Start a scan
const url = 'https://api.devsecure.io/v1/scans';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"type":"code","title":"API scan","description":"example","environment":"prod","repository_id":"example","repository_url":"example","branch":"example","target_url":"example","dast_profile":"baseline","api_definition_url":"example","image_ref":"ghcr.io/acme/app:1.4.2","registry_credentials":{"username":"example","password":"example"}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.devsecure.io/v1/scans \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "type": "code", "title": "API scan", "description": "example", "environment": "prod", "repository_id": "example", "repository_url": "example", "branch": "example", "target_url": "example", "dast_profile": "baseline", "api_definition_url": "example", "image_ref": "ghcr.io/acme/app:1.4.2", "registry_credentials": { "username": "example", "password": "example" } }'Starts a code, DAST, container or pentest scan and returns it with status queued. The scope needed depends on type. DAST targets must be authorised for the workspace and pentest targets approved by a person. Quotas and plan limits apply as in the dashboard.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Header Parameters
Section titled “Header Parameters”Makes the request safe to retry for 24 hours. Same key and same request: the first response is replayed. Same key, different request: 409 idempotency_conflict.
Request Bodyrequired
Section titled “Request Bodyrequired”Start a scan. Which fields apply depends on type.
object
Dast only.
object
Responses
Section titled “Responses”Accepted.
object
object
Example
{ "id": "1042", "type": "code", "provider": "github", "title": "Nightly scan", "status": "queued", "environment": "prod", "repository": { "id": "repo_3f9a0c2d4b1e8f7a6c5d4e3f", "provider": "github", "name": "acme/payments-api" }}Headers
Section titled “Headers”Identifies the request; quote it to support.
Requests allowed per window.
Requests left in the window.
Seconds until the window resets.
The request is not valid (validation_error, invalid_cursor).
object
Example
{ "error": { "code": "validation_error", "message": "The request is not valid.", "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d" }}Headers
Section titled “Headers”Identifies the request; quote it to support.
Missing, unknown, expired or revoked credential (invalid_credentials).
object
Example
{ "error": { "code": "invalid_credentials", "message": "The credential is missing, invalid, expired or revoked.", "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d" }}Headers
Section titled “Headers”Identifies the request; quote it to support.
The credential may not do this (insufficient_scope, permission_denied, plan_not_allowed, quota_exceeded, target_not_authorized).
object
Example
{ "error": { "code": "insufficient_scope", "message": "The credential does not have the scope this operation needs.", "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d" }}Headers
Section titled “Headers”Identifies the request; quote it to support.
Conflicts with the current state or an earlier Idempotency-Key (conflict, idempotency_conflict).
object
Example
{ "error": { "code": "idempotency_conflict", "message": "This Idempotency-Key was already used for a different request.", "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d" }}Headers
Section titled “Headers”Identifies the request; quote it to support.
Too many requests (rate_limited).
object
Example
{ "error": { "code": "rate_limited", "message": "Too many requests. Retry after the time in Retry-After.", "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d" }}Headers
Section titled “Headers”Identifies the request; quote it to support.
Requests allowed per window.
Requests left in the window.
Seconds until the window resets.
Seconds to wait before retrying.
Unexpected error (internal_error). Quote the request id to support.
object
Example
{ "error": { "code": "internal_error", "message": "Something went wrong on our side.", "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d" }}Headers
Section titled “Headers”Identifies the request; quote it to support.
Not available yet in this deployment (not_implemented).
object
Example
{ "error": { "code": "not_implemented", "message": "This operation is not available yet.", "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d" }}Headers
Section titled “Headers”Identifies the request; quote it to support.
A DevSecure service this operation needs did not answer (upstream_unavailable).
object
Example
{ "error": { "code": "upstream_unavailable", "message": "A service this operation needs is unavailable. Try again later.", "request_id": "req_3f0c2a9d5b6e4f7a8c1d2e3f4a5b6c7d" }}Headers
Section titled “Headers”Identifies the request; quote it to support.