Read report metadata

GET

/organizations/{organization_id}/whistleblower/reports/{id}.json

const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/reports/example.json';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://secure.ethicsportal.eu/organizations/example/whistleblower/reports/example.json \
  --header 'Authorization: Bearer <token>'

Read the metadata of one report: status, assignment, acknowledgement and feedback deadlines, and overdue flags. Report content is never returned. A personal token reads only a report its user can open; any other report returns 404. An organisation token reads every report.

Authorizations

personalToken
reports:read
organizationToken
reports:read

Parameters

Path Parameters

organization_id

required

string

Obfuscated organisation ID returned by identity.

required

string

Obfuscated report ID; not the reporter access code.

Header Parameters

If-None-Match

string

The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail.

Responses

200

Metadata only. Dates describe recorded workflow state, not proof of notification delivery.

application/json

object

required

string

organization_id

required

string

status

required

string

Allowed values: received acknowledged feedback_given closed

assigned

required

boolean

created_at

required

string format: date-time

acknowledged_at

required

string | null format: date-time

feedback_given_at

required

string | null format: date-time

closed_at

required

string | null format: date-time

acknowledgment_due_at

required

string format: date-time

feedback_due_at

required

string format: date-time

acknowledgment_overdue

required

boolean

feedback_overdue

required

boolean

url

required

string format: uri

web_url

required

string format: uri

audit_trail_url

required

string format: uri

Example

{
  "id": "aBcDef",
  "organization_id": "gHiJkl",
  "status": "received",
  "assigned": false,
  "created_at": "2026-11-07T10:00:00Z",
  "acknowledged_at": null,
  "feedback_given_at": null,
  "closed_at": null,
  "acknowledgment_due_at": "2026-11-14T10:00:00Z",
  "feedback_due_at": "2027-02-14T10:00:00Z",
  "acknowledgment_overdue": false,
  "feedback_overdue": false,
  "url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef.json",
  "web_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef",
  "audit_trail_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef/audit-log.json"
}

Headers

ETag

string

Weak validator of this response body. Send it back as If-None-Match.

304

Not modified since the ETag sent in If-None-Match. No body.

400

Invalid query or cursor

application/json

object

error

required

object

code

required

string

Allowed values: invalid_token forbidden insufficient_scope not_found invalid_request agreement_required rate_limited idempotency_key_reused idempotency_key_in_progress not_retryable channel_inactive invitation_unavailable already_subscribed no_subscription

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "invalid_request",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

401

Missing, invalid, expired or revoked bearer token

application/json

object

error

required

object

code

required

string

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "invalid_token",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

Headers

WWW-Authenticate

string

Bearer realm=“EthicsPortal”

403

Required agreement not accepted or permission denied

application/json

object

error

required

object

code

required

string

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "agreement_required",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

404

Missing or inaccessible organisation or resource, or feature disabled

application/json

object

error

required

object

code

required

string

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "not_found",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

429

Rate limit exceeded

application/json

object

error

required

object

code

required

string

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "rate_limited",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

Headers

Retry-After

string

60 seconds