# List application-scoped scan templates

Returns a paginated list of application-scoped scan templates.

Endpoint: GET /api/v3.0/redteaming/orgs/{orgUuid}/applications/{applicationUuid}/templates
Version: 3.0
Security: bearer-key

## Security:

  - `bearer-key` (unknown)
    http bearer JWT

## Path parameters:

  - `orgUuid` (string, required)

  - `applicationUuid` (string, required)

## Query parameters:

  - `pretty` (boolean)
    When `true`, indent the JSON body (2 spaces) and render multiline string
fields (e.g. YAML `config`) with literal newlines for human readability.
Default off (compact JSON). Intended for interactive use; omit for clients
that parse the body as strict JSON.

  - `cursor` (integer)

  - `limit` (integer)

## Header parameters:

  - `X-Correlation-ID` (string)
    Optional caller-supplied correlation id. Must be a UUID when present.
When omitted or blank, the API generates a UUID. A non-UUID value
returns 400 `CORRELATION.INVALID`. If a write fails because a UUID is already in use, the API returns 409
`UUID.DUPLICATE`. The value used (caller or generated) is echoed as
`supportToken` and in the `X-Correlation-ID` response header.

## Response 200:

  - `200` (unknown)
    Templates

## Response 200 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `additionalData` (object, required)

  - `additionalData.totalItems` (string, required)
    Total number of items, encoded as a string.

  - `additionalData.cursor` (integer)

  - `additionalData.next` (string)
    URL of the next page, or null when this page is the last.

  - `response` (array, required)

  - `response.id` (string, required)

  - `response.name` (string, required)

  - `response.description` (string, required)

  - `response.config` (object, required)

  - `response.config.probes` (array)
    Human-readable probe or strategy names. Writes accept an id or a name.

  - `response.config.strategies` (array)
    Human-readable probe or strategy names. Writes accept an id or a name.

  - `response.config.numTests` (integer)

  - `response.config.maxConcurrency` (integer)

  - `response.config.language` (any)

  - `response.config.probeTimeoutMs` (integer)

  - `response.config.maxCampaignTimeMs` (integer)

  - `response.scopeType` (string, required)
    Enum: "organization", "application", "project"

  - `response.organization` (string, required)

  - `response.application` (string, required)

  - `response.project` (string, required)

  - `response.createdBy` (string, required)

  - `response.updatedBy` (string, required)

  - `response.createdAt` (string, required)

  - `response.updatedAt` (string, required)

  - `response.canEdit` (boolean, required)

  - `response.canDelete` (boolean, required)

  - `response._links` (object, required)

## Response 200 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 400:

  - `400` (unknown)
    X-Correlation-ID is not a UUID (CORRELATION.INVALID), cursor is not a whole number of 0 or greater (PAGE.CURSOR), or limit is not a whole number from 1 to 200 (PARAM.INT_RANGE).

## Response 400 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 400 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 401:

  - `401` (unknown)
    Authentication failed. The job report returns this JSON envelope and never a PDF or CSV attachment. Codes: AUTH.REQUIRED, AUTH.FAILED, AUTH.USER_HEADER_MISMATCH, JWT.EXPIRED, JWT.SIGNATURE, JWT.STRUCTURE, JWT.MISSING_CLAIMS, JWT.UNAVAILABLE, JWT.CLAIM_INVALID, JWT.VERIFICATION_FAILED.

## Response 401 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 401 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 403:

  - `403` (unknown)
    Authentication succeeded but the call is not allowed. AUTH.SERVICE_BOT: a service-to-service token cannot call this API. AUTH.ORG_MISMATCH: the organization in the URL does not match the access token. AUTH.INSUFFICIENT_PERMISSIONS: the token lacks permission for this action. Template update and delete also return AUTH.INSUFFICIENT_PERMISSIONS when the caller is not the template owner and does not have manage-settings access. TEMPLATE.ORG_SCOPE_DENIED: a template write whose scope is organization without organization-level manage-targets permission.

## Response 403 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 403 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 429:

  - `429` (unknown)
    The caller exceeded the per-user request rate (RATE.LIMITED). The default is 600 requests per minute per user. Retry after the number of seconds in Retry-After.

## Response 429 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 429 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

  - `Retry-After` (integer)
    Seconds to wait before retrying.

## Response 500:

  - `500` (unknown)
    INTERNAL.ERROR: an unexpected failure. Retry and include supportToken if it continues. AUTH.PERMISSIONS_UNRESOLVED: permissions could not be resolved.

## Response 500 fields (application/json):

  - `supportToken` (string, required)
    Correlation id used for this request. Same value as the X-Correlation-ID response header.

  - `response` (object, required)

  - `response.error` (string, required)
    Stable uppercase code identifying the failure. Clients may match this value. Not translated. The English message for each code is the matching example message in this document. PATH.HIERARCHY_REQUIRED is reserved for a project URL missing an organization, application, or project id. RESOURCE.NOT_FOUND is an unknown path (404). METHOD.NOT_ALLOWED is a known path called with the wrong HTTP method (405). Parameterized messages substitute values named in the example description: CAMPAIGNS.TOO_MANY {max}, PATH.INVALID_UUID {name}, CONFIG.CONNECTIVITY_FAILED {reason}, CONFIG.VALIDATION_FAILED {reason}, CONFIG.UNSUPPORTED_ITEMS {items}, PARAM.REPEATED {name}, PARAM.INT_RANGE {name} and {max}, PROBE.UNKNOWN {probe}, STRATEGY.UNKNOWN {strategy}.
    Enum: "UUID.DUPLICATE", "INTERNAL.ERROR", "CONTENT_TYPE.JSON", "BODY.INVALID_JSON", "BODY.TOO_LARGE", "RATE.LIMITED", "AUTH.REQUIRED", "AUTH.FAILED", "AUTH.USER_HEADER_MISMATCH", "AUTH.SERVICE_BOT", "AUTH.ORG_MISMATCH", "PATH.HIERARCHY_REQUIRED", "PATH.INVALID_UUID", "CORRELATION.INVALID", "AUTH.INSUFFICIENT_PERMISSIONS", "AUTH.PERMISSIONS_UNRESOLVED", "PAGE.CURSOR", "CAMPAIGNS.ALL_CAMPAIGNS", "CAMPAIGNS.EMPTY", "CAMPAIGNS.INVALID_ID", "CAMPAIGNS.DUPLICATE_IDS", "CAMPAIGNS.COMBINED_WITH_LAST_N", "CAMPAIGNS.TOO_MANY", "TARGET.NOT_FOUND", "CONFIGURATION.NOT_FOUND", "TARGET.NAME_REQUIRED", "TARGET.NAME_EXISTS", "TARGET.CONFIG_REQUIRED", "TARGET.CONNECTOR_CHANGE_FORBIDDEN", "TARGET.URL_IMMUTABLE", "TARGET.SCAN_ALREADY_RUNNING", "TARGET.DELETE_WHILE_RUNNING", "CONFIG.MUST_USE_PROBES", "CONFIG.INVALID_YAML", "CONFIG.CONNECTIVITY_FAILED", "CONFIG.PROVIDER_EXTRACT_FAILED", "CONFIG.SECURITY_ISSUES", "CONFIG.SECRET_PLACEHOLDER", "CONFIG.TEMPLATE_EXPRESSION", "CONFIG.VALIDATION_FAILED", "CONFIG.UNSUPPORTED_ITEMS", "CONFIG.HEADER_PLACEHOLDER", "CAMPAIGN.NOT_FOUND", "JOB.NOT_FOUND", "JOB.RESULTS_NOT_READY", "REPORT.FORMAT", "REPORT.MODE", "REMEDIATIONS.NOTHING_TO_EXPORT", "REMEDIATIONS.SEVERITY_INVALID", "REMEDIATIONS.SORT_INVALID", "REMEDIATIONS.CATEGORY_INVALID", "FINDING.NOT_FOUND", "SUPPRESSION.REASON_KIND_REQUIRED", "SUPPRESSION.REASON_KIND_INVALID", "SUPPRESSION.REASON_TEXT_REQUIRED", "SUPPRESSION.REASON_TEXT_LENGTH", "SUPPRESSION.KIND_REQUIRED", "SUPPRESSION.KIND_INVALID", "SUPPRESSION.TEXT_REQUIRED", "SUPPRESSION.TEXT_LENGTH", "RESOURCE.NOT_FOUND", "METHOD.NOT_ALLOWED", "TEMPLATE.CREATE_REQUIRED", "TEMPLATE.UPDATE_REQUIRED", "TEMPLATE.NOT_FOUND", "TEMPLATE.SCOPE_INVALID", "TEMPLATE.SCOPE_NOT_ALLOWED", "TEMPLATE.ORG_SCOPE_DENIED", "TEMPLATE.FIELD_REQUIRED", "TEMPLATE.FIELD_TOO_LONG", "TEMPLATE.NAME_EXISTS", "TEMPLATE.UNKNOWN_PROBE_VALUE", "TEMPLATE.UNKNOWN_STRATEGY_VALUE", "JWT.EXPIRED", "JWT.SIGNATURE", "JWT.STRUCTURE", "JWT.MISSING_CLAIMS", "JWT.UNAVAILABLE", "JWT.CLAIM_INVALID", "JWT.VERIFICATION_FAILED", "PARAM.REPEATED", "PARAM.INT_RANGE", "PROBE.UNKNOWN", "STRATEGY.UNKNOWN", "UPSTREAM.REJECTED", "UPSTREAM.TIMEOUT", "UPSTREAM.TOO_LARGE", "REQUEST.FAILED"

  - `response.message` (string, required)
    Human-readable explanation of the failure and what to change. Distinct from `error`. English.

  - `response.suggestions` (array)
    Optional actionable fix hints. Present when the API includes suggestions for connectivity or security validation failures. For CONFIG.CONNECTIVITY_FAILED at most 3 suggestions of at most 300 characters are returned; detected secrets are redacted, and hosts or IP addresses that do not appear in the submitted config are replaced with `[host]`.

## Response 500 headers (application/json):

  - `X-Correlation-ID` (string)
    Correlation id used for this request (caller-supplied UUID, or a UUID
generated when the request omitted the header). Same value as `supportToken`.

## Response 503:

  - `503` (unknown)
    The API is temporarily unavailable and is not accepting this request. This body is not the error envelope.

## Response 503 fields (application/json):

  - `status` (string, required)
    Enum: "not-ready"

  - `reason` (string, required)
    Why the API is not accepting the request.

## Response 400 examples:

  - `PATH.INVALID_UUID` (unknown)
    {name} is the path parameter that is not a UUID, for example targetId.

  - `CORRELATION.INVALID` (unknown)

  - `PAGE.CURSOR` (unknown)

  - `PARAM.INT_RANGE` (unknown)
    Sample is limit from 1 to 200. Campaign lastN is 1 to 200. Findings lastN is 1 to 10000. The live message substitutes {name} and {max}.

## Response 401 examples:

  - `AUTH.REQUIRED` (unknown)

  - `AUTH.FAILED` (unknown)

  - `AUTH.USER_HEADER_MISMATCH` (unknown)

  - `JWT.EXPIRED` (unknown)

  - `JWT.SIGNATURE` (unknown)

  - `JWT.STRUCTURE` (unknown)

  - `JWT.MISSING_CLAIMS` (unknown)

  - `JWT.UNAVAILABLE` (unknown)

  - `JWT.CLAIM_INVALID` (unknown)

  - `JWT.VERIFICATION_FAILED` (unknown)

## Response 403 examples:

  - `TEMPLATE.ORG_SCOPE_DENIED` (unknown)

  - `AUTH.SERVICE_BOT` (unknown)

  - `AUTH.ORG_MISMATCH` (unknown)

  - `AUTH.INSUFFICIENT_PERMISSIONS` (unknown)

## Response 429 examples:

  - `RATE.LIMITED` (unknown)

## Response 500 examples:

  - `INTERNAL.ERROR` (unknown)

  - `AUTH.PERMISSIONS_UNRESOLVED` (unknown)