> ## Documentation Index > Fetch the complete documentation index at: https://docs.myrqen.cc/llms.txt > Use this file to discover all available pages before exploring further. # Read a synced report > Owner and workspace-member access. A platform administrator has **no** path to report content here — that requires an explicit, expiring support grant. While a report is still live and has no stored body, `report` is `null` and `meta` carries what is known so far. Workspace-member reads are audited. ## OpenAPI ````yaml /api-reference/openapi.json get /api/v1/reports/{id} openapi: 3.1.0 info: title: Myrqen API version: 1.0.0 description: >- The JSON API served by `apps/web` under `/api/v1`. Derived from the route handlers in `apps/web/app/api/v1` and the shared types in `packages/contracts`. This reference documents the surface a developer and the Myrqen CLI actually use. Platform-administration and billing endpoints exist in the application but are operator-only and are deliberately not published here. The hosted service at `https://api.myrqen.cc` is not deployed yet. Run your own deployment and use its origin. license: name: Myrqen Source-Available Licence 1.0 url: https://github.com/stijnswapped/Myrqen/blob/main/LICENSE servers: - url: http://localhost:3000 description: >- A deployment you run yourself. Use this while the hosted service is unavailable. - url: https://api.myrqen.cc description: >- The hosted API. This is the CLI's shipped default, but the hosted service is NOT deployed yet, so requests to it do not resolve today. security: [] tags: - name: Health description: >- Liveness and readiness probes. Unauthenticated, and answered on any hostname. - name: Authentication description: Browser sessions. Password plus recovery codes; no email is ever sent. - name: Device linking description: Binding a machine's CLI to an account, via browser approval. - name: Workspaces and projects description: Where a scanned repository belongs. - name: Sync and quota description: Creating, feeding, and finalizing a cloud report. - name: Reports description: Reading and exporting a synced report. - name: Sharing description: Share links and the server-side projections they resolve to. - name: Analytics description: Allowlisted product-event ingest. - name: Updates description: The signed release manifest. paths: /api/v1/reports/{id}: get: tags: - Reports summary: Read a synced report description: >- Owner and workspace-member access. A platform administrator has **no** path to report content here — that requires an explicit, expiring support grant. While a report is still live and has no stored body, `report` is `null` and `meta` carries what is known so far. Workspace-member reads are audited. operationId: getReport parameters: - $ref: '#/components/parameters/ReportId' responses: '200': description: >- The report projection for this viewer, or metadata when no body is stored yet. content: application/json: schema: type: object required: - state properties: state: type: string report: oneOf: - $ref: '#/components/schemas/ReportProjection' - type: 'null' expiresAt: type: string format: date-time meta: $ref: '#/components/schemas/ReportMeta' '404': $ref: '#/components/responses/NotFound' '410': $ref: '#/components/responses/Gone' security: - sessionCookie: [] components: parameters: ReportId: name: id in: path required: true schema: type: string description: The cloud report id. schemas: ReportProjection: type: object required: - id - schemaVersion - projectedFor description: >- What this viewer is permitted to see. Excluded sections and findings are **absent**, not masked in place. properties: id: type: string schemaVersion: type: string const: 1.0.0 projectedFor: type: object required: - principalType properties: principalType: type: string enum: - user - email - workspace - anonymous label: type: string generatedAt: type: string format: date-time project: type: object scan: type: object authorization: type: object summary: $ref: '#/components/schemas/ReportSummary' findings: type: array items: $ref: '#/components/schemas/Finding' coverage: type: array items: type: string coverageAreas: type: array items: type: object limitations: type: array items: type: string methodologyVersion: type: string redactionNotice: type: string ReportMeta: type: object properties: id: type: string projectName: type: string workspaceName: type: string workspaceKind: $ref: '#/components/schemas/WorkspaceKind' state: type: string effortRequested: type: string agentName: type: - string - 'null' modelName: type: - string - 'null' expiresAt: type: string format: date-time syncCreatedAt: type: string format: date-time ReportSummary: type: object required: - findingCount - severityCounts - verificationCounts properties: findingCount: type: integer severityCounts: type: object required: - critical - high - medium - low - info properties: critical: type: integer high: type: integer medium: type: integer low: type: integer info: type: integer verificationCounts: type: object required: - verified - strong_evidence - needs_review properties: verified: type: integer strong_evidence: type: integer needs_review: type: integer candidateCount: type: integer duplicateCount: type: integer fixedCount: type: integer Finding: type: object required: - id - title - category - severity - verification - summary - impact - affected - evidence - remediation - verificationPlan properties: id: type: string example: MYR-001 title: type: string category: type: string taxonomy: type: array items: type: string severity: $ref: '#/components/schemas/Severity' verification: $ref: '#/components/schemas/Verification' summary: type: string impact: type: string affected: type: object required: - component properties: component: type: string file: type: string lineStart: type: integer lineEnd: type: integer route: type: string origin: type: string evidence: type: array items: $ref: '#/components/schemas/FindingEvidence' corroboration: type: array items: $ref: '#/components/schemas/FindingEvidence' remediation: type: string verificationPlan: type: string reproduction: type: string references: type: array items: type: string fingerprint: type: string description: Stable dedupe identity assigned by the CLI, not by the agent. secretReferences: type: array description: >- A secret is described by label, kind, and a local HMAC fingerprint. Never by value. items: type: object required: - label - kind - fingerprint properties: label: type: string kind: type: string fingerprint: type: string location: type: string status: type: string enum: - open - fix_suggested - fix_applied - fixed_verified - accepted_risk - false_positive fixedAt: type: string format: date-time fixHistory: type: array items: $ref: '#/components/schemas/FixHistoryEntry' firstSeenAt: type: string format: date-time tags: type: array items: type: string WorkspaceKind: type: string enum: - personal - team ApiError: type: object required: - error properties: error: type: object required: - code - message - requestId properties: code: $ref: '#/components/schemas/ApiErrorCode' message: type: string description: Human-readable. May change; branch on `code`. requestId: type: string description: A fresh UUID per response, for correlating with server logs. details: type: object additionalProperties: true example: error: code: SYNC_WEEKLY_LIMIT_REACHED message: Cloud report limit reached. This scan stays local. requestId: 8f14e45f-ceea-467a-9f8b-2b6b2b6a1f2c details: weekly: used: 15 limit: 15 resetsAt: '2026-08-24T06:00:00.000Z' Severity: type: string enum: - critical - high - medium - low - info Verification: type: string enum: - verified - strong_evidence - needs_review FindingEvidence: type: object required: - kind - description properties: kind: type: string enum: - source - runtime - identity_differential - configuration - dependency - other description: type: string snippet: type: string location: type: string redacted: type: boolean FixHistoryEntry: type: object required: - at - action - verified properties: at: type: string format: date-time action: type: string enum: - suggested - applied - verified - verification_failed - reverted verified: type: boolean changedFiles: type: array items: type: string note: type: string ApiErrorCode: type: string enum: - BAD_REQUEST - VALIDATION_FAILED - UNAUTHENTICATED - FORBIDDEN - NOT_FOUND - CONFLICT - RATE_LIMITED - INTERNAL - DEVICE_LINK_EXPIRED - DEVICE_LINK_ALREADY_CONSUMED - DEVICE_LINK_NOT_APPROVED - DEVICE_REVOKED - SYNC_DAILY_LIMIT_REACHED - SYNC_WEEKLY_LIMIT_REACHED - REPORT_EXPIRED - REPORT_SCHEMA_UNSUPPORTED - UNSAFE_PAYLOAD_REJECTED - SHARE_PASSWORD_REQUIRED - SHARE_NOT_AVAILABLE - CLIENT_VERSION_REVOKED - CLIENT_VERSION_TOO_OLD - SUPPORT_GRANT_REQUIRED responses: NotFound: description: >- `NOT_FOUND` — the resource does not exist, or exists and you may not know that. content: application/json: schema: $ref: '#/components/schemas/ApiError' Gone: description: >- `REPORT_EXPIRED` or `DEVICE_LINK_EXPIRED` — the resource passed its window and its contents were deleted. content: application/json: schema: $ref: '#/components/schemas/ApiError' securitySchemes: sessionCookie: type: apiKey in: cookie name: myrqen_session description: >- Browser session cookie: `httpOnly`, `sameSite=lax`, `Secure` when `APP_BASE_URL` is https, 30-day lifetime. Deliberately separate from CLI device credentials. ````