Lomo CodeSecurity

The API reference is in English.

Immutable source snapshot

POST /runs

Start run. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Current reference · Download OpenAPI specification

Private service protocols are unsupported for external integration. Their schemas describe source declarations; they are not public service endpoints.

Read pinned handler: services/scanner/kodesec_scanner/main.py:1506

Start run

Start run through POST /runs. The parameters and declared response shapes below come from this exact source snapshot.

Internal protocol; unsupported for external integration. This page makes no request to a local installation.

Authority

Private service protocol. No public or third-party integration authority.

Inspect the authority source · Authentication guide

Parameters and headers

No explicit path, query or header parameters are declared here. The authority boundary still applies.

Request body

JSON body · required · RunStartRequest

FieldTypePresence
base_refstring | nullOptional
enabled_toolsarrayRequired
head_refstring | nullOptional
modestringOptional
repo_pathstringRequired
run_idstringRequired
scan_idintegerRequired
source_snapshot_digeststring | nullOptional
target_kindstring | nullOptional
target_pathstring | nullOptional
Complete declared request schema
{
  "additionalProperties": false,
  "properties": {
    "base_ref": {
      "anyOf": [
        {
          "maxLength": 255,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Base Ref"
    },
    "enabled_tools": {
      "items": {
        "maxLength": 64,
        "minLength": 1,
        "type": "string"
      },
      "maxItems": 32,
      "minItems": 1,
      "title": "Enabled Tools",
      "type": "array"
    },
    "head_ref": {
      "anyOf": [
        {
          "maxLength": 255,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Head Ref"
    },
    "mode": {
      "default": "full",
      "enum": [
        "full",
        "incremental_diff"
      ],
      "title": "Mode",
      "type": "string"
    },
    "repo_path": {
      "maxLength": 4096,
      "minLength": 1,
      "title": "Repo Path",
      "type": "string"
    },
    "run_id": {
      "format": "uuid",
      "title": "Run Id",
      "type": "string"
    },
    "scan_id": {
      "exclusiveMinimum": 0,
      "maximum": 2147483647,
      "title": "Scan Id",
      "type": "integer"
    },
    "source_snapshot_digest": {
      "anyOf": [
        {
          "pattern": "^[0-9a-f]{64}$",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Source Snapshot Digest"
    },
    "target_kind": {
      "anyOf": [
        {
          "enum": [
            "file",
            "directory"
          ],
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Target Kind"
    },
    "target_path": {
      "anyOf": [
        {
          "maxLength": 4096,
          "minLength": 1,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Target Path"
    }
  },
  "required": [
    "scan_id",
    "repo_path",
    "enabled_tools",
    "run_id"
  ],
  "title": "RunStartRequest",
  "type": "object"
}

Responses

StatusMeaning and declared shape
202

Successful Response

application/json · RunStateResponse
{
  "additionalProperties": false,
  "properties": {
    "created_at": {
      "format": "date-time",
      "title": "Created At",
      "type": "string"
    },
    "deadline_at": {
      "format": "date-time",
      "title": "Deadline At",
      "type": "string"
    },
    "error_code": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Error Code"
    },
    "error_detail": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Error Detail"
    },
    "expires_at": {
      "anyOf": [
        {
          "format": "date-time",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Expires At"
    },
    "finished_at": {
      "anyOf": [
        {
          "format": "date-time",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Finished At"
    },
    "request_digest": {
      "pattern": "^[0-9a-f]{64}$",
      "title": "Request Digest",
      "type": "string"
    },
    "result_available": {
      "default": false,
      "title": "Result Available",
      "type": "boolean"
    },
    "result_manifest": {
      "anyOf": [
        {
          "$ref": "#/components/schemas/RunResultManifest"
        },
        {
          "type": "null"
        }
      ]
    },
    "run_id": {
      "format": "uuid",
      "title": "Run Id",
      "type": "string"
    },
    "started_at": {
      "anyOf": [
        {
          "format": "date-time",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Started At"
    },
    "status": {
      "enum": [
        "queued",
        "running",
        "cancelling",
        "completed",
        "failed",
        "cancelled"
      ],
      "title": "Status",
      "type": "string"
    }
  },
  "required": [
    "run_id",
    "request_digest",
    "status",
    "created_at",
    "deadline_at"
  ],
  "title": "RunStateResponse",
  "type": "object"
}
409

Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.

422

Validation Error

application/json · HTTPValidationError
{
  "properties": {
    "detail": {
      "items": {
        "$ref": "#/components/schemas/ValidationError"
      },
      "title": "Detail",
      "type": "array"
    }
  },
  "title": "HTTPValidationError",
  "type": "object"
}

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

2 source error observations
StatusSource detailRecovery
409 ↗{"code":"run_id_conflict","message":"run_id is already bound to a different request"}Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗{"code":"scanner_capacity","message":"scanner active-run capacity is exhausted"}Refresh current revision and identity. A conflicting command must not be blindly repeated.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON
{
  "enabled_tools": [
    "synthetic"
  ],
  "repo_path": "/workspace/synthetic-demo",
  "run_id": "00000000-0000-4000-8000-000000000001",
  "scan_id": 1
}
Response 202 JSON
{
  "created_at": "2026-01-01T00:00:00Z",
  "deadline_at": "2026-01-01T00:00:00Z",
  "request_digest": "0000000000000000000000000000000000000000000000000000000000000000",
  "run_id": "00000000-0000-4000-8000-000000000001",
  "status": "queued"
}
Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.