                  summary: Testing identified a cross-account authorization weakness.
                  scope: api.example.com
                  methodology: Authenticated testing of invoice ownership checks.
                  runIds:
                    - run_123
                  vulnerabilities:
                    - vulnerability:
                        id: vuln_123
                        title: Cross-account invoice access
                        description: >-
                          An authenticated account can retrieve another
                          account’s invoice by changing its ID.
                        severity: high
                        target: api.example.com
                        runId: run_123
                        remediation: >-
                          Check that the authenticated account owns the invoice
                          before returning it.
                        status: open
                        assignee: null
                        riskAcceptance: null
                        createdAt: '2026-09-13T10:00:00.000Z'
                        updatedAt: '2026-09-13T10:00:00.000Z'
                      evidence:
                        - id: ev_123
                          vulnerabilityId: vuln_123
                          runId: run_123
                          filename: reproduction.py
                          sizeBytes: 2048
                          contentType: text/x-python
                          createdAt: '2026-09-13T10:00:00.000Z'
                  createdAt: '2026-09-13T10:00:00.000Z'
        '400':
          $ref: '#/components/responses/Error400'
        '401':
          $ref: '#/components/responses/Error401'
        '403':
          $ref: '#/components/responses/Error403'
        '404':
          $ref: '#/components/responses/Error404'
        '429':
          $ref: '#/components/responses/Error429'
components:
  schemas:
    Report:
      type: object
      properties:
        id:
          type: string
          minLength: 1
        title:
          type: string
        summary:
          type: string
        scope:
          type: string
        methodology:
          type: string
        runIds:
          type: array
          items:
            type: string
            minLength: 1
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/ReportVulnerability'
          description: >-
            Vulnerability and evidence metadata captured when the report was
            written. Later updates do not change these values.
        createdAt:
          type: string
          format: date-time
      required:
        - id
        - title
        - summary
        - scope
        - methodology
        - runIds
        - vulnerabilities
        - createdAt
      additionalProperties: false
      example:
        id: report_123
        title: Production API assessment
        summary: Testing identified a cross-account authorization weakness.
        scope: api.example.com
        methodology: Authenticated testing of invoice ownership checks.
        runIds:
          - run_123
        vulnerabilities:
          - vulnerability:
              id: vuln_123
              title: Cross-account invoice access
              description: >-
                An authenticated account can retrieve another account’s invoice
                by changing its ID.
              severity: high
              target: api.example.com
              runId: run_123
              remediation: >-
                Check that the authenticated account owns the invoice before
                returning it.
              status: open
              assignee: null
              riskAcceptance: null
              createdAt: '2026-09-13T10:00:00.000Z'
              updatedAt: '2026-09-13T10:00:00.000Z'
            evidence:
              - id: ev_123
                vulnerabilityId: vuln_123
                runId: run_123
                filename: reproduction.py
                sizeBytes: 2048
                contentType: text/x-python
                createdAt: '2026-09-13T10:00:00.000Z'
        createdAt: '2026-09-13T10:00:00.000Z'
    ReportVulnerability:
      type: object
      properties:
        vulnerability:
          $ref: '#/components/schemas/Vulnerability'
        evidence:
          type: array
          items:
            $ref: '#/components/schemas/Evidence'
      required:
        - vulnerability
        - evidence
      additionalProperties: false
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Stable error code.
            message:
              type: string
              description: Description of the problem.
          required:
            - code
            - message
          additionalProperties: false
      required:
        - error
      additionalProperties: false
      example:
        error:
          code: invalid_request
          message: The target value is required.
    Vulnerability:
      type: object
      properties:
        id:
          type: string
          minLength: 1
        title:
          type: string
          description: Short description of the weakness.
          minLength: 1
        description:
          type: string
          description: Affected behavior, reproduction steps, and impact.
          minLength: 1
        severity:
          type: string
          enum:
            - critical
            - high
            - medium
            - low
        remediation:
          type: string
          description: >-
            Proposed remediation steps. May include links to pull requests or
            infrastructure recommendations.
        target:
          type: string
        runId:
          type:
            - string
            - 'null'
          description: Run that originally discovered the vulnerability, if any.
        status:
          type: string
          enum:
            - open
            - in_progress
            - remediated
            - verified
            - accepted_risk
        assignee:
          type:
            - string
            - 'null'
          description: Team member email or registered agent name. Null means unassigned.
        riskAcceptance:
          oneOf:
            - $ref: '#/components/schemas/RiskAcceptance'
            - type: 'null'
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
      required:
        - id
        - title
        - description
        - severity
        - remediation
        - target
        - runId
        - status
        - assignee
        - riskAcceptance
        - createdAt
        - updatedAt
      additionalProperties: false
      example:
        id: vuln_123
        title: Cross-account invoice access
        description: >-
          An authenticated account can retrieve another account’s invoice by
          changing its ID.
        severity: high
        target: api.example.com
        runId: run_123
        remediation: >-
          Check that the authenticated account owns the invoice before returning
          it.
        status: open
        assignee: null
        riskAcceptance: null
        createdAt: '2026-09-13T10:00:00.000Z'
        updatedAt: '2026-09-13T10:00:00.000Z'
    Evidence:
      type: object
      properties:
        id:
          type: string
          minLength: 1
        vulnerabilityId:
          type: string
          minLength: 1
        runId:
          type:
            - string
            - 'null'
          description: Run that produced the file, if any.
        filename:
          type: string
        sizeBytes:
          type: integer
          minimum: 0
        contentType:
          type: string
          description: Media type of the evidence file.
        createdAt:
          type: string
          format: date-time
      required:
        - id
        - vulnerabilityId
        - runId
        - filename
        - sizeBytes
        - contentType
        - createdAt
      additionalProperties: false
      example:
        id: ev_123
        vulnerabilityId: vuln_123
        runId: run_123
        filename: reproduction.py
        sizeBytes: 2048
        contentType: text/x-python
        createdAt: '2026-09-13T10:00:00.000Z'
    RiskAcceptance:
      type: object
      properties:
        note:
          type: string
          description: Reason for accepting the risk.
          minLength: 1
        expiresAt:
          type: string
          format: date-time
          description: Time when acceptance expires. Must be in the future when submitted.
      required:
        - note
        - expiresAt
      additionalProperties: false
  responses:
    Error400:
      description: Invalid request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: invalid_request
              message: Check the request fields and values.
    Error401:
      description: Authentication required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: unauthorized
              message: Supply a valid API key.
    Error403:
      description: Permission denied
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: forbidden
              message: The API key does not permit this operation or requested scope.
    Error404:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: not_found
              message: The resource does not exist in this organization.
    Error429:
      description: Too many requests
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: rate_limited
              message: Retry after the interval in Retry-After.
      headers:
        Retry-After:
          description: Seconds to wait before retrying.
          schema:
            type: integer
            minimum: 1
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: >-
        API key from your organization. Supply the value directly, without a
        Bearer prefix.

````