> ## Documentation Index > Fetch the complete documentation index at: https://pentest-tools.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get scan output by ID ## OpenAPI ````yaml https://api.pentest-tools.com/api-schema.yml get /scans/{id}/output openapi: 3.0.3 info: title: pentest-tools.com REST API version: 1.0.1.1 servers: - url: https://app.pentest-tools.com/api/v2 security: - bearerAuth: [] tags: - name: targets x-displayName: Targets description: Operations done on Targets - name: scans x-displayName: Scans description: Operations done on Scans - name: workspaces x-displayName: Workspaces description: Operations done on Workspaces - name: http_loggers x-displayName: HTTP Loggers description: Operations done on HTTP Loggers - name: wordlists x-displayName: Wordlists description: Operations done on Wordlists - name: finding_templates x-displayName: Finding Templates description: Operations done on Finding Templates - name: vpn_profiles x-displayName: VPN Profiles description: Operations done on VPN Profiles - name: findings x-displayName: Findings description: Operations done on Findings - name: reports x-displayName: Reports description: Operations done on Reports paths: /scans/{id}/output: parameters: - name: id in: path description: id of scan required: true schema: type: integer - name: Accept in: header schema: type: string enum: - application/json - application/pdf get: tags: - scans summary: Get scan output by ID operationId: get_scan_output responses: '200': description: OK content: application/json: schema: type: object required: - data properties: data: $ref: '#/components/schemas/ScanOutput' application/pdf: schema: type: string format: binary '400': description: Invalid parameters '401': $ref: '#/components/responses/UnauthorizedError' '403': $ref: '#/components/responses/ForbiddenError' '404': $ref: '#/components/responses/ObjectNotFoundError' '406': description: Media type not supported '429': $ref: '#/components/responses/TooManyRequestsError' '500': description: Internal server error components: schemas: ScanOutput: type: object required: - output_type - output_data properties: output_type: type: string description: The type of output returned by the scan output_data: type: object description: The output of the scan discriminator: propertyName: output_type mapping: subdomain_list: $ref: '#/components/schemas/FindSubdomainsOutput' domain_list: $ref: '#/components/schemas/FindDomainsOutput' vhost_list: $ref: '#/components/schemas/VHostsFinderOutput' fuzzing_results: $ref: '#/components/schemas/UrlFuzzerOutput' port_scanner: $ref: '#/components/schemas/PortScannerOutput' finding_list: $ref: '#/components/schemas/VulnScannerOutput' sniper_output: $ref: '#/components/schemas/SniperOutput' waf_results: $ref: '#/components/schemas/WafDetectorOutput' people_hunter_results: $ref: '#/components/schemas/PeopleHunterOutput' sqli_exploits: $ref: '#/components/schemas/SQLiExploiterOutput' FindSubdomainsOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: subdomains: description: List of subdomains found by the scanner type: array items: type: object description: >- An object containing the properties of a subdomain. If a property is not present due to a scan parameter, it will be set to `null` properties: hostname: type: string example: host.mydomain.com ip_address: type: string format: ipv4 example: 8.8.8.8 description: >- The IP address or an empty string if the subdomain could not be resolved. os: type: string nullable: true server: type: string nullable: true technology: type: string nullable: true web_platform: type: string nullable: true page_title: type: string nullable: true whois_netname: type: string nullable: true whois_country: type: string nullable: true example: DE resolved: type: boolean FindDomainsOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: domains: description: List of domains found by the scanner type: array items: type: object description: An object containing the properties of a domain. properties: domain: type: string example: host.mydomain.com companies: type: array items: type: string example: - Microsoft Corporation emails: type: array items: type: string example: - domains@microsoft.com - msnhst@microsoft.com sources: type: array items: type: string example: - Name match - Redirect - SSL Certificate certainty: type: integer example: 100 VHostsFinderOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: virtual_hosts: description: List of virtual hosts found by the scanner type: array items: type: object description: An object containing the properties of a virtual host properties: host: type: string example: www.example.com ip: type: string example: 8.8.8.8 UrlFuzzerOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: fuzzing_results: description: >- List of fuzzing results according to the response filters set type: array items: type: object description: >- An object containing an input fuzzing word and the HTTP response details properties: fuzzing_word: type: string example: admin description: A word from the input fuzzing wordlist url: type: string example: https://example.com/path/admin description: The URL of the HTTP request method: type: string enum: - GET - POST description: The method used to make the HTTP request post_data: type: string nullable: true example: username=admin&pass=123 description: The POST data sent in the HTTP request http_code: type: integer example: 200 description: The HTTP code of the response http_reason: type: string example: OK description: The HTTP reason of the response response_size: type: number format: float example: 0.478 description: The size of the response in KB PortScannerOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: status: type: string enum: - up - down traceroute: type: object minItems: 0 properties: detected: type: string enum: - 'True' - 'False' nodes: type: array items: type: object properties: rtt: type: number format: float minimum: 0 example: 30.54 host: type: string nullable: true format: hostname example: target.local ipaddr: type: string format: ipv4 example: 8.8.4.4 ttl: type: integer minimum: 1 example: 1 os: type: object properties: vendor: type: string example: Linux name: type: string example: Linux 2.6.32 family: type: string example: Linux generation: type: string example: 2.6.X cpe: type: string example: cpe:/o:linux:linux_kernel:2.6.32 detected: type: string enum: - 'True' - 'False' accuracy: type: string example: 100% hostnames: type: array items: type: string example: - example.com - com.example.reverse_dns ip_address: type: string format: ipv4 example: 8.8.8.8 ports: type: array items: $ref: '#/components/schemas/Port' type: object VulnScannerOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: findings: description: List of findings found by the vulnerability scanner type: array items: $ref: '#/components/schemas/OutputFinding' type: object SniperOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: ports: type: array items: type: object properties: number: type: integer minimum: 1 maximum: 65535 example: 443 state: type: string example: open service_name: type: string example: http service_version: type: string example: HTTP nginx 1.25.2 num_compatible_exploits: type: integer example: 2 vulnerable: type: boolean exploited: type: boolean successful_exploits: type: array items: type: string example: >- Oracle Weblogic - Remote Code Execution (CVE-2018-2894) web_fingerprint: type: object nullable: true deprecated: true description: > This field is deprecated and will be removed in a future version. Use `web_technologies` instead. properties: platform_type: type: string server_type: type: string server_version: type: string app_title: type: string platform_version: type: string tech_type: type: string tech_version: type: string web_technologies: type: array items: type: string example: - nginx 1.25.2 - PHP 8.1.0 artefacts: type: object properties: name: type: string enum: - network_configuration - network_services - network_neighbors - local_users - processes - network_graph - system_information - filesystem - command_history data_key: type: string nullable: true data: $ref: '#/components/schemas/SniperOutputData' raw_data: type: array items: type: string cmds: type: array nullable: true items: type: string WafDetectorOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: waf_results: description: List of URLs and the analyzed WAF behaviors type: array items: type: object description: >- An object containing the target URL and information about the detected WAF behavior properties: target_url: type: string example: https://example.com description: The URL given to analyze for WAF behavior waf_name: type: string nullable: true example: CloudFlare description: The detected WAF or `null` if it could not determined vendor_name: type: string nullable: true example: CloudFlare Inc. description: >- The vendor of the detected WAF or `null` if it could not be determined notes: type: string nullable: true example: >- We detected WAF behaviour, but we could not determine the specific WAF type description: Additional notes regarding the scan outcome detection_url: type: string nullable: true example: https://example.com/dwef description: The URL accessed to trigger the WAF behavior origin_ip: type: string nullable: true example: https://1.2.3.4 description: >- The URL with the server IP behind the WAF or `null` if it could not be determined PeopleHunterOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: ports: type: array items: $ref: '#/components/schemas/Port' type: object results: type: array items: type: object properties: email_pattern_results: type: array items: type: object properties: emails: type: array items: type: string format: email pattern: type: string example: First and last name with dot percentage: type: integer example: 70 description: percentage of emails with this pattern emails: type: array items: type: object properties: address: type: string format: email example: user@example.com discovered_from: type: string format: uri domain: type: string format: hostname local: type: string example: user pattern: type: string example: Single name port: type: integer minimum: 1 maximum: 65535 example: 443 social_media_pages: type: array items: type: object properties: discovered_from: type: string url: type: string SQLiExploiterOutput: allOf: - $ref: '#/components/schemas/ScanOutput' - type: object properties: output_data: type: object properties: current_user: type: string current_database: type: string hostname: type: string banner: type: string example: 10.11.9-MariaDB-ubu2204 web_app_technology: type: string example: Nginx 1.27.4, PHP 8.4.5 backend_dbms: type: string example: MySQL >= 5.0 (MariaDB fork) operating_system: type: string dbms_users: type: array items: type: string injection_points: type: array items: type: object properties: parameter: type: string example: id method: type: string example: GET sqli_type: type: string example: time-based blind payload: type: string databases: type: array items: type: object properties: name: type: string example: users tables: type: array items: type: object properties: name: type: string columns: type: array items: type: object additionalProperties: type: string example: user_id: user id user: user password: PASSWORD rows: type: array items: type: object additionalProperties: true example: user_id: 1 user: admin password: 5f4dcc3b5aa765d61d8327deb882cf99 ErrorResponse: type: object additionalProperties: false properties: status: type: integer example: 401 message: type: string example: No API key specified Port: type: object properties: service_version: type: string example: 7.9p1 Debian 10+deb10u2 service_name: type: string example: ssh cpe: type: string example: cpe:/a:openbsd:openssh:7.9p1 service_extrainfo: type: string example: protocol 2.0 port_state: type: string enum: - open - closed - filtered - unfiltered - open|filtered - closed|filtered port_number: type: integer minimum: 1 maximum: 65535 example: 22 service_product: type: string example: OpenSSH OutputFinding: type: object properties: id: type: integer nullable: true description: the ID of the finding. This is `null` if the scan is still running example: 420233 name: type: string description: A short description of the finding example: Vulnerabilities found for Apache Httpd 2.4.10 test_description: deprecated: true type: string description: | This field is deprecated and will be removed in a future version. Use `/scans/{id}/tests` or `/findings/{id}/tests` instead. A short description of what the test does. example: Checking for SQL Injection... test_finished: deprecated: true type: boolean example: true description: > This field is deprecated and will be removed in a future version. Use `/scans/{id}/tests` or `/findings/{id}/tests` instead. This is set to `true` when the test ends. If `false`, it indicates the failed test. confirmed: type: boolean description: >- this is set to `true` if the finding has a high certainty of not being a false positive epss_score: type: number nullable: true format: float epss_percentile: type: number nullable: true format: float in_cisa_catalog: type: boolean nullable: true example: true description: >- Indicated whether the CVEs are part of the CISA Known Exploited Vulnerabilities Catalog cve: type: array items: type: string example: - CVE-2017-3167 - CVE-2019-0217 cvss: type: number nullable: true format: float cvssv3: type: number nullable: true format: float vuln_description: type: string example: Vulnerabilities found for Apache Httpd 2.4.25 (port 80/tcp) description: A short description of the vulnerability vuln_evidence: type: object description: >- the evidence for the data. Depending on the type, the data type changes. This is only human friendly and its format and data might change in the future properties: type: type: string enum: - text - table - list - unsuported data: type: object nullable: true oneOf: - type: string - $ref: '#/components/schemas/Table' - type: array items: type: string risk_description: type: string description: >- The risk posed by the vulnerability. This is only human friendly and its format and data might change in the future risk_level: type: integer enum: - 0 - 1 - 2 - 3 - 4 description: | Risk level: * `0` - Informational * `1` - Low * `2` - Medium * `3` - High * `4` - Critical status: type: string nullable: true enum: - open - false_positive - ignored - fixed - accepted description: >- The status of the finding. By default this is `open`. It is `null` if the scan is still running recommendation: type: string description: >- a recommendation for mitigating the vulnerability. This is only human friendly and its format and data might change in the future references: type: array items: type: string format: uri verified: type: boolean nullable: true description: >- This is set to `true` if a finding was manually verified. It is `null` for running scans, since this is an attribute of the findings generated after a scan finished vuln_id: type: string nullable: true description: A unique vulnerability identifier example: NETSCAN-SNIPER-CVE-2021-42013-RCE owasp: type: object description: Vulnerability OWASP Top 10 properties: owasp_2017: type: string nullable: true owasp_2021: type: string nullable: true owasp_2025: type: string nullable: true cwe: type: string nullable: true port: type: integer nullable: true minimum: 0 maximum: 65535 description: The port where this was found on the target protocol: type: string nullable: true enum: - TCP - UDP - DCCP - SCTP description: The transport layer protocol associated with the finding service: type: string nullable: true enum: - AMQP - Docker - FTP - HTTP - HTTPS - MQTT - MSSQL - MySQL - PostgreSQL - RDP - Redis - SMB - SSH - STOMP - Telnet - VNC - WinRM description: The application layer service associated with the finding group_id: type: integer nullable: true description: The ID of the finding group this finding belongs to example: 9876 SniperOutputData: type: object nullable: true discriminator: propertyName: name mapping: network_configuration: $ref: '#/components/schemas/SniperOutputDataNetworkConfig' network_services: $ref: '#/components/schemas/SniperOutputDataNetworkServices' network_neighbors: $ref: '#/components/schemas/SniperOutputDataNetworkNeighbors' local_users: $ref: '#/components/schemas/SniperOutputDataLocalUsers' processes: $ref: '#/components/schemas/SniperOutputDataProcesses' network_graph: $ref: '#/components/schemas/SniperOutputDataNetworkGraph' system_information: $ref: '#/components/schemas/SniperOutputDataSystemInfo' filesystem: $ref: '#/components/schemas/SniperOutputDataFilesystem' command_history: $ref: '#/components/schemas/SniperOutputDataCmdHistory' Table: type: object nullable: true properties: headers: type: array items: type: string rows: type: array items: type: array items: oneOf: - type: string - type: number format: float SniperOutputDataNetworkConfig: allOf: - $ref: '#/components/schemas/SniperOutputData' properties: interfaces: type: string nullable: true SniperOutputDataNetworkServices: allOf: - $ref: '#/components/schemas/SniperOutputData' properties: services: type: string nullable: true SniperOutputDataNetworkNeighbors: allOf: - $ref: '#/components/schemas/SniperOutputData' properties: neighbors: type: string nullable: true SniperOutputDataLocalUsers: allOf: - $ref: '#/components/schemas/SniperOutputData' properties: username: example: root type: string full_name: example: root type: string home_dir: example: /root type: string password: example: password type: string groups: example: - root type: array items: type: string shell: example: /bin/bash type: string SniperOutputDataProcesses: type: object allOf: - $ref: '#/components/schemas/SniperOutputData' nullable: true SniperOutputDataNetworkGraph: type: object allOf: - $ref: '#/components/schemas/SniperOutputData' nullable: true SniperOutputDataSystemInfo: allOf: - $ref: '#/components/schemas/SniperOutputData' properties: operating_system: example: Linux 5.10.0-27-amd64 type: string hostname: example: 02c251c5bbd type: string ip_addr: example: 178.79.134.18 type: string arch: example: x86_64 type: string locale: type: string pwd: example: /var/lib/redis type: string exploit_user: example: root type: string SniperOutputDataFilesystem: allOf: - $ref: '#/components/schemas/SniperOutputData' properties: name: example: / type: string permissions: example: drwxr-x--- type: string user: example: root type: string group: example: redis type: string size: example: '4096' type: string type: example: dir type: string path: example: / type: string short_path: type: string nullable: true content: type: array items: type: object properties: name: type: string permissions: type: string user: type: string group: type: string size: type: string type: type: string path: type: string short_path: type: string content: type: array nullable: true items: type: object properties: name: type: string permissions: type: string user: type: string group: type: string size: type: string type: type: string path: type: string short_path: type: string content: type: string nullable: true last_modified: type: string last_modified: type: string SniperOutputDataCmdHistory: allOf: - $ref: '#/components/schemas/SniperOutputData' properties: history: type: array items: type: string responses: UnauthorizedError: description: API key is missing or invalid content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ForbiddenError: description: You can"t perform this action. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ObjectNotFoundError: description: The object with the given ID was not found content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' TooManyRequestsError: description: Too many requests made in a short period of time content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer description: >- Use the "API key" from the [profile page](https://app.pentest-tools.com/account/api) as the token ````