List report metadata

GET

/organizations/{organization_id}/whistleblower/reports.json

const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/reports.json?limit=50&status=received';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://secure.ethicsportal.eu/organizations/example/whistleblower/reports.json?limit=50&status=received' \
  --header 'Authorization: Bearer <token>'

List report metadata for one organisation: status, assignment, deadlines and overdue flags. Filter by status or creation date and page with a cursor. A personal token lists only the reports its user can open: every report for administrators and viewers, and for members only the reports assigned to them or in which they participate. An organisation token lists every report.

Authorizations

personalToken
reports:read
organizationToken
reports:read

Parameters

Path Parameters

organization_id

required

string

Obfuscated organisation ID returned by identity.

Query Parameters

limit

integer

default: 50 >= 1 <= 100

cursor

string

Follow the Link response header unchanged. Signed cursor expires after one hour.

status

string

Allowed values: received acknowledged feedback_given closed

created_after

string format: date-time

Exclusive lower receipt-time bound.

created_before

string format: date-time

Exclusive upper receipt-time bound.

Header Parameters

If-None-Match

string

The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail.

Responses

200

Metadata only. Dates describe recorded workflow state, not proof of notification delivery.

application/json

object

data

required

Array<object>

<= 100 items

object

required

string

organization_id

required

string

status

required

string

Allowed values: received acknowledged feedback_given closed

assigned

required

boolean

created_at

required

string format: date-time

acknowledged_at

required

string | null format: date-time

feedback_given_at

required

string | null format: date-time

closed_at

required

string | null format: date-time

acknowledgment_due_at

required

string format: date-time

feedback_due_at

required

string format: date-time

acknowledgment_overdue

required

boolean

feedback_overdue

required

boolean

url

required

string format: uri

web_url

required

string format: uri

audit_trail_url

required

string format: uri

next_cursor

required

Pass as the cursor parameter for the next page; null on the last page. The Link header carries the same next page.

string | null

Example

{
  "data": [
    {
      "id": "aBcDef",
      "organization_id": "gHiJkl",
      "status": "received",
      "assigned": false,
      "created_at": "2026-11-07T10:00:00Z",
      "acknowledged_at": null,
      "feedback_given_at": null,
      "closed_at": null,
      "acknowledgment_due_at": "2026-11-14T10:00:00Z",
      "feedback_due_at": "2027-02-14T10:00:00Z",
      "acknowledgment_overdue": false,
      "feedback_overdue": false,
      "url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef.json",
      "web_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef",
      "audit_trail_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef/audit-log.json"
    }
  ],
  "next_cursor": null
}

Headers

ETag

string

Weak validator of this response body. Send it back as If-None-Match.

304

Not modified since the ETag sent in If-None-Match. No body.

400

Invalid query or cursor

application/json

object

error

required

object

code

required

string

Allowed values: invalid_token forbidden insufficient_scope not_found invalid_request agreement_required rate_limited idempotency_key_reused idempotency_key_in_progress not_retryable channel_inactive invitation_unavailable already_subscribed no_subscription

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "invalid_request",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

401

Missing, invalid, expired or revoked bearer token

application/json

object

error

required

object

code

required

string

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "invalid_token",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

Headers

WWW-Authenticate

string

Bearer realm=“EthicsPortal”

403

Required agreement not accepted or permission denied

application/json

object

error

required

object

code

required

string

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "agreement_required",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

404

Missing or inaccessible organisation or resource, or feature disabled

application/json

object

error

required

object

code

required

string

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "not_found",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

429

Rate limit exceeded

application/json

object

error

required

object

code

required

string

feedback_url

required

Where to tell EthicsPortal what went wrong: POST product feedback here with the same token.

string format: uri

Example

{
  "error": {
    "code": "rate_limited",
    "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json"
  }
}

Headers

Retry-After

string

60 seconds