Skip to main content
POST
Start Ingestion Scan

Permissions

Requires a service user or personal access token with the UseAccountCodeScans permission at the enterprise level.

Behavior

Enqueues an ingestion-mode code scan. Instead of discovering issues from scratch, an ingestion scan takes findings produced elsewhere (for example a SAST report) and has Devin triage and validate them against the repository. The scan is launched asynchronously by the scan dispatcher and attributed to the calling principal.

Request fields

Provide exactly one of repo_name or repos.
  • repo_name: full repository name, e.g. owner/repo.
  • repos: repositories covered by one multi-repo scan, as a list of objects with repo_name and an optional host (up to 200). The first entry is the scan’s primary repository.
  • profile_id (required): an ingest-mode scan profile. A discover-mode profile is rejected with 400.
  • host: Git host of the repository, if it cannot be inferred.
  • attachment_urls: Devin attachment URLs (for example an exported scanner report) to provide to the scan. Upload files first with the attachments API.
  • effort: normal (default) uses lower model reasoning effort with larger triage and validation batches; deep runs the full pipeline.
  • platform: where the scan’s sessions run, either a platform label configured for the organization (for example linux, windows, or macos) or the name of an outpost pool, case-insensitive. Platforms take priority when a name matches both. Defaults to the organization default.

Errors

  • 400 when profile_id is not an ingestion-mode profile, or platform does not match a configured platform label or outpost pool (the error body lists the available values).
  • 404 when the organization, repository, or profile is not visible to the enterprise account.
  • 409 when the organization’s scan backlog is at capacity. Retry later.
  • 422 when both or neither of repo_name and repos are provided, or repos is empty.

Authorizations

Authorization
string
header
required

Service User credential (prefix: cog_)

Path Parameters

org_id
string
required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Body

application/json

Request body for starting an ingestion-mode code scan.

Only accepts an ingestion (ingest-mode) scan profile: the profile is run against the given repository (or repositories).

profile_id
string
required

Ingestion-mode scan profile to run. Must be an ingest profile; non-ingest profiles are rejected with 400.

attachment_urls
string<uri>[] | null

Devin attachment URLs to provide to the scan, e.g. files uploaded via the attachments API. The attachments must belong to the organization being scanned.

Maximum array length: 10
Required string length: 1 - 2083
effort
enum<string> | null

Scan effort: 'normal' (default) uses lower model reasoning effort with larger triage and validation batches; 'deep' runs the full pipeline.

Available options:
normal,
deep
host
string | null

Git host of the repository, if known.

platform
string | null

Where the scan's sessions run: a platform label configured for the organization (e.g. 'linux', 'windows', 'macos') or the name of an outpost (BYOB) pool, case-insensitive; platforms take priority when a name matches both. Omitted means the organization default. Unrecognized values are rejected with a 400 whose error body lists the available platform labels and outpost pool names.

Maximum string length: 128
repo_name
string | null

Full name of the repository to scan. Provide exactly one of repo_name or repos.

repos
ScanRepoRequest · object[] | null

Repositories covered by one scan; the first entry is the scan's primary repository. Provide exactly one of repo_name or repos.

Maximum array length: 200

Response

Successful Response

A single code scan.

created_at
integer
required

When the scan was created (unix seconds).

effort
enum<string>
required

Scan effort: 'normal' uses lower model reasoning effort with larger investigation batches; 'deep' runs the full pipeline.

Available options:
normal,
deep
host
string | null
required

Git host of the repository, if known.

org_id
string
required

Organization the scan belongs to.

profile
CodeScanProfileResponse · object | null
required

Profile the scan ran under, if any.

repo_name
string
required

Primary repository of the scan. Multi-repo scans cover additional repositories not listed here.

scan_id
string
required

Unique identifier for the scan.

scan_type
enum<string>
required

Type of scan, stamped at creation.

Available options:
security,
performance,
db-queries,
test-coverage,
dead-code,
code-quality,
cleanup,
telemetry,
accessibility,
compliance,
general,
migration-docs
status
enum<string>
required

Scan status: waiting, pending, running, awaiting_user_input, completed, failed, or cancelled.

Available options:
waiting,
pending,
running,
awaiting_user_input,
completed,
failed,
cancelled
url
string
required

URL of the scan's page in the Devin webapp.

outpost_pool_id
string | null

Outpost pool the scan's sessions run on, if one is set.

platform
string | null

Hosted platform label the scan's sessions run on. Null when the scan runs on an outpost pool or the organization default.

repo_full_name
string | null

Host-qualified identity of the primary repository (e.g. github.com/org/repo). Null for Perforce depots, which have no git host.