POST /v1/scans

Create scan. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Immutable snapshot · Download OpenAPI specification

Read pinned handler: apps/api/kodesec_api/main.py:4632

Create scan

Create scan through POST /v1/scans. The parameters and declared response shapes below come from this exact source snapshot.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Browser operator session or exact IDE capability with scan:create. Route-specific ownership and generation checks also apply.

Browser mutations require the exact control Origin and session-bound CSRF header. IDE callers use only their admitted route scope and exact generation.

Inspect the authority source · Authentication guide

Parameters and headers

Name	Location	Contract
`X-CSRF-Token`	header Conditional / optional	Required for browser mutations with the exact control Origin. Not an IDE capability. Schema `{ "type": "string" }`
`Idempotency-Key`	header Required	Required for command submission; for bulk findings, only the triage action. Stable key for the same exact command, beginning with a letter or digit. Reuse with different content conflicts. Schema `{ "maxLength": 160, "minLength": 8, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$", "type": "string" }`

Request body

JSON body · required · ScanCreate

Field	Type	Presence
`acknowledge_limited_coverage`	boolean	Optional
`base_ref`	string \| null	Optional
`coverage`	string	Optional
`head_ref`	string \| null	Optional
`mode`	string	Optional
`preflight_revision`	string \| null	Optional
`project_id`	integer	Required
`source_snapshot_digest`	string \| null	Optional
`target_kind`	string \| null	Optional
`target_path`	string \| null	Optional
`use_ai`	boolean	Optional

Complete declared request schema

{
  "properties": {
    "acknowledge_limited_coverage": {
      "default": false,
      "title": "Acknowledge Limited Coverage",
      "type": "boolean"
    },
    "base_ref": {
      "anyOf": [
        {
          "maxLength": 160,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Base Ref"
    },
    "coverage": {
      "default": "complete",
      "enum": [
        "complete",
        "limited"
      ],
      "title": "Coverage",
      "type": "string"
    },
    "head_ref": {
      "anyOf": [
        {
          "maxLength": 160,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Head Ref"
    },
    "mode": {
      "default": "full",
      "enum": [
        "full",
        "incremental_diff"
      ],
      "title": "Mode",
      "type": "string"
    },
    "preflight_revision": {
      "anyOf": [
        {
          "maxLength": 64,
          "minLength": 64,
          "pattern": "^[0-9a-f]{64}$",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Preflight Revision"
    },
    "project_id": {
      "title": "Project Id",
      "type": "integer"
    },
    "source_snapshot_digest": {
      "anyOf": [
        {
          "maxLength": 64,
          "minLength": 64,
          "pattern": "^[0-9a-f]{64}$",
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Source Snapshot Digest"
    },
    "target_kind": {
      "anyOf": [
        {
          "enum": [
            "file",
            "directory"
          ],
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Target Kind"
    },
    "target_path": {
      "anyOf": [
        {
          "maxLength": 4096,
          "minLength": 1,
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "title": "Target Path"
    },
    "use_ai": {
      "default": false,
      "title": "Use Ai",
      "type": "boolean"
    }
  },
  "required": [
    "project_id"
  ],
  "title": "ScanCreate",
  "type": "object"
}

Responses

Status	Meaning and declared shape
`202`	Successful Response application/json · ScanOut { "properties": { "base_ref": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "title": "Base Ref" }, "completed_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "title": "Completed At" }, "created_at": { "format": "date-time", "title": "Created At", "type": "string" }, "duration_ms": { "anyOf": [ { "type": "integer" }, { "type": "null" } ], "title": "Duration Ms" }, "error": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "title": "Error" }, "findings_revision": { "default": 1, "title": "Findings Revision", "type": "integer" }, "gate_decision": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "title": "Gate Decision" }, "gate_reasons": { "items": { "type": "string" }, "title": "Gate Reasons", "type": "array" }, "head_ref": { "anyOf": [ { "type": "string" }, { "type": "null" } ], "title": "Head Ref" }, "id": { "title": "Id", "type": "integer" }, "job_id": { "anyOf": [ { "type": "integer" }, { "type": "null" } ], "title": "Job Id" }, "job_revision": { "anyOf": [ { "type": "integer" }, { "type": "null" } ], "title": "Job Revision" }, "mode": { "title": "Mode", "type": "string" }, "project_id": { "title": "Project Id", "type": "integer" }, "revision": { "default": 1, "title": "Revision", "type": "integer" }, "scanner_summary": { "additionalProperties": true, "title": "Scanner Summary", "type": "object" }, "source_snapshot": { "anyOf": [ { "$ref": "#/components/schemas/ScanSourceSnapshotOut" }, { "type": "null" } ] }, "started_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "title": "Started At" }, "status": { "title": "Status", "type": "string" } }, "required": [ "id", "project_id", "mode", "base_ref", "head_ref", "status", "gate_decision", "gate_reasons", "scanner_summary", "error", "created_at", "started_at", "completed_at", "duration_ms" ], "title": "ScanOut", "type": "object" }
`400`	Exact host, malformed request or URL credential refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`401`	Missing or invalid membership application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`403`	Exact origin, CSRF or route authority refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`404`	Refresh the collection and verify the resource identity before retrying. See source-linked error catalog.
`409`	Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.
`422`	Validation Error application/json · HTTPValidationError `{ "properties": { "detail": { "items": { "$ref": "#/components/schemas/ValidationError" }, "title": "Detail", "type": "array" } }, "title": "HTTPValidationError", "type": "object" }`
`429`	Authentication rate or connection limit application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`503`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness. See source-linked error catalog.

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

24 source error observations

Status	Source detail	Recovery
404 ↗	`project not found`	Refresh the collection and verify the resource identity before retrying.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`idempotent scan command no longer has its scan resource`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
422 ↗	`Dynamic detail; inspect source`	Correct the field or semantic validation error. Input values are omitted from control validation errors.
422 ↗	`Dynamic detail; inspect source`	Correct the field or semantic validation error. Input values are omitted from control validation errors.
409 ↗	`idempotent scan command no longer has its scan resource`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Idempotency-Key is already bound to a different command`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
422 ↗	`Dynamic detail; inspect source`	Correct the field or semantic validation error. Input values are omitted from control validation errors.
409 ↗	`the selected Advisor provider no longer exists`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
503 ↗	`Dynamic detail; inspect source`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
503 ↗	`Dynamic detail; inspect source`	Check readiness and the recorded job state. A healthy control plane does not prove scanner readiness.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
409 ↗	`Dynamic detail; inspect source`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
404 ↗	`scanner tool not found`	Refresh the collection and verify the resource identity before retrying.
422 ↗	`command payload must be an object`	Correct the field or semantic validation error. Input values are omitted from control validation errors.
401 ↗	`authentication required`	Reconcile the exact browser or IDE membership through the normal owner workflow.
422 ↗	`Idempotency-Key must contain 8-160 ASCII letters, digits, '.', '_', ':', or '-'`	Correct the field or semantic validation error. Input values are omitted from control validation errors.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON

{
  "project_id": 1
}

Response 202 JSON

{
  "base_ref": "synthetic",
  "completed_at": "2026-01-01T00:00:00Z",
  "created_at": "2026-01-01T00:00:00Z",
  "duration_ms": 1,
  "error": "synthetic",
  "gate_decision": "synthetic",
  "gate_reasons": [],
  "head_ref": "synthetic",
  "id": 1,
  "mode": "synthetic",
  "project_id": 1,
  "scanner_summary": {},
  "started_at": "2026-01-01T00:00:00Z",
  "status": "synthetic"
}

Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.