Skip to content
GitmoapAPIBeta
Shipcatalog
GET/catalog/scorecards/{scorecard_id}/results

List a scorecard's results, worst state first

list_scorecard_results
  • catalog:read
    A token needs the catalog:read scope: Read the service catalog: services, their bindings, their owners and their overviewsGranted by read_api, write_api.Every operation this scope unlocks
  • Single-resource

    x-gitmoap-isolation: {"kind":"single_or_self_scoped"}

  • Paginated
    Pass the next_token a page returns to get the next one.

Returns one result per service and check, failing first, then stale, expired, unknown, passing and not applicable. Beside the page sits a summary over the whole scorecard, never just the page: how many services reach each level and how many are not scored at all. Filter by state, check_key or service_id; page with limit and next_token.

Parameters

Path
  • scorecard_idScorecardId (string · uuid)The scorecard's id
Query
  • statestringoptionalFilter to one check state
  • check_keystringoptionalFilter to one check
  • service_idstringoptionalFilter to one service. summary is unaffected and stays scorecard-wide, so a per-service count is folded from items — which with this filter is that service's complete result set
  • limitinteger · int32optionalPage size (clamped)
  • next_tokenstringoptionalOpaque pagination cursor

Responses

200The results, with a scorecard-wide summary of scored and unscored services beside themapplication/json
  • itemsarray of ServiceCheckResult
    • The ServiceCheckResult schema
    • check_keyCheckKey (string)
    • evaluated_atstring
    • scorecard_idScorecardId (string · uuid)
    • service_idServiceId (string · uuid)
    • stateCheckStatefailingstaleexpiredunknownpassingnot_applicableWhat a check currently says about a service, listed worst first. failing: the check does not hold. stale: the evidence that used to prove it no longer does. expired: an attestation whose renewal window has passed. unknown: never evaluated. passing: the check holds. not_applicable: the check does not apply to this service, so it does not count against it.
    • attested_atstring or nulloptional
    • attested_byActorSummary or nulloptional
    • detailobjectoptional
    • evidence_atstring or nulloptional
    • evidence_commit_shaCommitHash (string) or nulloptional
    • evidence_pipeline_idPipelineId (string · uuid) or nulloptional
    • evidence_run_idPipelineRunId (string · uuid) or nulloptional
    • expires_atstring or nulloptional
    • flappingbooleanoptionalWhether the check has changed state ten times today, after which further changes are not recorded until tomorrow. Read it as "this check is not trustworthy": a threshold set at the noise floor, or a test that is not deterministic.
    • observed_valuenumber · double or nulloptional
  • summaryScorecardAggregate
    • The ScorecardAggregate schema
    • scoredScoredPartition
      • The ScoredPartition schema
      • checksCheckStateCountsSummed over every scored service's checks.
      • totalinteger · int320–∞
      • unleveledinteger · int320–∞Services reaching no level at all — including every service on a scorecard with no levels.
      • by_levelobjectoptionalServices at each named level. Absent levels are absent keys, not zeroes.
    • unscoredUnscoredPartition
      • The UnscoredPartition schema
      • externalinteger · int320–∞Services marked external, which the platform cannot measure.
      • totalinteger · int320–∞
      • reasonstring or nulloptionalWhy nothing could be derived, in one phrase a page can render beside the number.
  • next_tokenstring or nulloptional
200 exampleSynthesized example
{
"items": [
{
"check_key": "check-key-2a73",
"evaluated_at": "2026-10-11T11:21:03Z",
"scorecard_id": "0493fbea-b176-44b7-92a3-b227580504e8",
"service_id": "518c6684-64f4-46aa-923d-d1c4fc5c85b8",
"state": "failing"
},
{
"check_key": "check-key-028b",
"evaluated_at": "2026-10-11T09:44:16Z",
"scorecard_id": "73d72a42-6261-410a-9413-a4ac70a49edf",
"service_id": "f95306b2-ab57-4b08-aec1-c65a12b7656d",
"state": "failing"
}
],
"summary": {
"scored": {
"checks": {
"expired": 57,
"failing": 87,
"not_applicable": 44,
"passing": 88,
"stale": 32,
"unknown": 24
},
"total": 4,
"unleveled": 26,
"by_level": {}
},
"unscored": {
"external": 14,
"total": 5,
"reason": "reason-60c5"
}
},
"next_token": "next-token-a077"
}
400Invalid filter or cursorapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-6bdc",
"message": "Draw the region map from operation density"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-162d",
"message": "Stream pipeline status into the run header"
}
}
403Forbidden — the caller's access level or token scope is insufficientapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-4c96",
"message": "Pin a page's payload to the build that rendered it"
}
}
404No such scorecard, or it is not visibleapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-205b",
"message": "Draw the region map from operation density"
}
}

CLI

gitmoap catalog list-scorecard-results

  • --scorecard-ididThe scorecard's id
  • --check-keystringoptionalFilter to one check
  • --limitnumberoptionalPage size (clamped)
  • --next-tokenstringoptionalOpaque pagination cursor
  • --service-idstringoptionalFilter to one service. `summary` is unaffected and stays scorecard-wide, so a per-service count is folded from `items` — which with this filter is that service's complete result set
  • --statestringoptionalFilter to one check state

Used in these guides