# List code repositories

List code repositories scoped to a project, served from target_summary joined with hierarchy_lookup.

Endpoint: GET /sto/api/v2/repositories
Version: 1.0
Security: 

## Query parameters:

  - `accountId` (string, required)
    Harness Account ID
    Example: "abcdef1234567890ghijkl"

  - `orgId` (string, required)
    Harness Organization ID
    Example: "example_org"

  - `projectId` (string, required)
    Harness Project ID
    Example: "example_project"

  - `page` (integer)
    Page number to fetch (starting from 0)
    Example: 4

  - `pageSize` (integer)
    Number of results per page
    Example: 50

  - `sort` (string)
    Field to sort by. 'severity' sorts on the sum of open occurrence counts for critical, high, medium, and low only (CHML — same vulnerability total shown on the main page; info and unassigned are excluded). 'lastScanAt' sorts on the most recent scan timestamp.
    Enum: "severity", "lastScanAt"

  - `order` (string)
    Sort direction. Defaults to DESC so that, under the default lastScanAt sort, the most recently scanned repositories appear first.
    Enum: "ASC", "DESC"

  - `search` (string)
    Case-insensitive substring match on the repository (target) name. Empty/absent means no name filter.
    Example: "nodegoat"

  - `source` (string)
    Keep repositories whose source is in this comma-separated set (IN). Values are matched as stored in target_summary (e.g. Github, Gitlab, Harness — same casing the UI sends). Empty/absent means no source filter.
    Example: "Github,Gitlab"

  - `scanTypes` (string)
    Keep repositories that have any of these comma-separated scan types (array overlap) against target_summary.scan_types. Empty/absent means no scan-type filter. Values are free text in the DB (e.g. SAST, SCA, DAST, SECRET, IAC, CONTAINER), so this is pattern-bounded rather than enum-constrained to avoid drift as new scan types are added.
    Example: "SAST,SCA"

  - `severity` (string)
    Keep repositories with a non-zero occurrence count (>0) for any of these comma-separated severities — the same vulnerability count shown on the main page. Empty/absent means no severity filter.
    Example: "critical,high"

## Response 200 fields (application/json):

  - `pagination` (object, required)
    Example: {"link":"","page":4,"pageSize":20,"totalItems":230,"totalPages":12}

  - `pagination.link` (string)
    Link-based paging

  - `pagination.page` (integer, required)
    Page number (starting from 0)
    Example: 4

  - `pagination.pageSize` (integer, required)
    Requested page size
    Example: 20

  - `pagination.totalItems` (integer, required)
    Total results available
    Example: 230

  - `pagination.totalPages` (integer, required)
    Total pages available
    Example: 12

  - `results` (array, required)
    Example: [{"id":"abcdef1234567890ghijkl","isBaseline":true,"issueSeverityCounts":{"critical":3,"high":4,"info":1,"low":2,"medium":5,"unassigned":0},"lastScanAt":1751793300000,"name":"NodeGoat","occurrenceSeverityCounts":{"critical":3,"high":4,"info":1,"low":2,"medium":5,"unassigned":0},"scanType":{"SAST":["bandit"],"SCA":["snyk","twistlock"]},"source":"Github","targetName":"main","targetVariantId":"abcdef1234567890ghijkl","url":"https://github.com/example/repo"},{"id":"abcdef1234567890ghijkl","isBaseline":true,"issueSeverityCounts":{"critical":3,"high":4,"info":1,"low":2,"medium":5,"unassigned":0},"lastScanAt":1751793300000,"name":"NodeGoat","occurrenceSeverityCounts":{"critical":3,"high":4,"info":1,"low":2,"medium":5,"unassigned":0},"scanType":{"SAST":["bandit"],"SCA":["snyk","twistlock"]},"source":"Github","targetName":"main","targetVariantId":"abcdef1234567890ghijkl","url":"https://github.com/example/repo"},{"id":"abcdef1234567890ghijkl","isBaseline":true,"issueSeverityCounts":{"critical":3,"high":4,"info":1,"low":2,"medium":5,"unassigned":0},"lastScanAt":1751793300000,"name":"NodeGoat","occurrenceSeverityCounts":{"critical":3,"high":4,"info":1,"low":2,"medium":5,"unassigned":0},"scanType":{"SAST":["bandit"],"SCA":["snyk","twistlock"]},"source":"Github","targetName":"main","targetVariantId":"abcdef1234567890ghijkl","url":"https://github.com/example/repo"}]

  - `results.id` (string, required)
    Target id
    Example: "abcdef1234567890ghijkl"

  - `results.isBaseline` (boolean)
    Whether this variant is the repository's baseline (target_summary.is_baseline).
    Example: true

  - `results.issueSeverityCounts` (object, required)
    Counts by severity, sourced from target_summary.
    Example: {"critical":3,"high":4,"info":1,"low":2,"medium":5,"unassigned":0}

  - `results.issueSeverityCounts.critical` (integer, required)
    Critical severity count
    Example: 3

  - `results.issueSeverityCounts.high` (integer, required)
    High severity count
    Example: 4

  - `results.issueSeverityCounts.info` (integer, required)
    Info severity count
    Example: 1

  - `results.issueSeverityCounts.low` (integer, required)
    Low severity count
    Example: 2

  - `results.issueSeverityCounts.medium` (integer, required)
    Medium severity count
    Example: 5

  - `results.issueSeverityCounts.unassigned` (integer, required)
    Unassigned severity count

  - `results.lastScanAt` (integer)
    Timestamp of the most recent scan, in milliseconds since Unix epoch (no server-side formatting; the UI formats it). Sortable. Null when the repository has never been scanned.
    Example: 1751793300000

  - `results.name` (string, required)
    Repository (target) name
    Example: "NodeGoat"

  - `results.occurrenceSeverityCounts` (object, required)
    Counts by severity, sourced from target_summary.
    Example: {"critical":3,"high":4,"info":1,"low":2,"medium":5,"unassigned":0}

  - `results.scanType` (object, required)
    Scan types present for this repository mapped to the scanners that produced them, from target_summary.scan_type_scanners (e.g. {"SAST": ["bandit"], "SCA": ["snyk"]}). Keys are the distinct scan types; the UI derives the scan-type count and any display label from them.
    Example: {"SAST":["bandit"],"SCA":["snyk","twistlock"]}

  - `results.source` (string)
    Origin/source of the repository (e.g. the SCM integration). Filterable via the source filter. Stored and returned with UI casing (e.g. Github, Gitlab, Harness). Null when target_summary.source is not set.
    Example: "Github"

  - `results.targetName` (string)
    Variant name — target_summary.variant_name for this row (e.g. branch name). Null when not set.
    Example: "main"

  - `results.targetVariantId` (string)
    Target variant id — target_summary.variant_id for this row. Null when not set.
    Example: "abcdef1234567890ghijkl"

  - `results.url` (string)
    Repository URL (the git clone/browse URL). Sourced from the chosen variant's last scan's git_metadata.RepositoryHTTP when available (the URL the scanner actually cloned), falling back to target.url. Null when neither is set. target_summary does not store it, so it is joined in from target/scan.
    Example: "https://github.com/example/repo"

## Response 400 fields (application/json):

  - `message` (string, required)
    Example: "Not Found"

  - `status` (integer)
    Example: 404