One analysis job by id.

GET

/api/v1/analysis/jobs/{id}

curl --request GET \
  --url https://example.com/api/v1/analysis/jobs/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Authorization: Bearer <token>'

Authorizations

• bearer

Parameters

Path Parameters

id

required

string format: uuid

Analysis job id

Responses

200

The job row, including its state and progress

Media typeapplication/json

A job row, as served to the API / SSE. Timestamps are epoch-millis so the WebUI formats relative times without a date dependency.

object

created_ms

required

integer format: int64

error

string | null

finding_count

required

integer format: int32

finished_ms

integer | null format: int64

id

required

string format: uuid

params

required

pct

required

integer format: int32

phase

string | null

scope_id

string | null format: uuid

scope_kind

required

string

scope_label

required

string

started_ms

integer | null format: int64

state

required

Where an analysis run is in its lifecycle.

A bare String until v0.2.6, and the cost of that was paid twice. The vocabulary had to be written out by hand at the API edge to validate the runs filter, and again in the WebUI to fill its dropdown — two lists nothing compared. Worse, state: string compares equal to any string: the in-app “your analysis finished” notice tested state === 'succeeded', which is the report-run vocabulary, so every successful analysis announced itself as a failure. Typing it makes that comparison a compile error on both sides.

string

Allowed values: queued running done failed cancelled unknown

summary

string | null

tool

required

string

Example

{
  "state": "queued"
}

401

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Role lacks the read permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}

404

No such job — also the answer when this deployment has no runner

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object

error

required

object

code

required

Stable machine-readable code. Clients branch on this, never on the message.

string

message

required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string

Example^generated

{
  "error": {
    "code": "example",
    "message": "example"
  }
}