Get a monitored repository
GET
/v1/security/repositories/{repositoryId}Includes current immutable policy and threat-model versions plus recent runs, findings, and audit events.
How to call this endpoint
Every ACP API request uses bearer authentication. The examples here show the actual request path, auth header, and body shape that the platform expects.
Path, query, and header parameters
These parameters control which ACP object the endpoint acts on and how the request is processed.
Path parameters
| Name | Location | Type | Required | Description |
|---|---|---|---|---|
| repositoryId | path | string | Yes | Monitored security repository ID |
Query parameters
None.
Header parameters
| Name | Location | Type | Required | Description |
|---|---|---|---|---|
| X-Computer-Agents-Organization | header | string | No | Active organization context. If omitted, the authenticated user's personal organization is used. |
Body schema
This endpoint does not require a request body.
None.
What the API returns
Each response code below includes the documented payload shape for the ACP API.
200Repository security detailapplication/json
| Field | Type | Required | Description |
|---|---|---|---|
| repository | object | Yes | — |
| repository.ownershipInvitation | object | No | — |
| repository.ownershipInvitation.id | string | Yes | Unique identifier. |
| repository.ownershipInvitation.organizationId | string | Yes | — |
| repository.ownershipInvitation.kind | share | ownership | Yes | — |
| repository.ownershipInvitation.resourceType | string | Yes | — |
| repository.ownershipInvitation.resourceId | string | Yes | — |
| repository.ownershipInvitation.resourceName | string | Yes | — |
| repository.ownershipInvitation.recipientUserId | string | Yes | — |
| repository.ownershipInvitation.invitedByUserId | string | Yes | — |
| repository.ownershipInvitation.accessLevel | use | edit | manage | Yes | — |
| repository.ownershipInvitation.status | pending | accepted | declined | revoked | expired | Yes | Current lifecycle status. |
| repository.ownershipInvitation.expiresAt | string | Yes | — |
| repository.ownershipInvitation.decidedAt | string | Yes | — |
| repository.ownershipInvitation.createdAt | string | Yes | ISO 8601 timestamp. |
| repository.ownershipInvitation.updatedAt | string | Yes | ISO 8601 timestamp. |
| repository.id | string | Yes | Unique identifier. |
| repository.githubRepositoryId | string | Yes | — |
| repository.githubInstallationId | string | Yes | — |
| repository.githubNumericRepositoryId | string | No | — |
| repository.githubNumericInstallationId | string | No | — |
| repository.fullName | string | Yes | — |
| repository.defaultBranch | string | Yes | — |
| repository.private | boolean | Yes | — |
| repository.archived | boolean | Yes | — |
| repository.status | active | paused | disconnected | Yes | Current lifecycle status. |
| repository.currentPolicyVersionId | string | No | — |
| repository.currentThreatModelVersionId | string | No | — |
| repository.permissionSet | object | No | — |
| repository.lastRunId | string | No | — |
| repository.lastRunAt | string | No | — |
| repository.nextScanAt | string | No | — |
| repository.metadata | object | No | Free-form metadata object. |
| repository.findingCounts | object | Yes | — |
| repository.findingCounts.open | integer | Yes | — |
| repository.findingCounts.critical | integer | Yes | — |
| repository.findingCounts.high | integer | Yes | — |
| repository.lastRunStatus | queued | running | waiting_approval | succeeded | partial | failed | cancelled | No | — |
| repository.lastRunStage | ingest | checkout | inventory | scan | validate | triage | remediate | verify | publish | complete | No | — |
| repository.createdAt | string | Yes | ISO 8601 timestamp. |
| repository.updatedAt | string | Yes | ISO 8601 timestamp. |
| policy | object | Yes | — |
| policy.id | string | Yes | Unique identifier. |
| policy.version | integer | Yes | — |
| policy.value | object | Yes | — |
| policy.value.schemaVersion | 1 | Yes | — |
| policy.value.defaultBranch | string | Yes | — |
| policy.value.scanMode | full | incremental | Yes | — |
| policy.value.schedule | object | Yes | — |
| policy.value.schedule.enabled | boolean | Yes | — |
| policy.value.schedule.cron | string | Yes | — |
| policy.value.schedule.timezone | string | Yes | — |
| policy.value.pullRequests | object | Yes | — |
| policy.value.pullRequests.enabled | boolean | Yes | — |
| policy.value.pullRequests.branches | string[] | Yes | — |
| policy.value.pullRequests.pathIncludes | string[] | Yes | — |
| policy.value.pullRequests.pathExcludes | string[] | Yes | — |
| policy.value.pullRequests.scanForksReadOnly | true | Yes | — |
| policy.value.push | object | Yes | — |
| policy.value.push.enabled | boolean | Yes | — |
| policy.value.push.branches | string[] | Yes | — |
| policy.value.scanners | string[] | Yes | — |
| policy.value.remediation | object | Yes | — |
| policy.value.remediation.mode | disabled | approval_required | Yes | — |
| policy.value.remediation.minimumSeverity | critical | high | medium | low | informational | Yes | — |
| policy.value.remediation.draftPullRequestsOnly | true | Yes | — |
| policy.value.remediation.allowWorkflowChanges | false | Yes | — |
| policy.value.remediation.maximumChangedFiles | integer | Yes | — |
| policy.value.remediation.maximumPatchBytes | integer | Yes | — |
| policy.changeSummary | string | Yes | — |
| policy.createdAt | string | Yes | ISO 8601 timestamp. |
| threatModel | object | Yes | — |
| threatModel.id | string | Yes | Unique identifier. |
| threatModel.version | integer | Yes | — |
| threatModel.source | generated | user | migration | Yes | — |
| threatModel.value | object | Yes | — |
| threatModel.value.schemaVersion | 1 | Yes | — |
| threatModel.value.summary | string | Yes | — |
| threatModel.value.entryPoints | string[] | Yes | — |
| threatModel.value.untrustedInputs | string[] | Yes | — |
| threatModel.value.trustBoundaries | string[] | Yes | — |
| threatModel.value.sensitiveDataPaths | string[] | Yes | — |
| threatModel.value.privilegedActions | string[] | Yes | — |
| threatModel.value.priorityAreas | string[] | Yes | — |
| threatModel.value.exclusions | object[] | Yes | — |
| threatModel.value.exclusions[].path | string | Yes | Workspace-relative file path. |
| threatModel.value.exclusions[].reason | string | Yes | — |
| threatModel.changeSummary | string | Yes | — |
| threatModel.createdAt | string | Yes | ISO 8601 timestamp. |
| runs | object[] | Yes | — |
| runs[].id | string | Yes | Unique identifier. |
| runs[].repositoryId | string | Yes | — |
| runs[].repositoryFullName | string | No | — |
| runs[].triggerType | manual | schedule | pull_request | push | retry | Yes | — |
| runs[].triggerEventId | string | No | — |
| runs[].baseSha | string | No | — |
| runs[].headSha | string | No | — |
| runs[].ref | string | No | — |
| runs[].status | queued | running | waiting_approval | succeeded | partial | failed | cancelled | Yes | Current lifecycle status. |
| runs[].stage | ingest | checkout | inventory | scan | validate | triage | remediate | verify | publish | complete | Yes | — |
| runs[].policyVersionId | string | No | — |
| runs[].threatModelVersionId | string | No | — |
| runs[].promptVersion | string | No | — |
| runs[].modelVersion | string | No | — |
| runs[].scannerVersions | object | No | — |
| runs[].coverage | object | No | — |
| runs[].summary | object | No | — |
| runs[].narrativeSummary | string | Yes | Evidence-grounded written assessment of the run. New runs retain model and prompt provenance in summary.narrative; legacy runs receive a deterministic projection. |
| runs[].error | object | No | — |
| runs[].findingCount | integer | Yes | — |
| runs[].checkRunUrl | string | No | — |
| runs[].pullRequestUrl | string | No | — |
| runs[].queuedAt | string | Yes | — |
| runs[].startedAt | string | No | ISO 8601 timestamp. |
| runs[].completedAt | string | No | ISO 8601 timestamp. |
| runs[].createdAt | string | Yes | ISO 8601 timestamp. |
| runs[].updatedAt | string | Yes | ISO 8601 timestamp. |
| findings | object[] | Yes | — |
| findings[].id | string | Yes | Unique identifier. |
| findings[].repositoryId | string | Yes | — |
| findings[].repositoryFullName | string | No | — |
| findings[].fingerprint | string | Yes | — |
| findings[].ruleId | string | No | — |
| findings[].title | string | Yes | Display title. |
| findings[].summary | string | Yes | — |
| findings[].narrativeSummary | string | Yes | Evidence-grounded written interpretation of this finding. The canonical scanner description remains available in summary. |
| findings[].severity | critical | high | medium | low | informational | Yes | — |
| findings[].confidence | number | Yes | — |
| findings[].exploitability | string | No | — |
| findings[].cwe | string[] | No | — |
| findings[].cvss | number | No | — |
| findings[].status | open | accepted | risk_accepted | false_positive | fixed | Yes | Current lifecycle status. |
| findings[].firstSeenRunId | string | No | — |
| findings[].lastSeenRunId | string | No | — |
| findings[].assignedToUserId | string | No | — |
| findings[].resolutionReason | string | No | — |
| findings[].resolutionExpiresAt | string | No | — |
| findings[].fixedAt | string | No | — |
| findings[].metadata | object | No | Free-form metadata object. |
| findings[].occurrenceCount | integer | Yes | — |
| findings[].createdAt | string | Yes | ISO 8601 timestamp. |
| findings[].updatedAt | string | Yes | ISO 8601 timestamp. |
| auditEvents | object[] | Yes | — |
| auditEvents[].id | string | Yes | Unique identifier. |
| auditEvents[].repositoryId | string | No | — |
| auditEvents[].runId | string | No | — |
| auditEvents[].findingId | string | No | — |
| auditEvents[].remediationId | string | No | — |
| auditEvents[].actorType | user | system | github | agent | Yes | — |
| auditEvents[].actorId | string | Yes | — |
| auditEvents[].action | string | Yes | — |
| auditEvents[].targetType | string | Yes | — |
| auditEvents[].targetId | string | Yes | — |
| auditEvents[].correlationId | string | No | — |
| auditEvents[].payload | object | No | — |
| auditEvents[].previousHash | string | Yes | SHA-256 digest of the preceding organization security audit event; empty for the chain root. |
| auditEvents[].eventHash | string | Yes | SHA-256 digest binding this event to its predecessor. |
| auditEvents[].createdAt | string | Yes | ISO 8601 timestamp. |
404Resource not foundapplication/json
| Field | Type | Required | Description |
|---|---|---|---|
| error | string | No | — |