Start Ingestion Scan (Devin API)
Start an ingestion-mode Devin code scan that triages findings from an external scanner using an ingest profile via the v3 organization API
Permissions
Requires a service user or personal access token with theUseCodeScans permission at the organization level.
Behavior
Enqueues an ingestion-mode code scan. Instead of discovering issues from scratch, an ingestion scan takes findings produced elsewhere (for example a SAST report) and has Devin triage and validate them against the repository. The scan is launched asynchronously by the scan dispatcher and attributed to the calling principal. The enterprise-scoped equivalent is Start Ingestion Scan (Enterprise).Request fields
repo_name(required): full repository name, e.g.owner/repo.profile_id(required): aningest-mode scan profile. Adiscover-mode profile is rejected with400.host: Git host of the repository, if it cannot be inferred.attachment_urls: Devin attachment URLs (for example an exported scanner report) to provide to the scan. Upload files first with the attachments API, which requires theUseDevinSessionspermission.
Errors
400whenprofile_idis not an ingestion-mode profile.404when the repository or profile is not visible to the organization.409when the organization’s scan backlog is at capacity. Retry later.
Authorizations
Service User credential (prefix: cog_)
Path Parameters
Organization ID (prefix: org-)
"org-abc123def456"
Body
Request body for starting an ingestion-mode code scan.
Only accepts an ingestion (ingest-mode) scan profile: the profile is run against the given repository.
Ingestion-mode scan profile to run. Must be an ingest profile; non-ingest profiles are rejected with 400.
Full name of the repository to scan.
Devin attachment URLs to provide to the scan, e.g. files uploaded via the attachments API. The attachments must belong to the organization being scanned.
101 - 2083Git host of the repository, if known.
Response
Successful Response
A single code scan.
When the scan was created (unix seconds).
Git host of the repository, if known.
Organization the scan belongs to.
Profile the scan ran under, if any.
Primary repository of the scan. Multi-repo scans cover additional repositories not listed here.
Unique identifier for the scan.
Type of scan, stamped at creation.
security, performance, db-queries, test-coverage, dead-code, code-quality, telemetry, accessibility, general, migration-docs Scan status: waiting, pending, running, awaiting_user_input, completed, failed, or cancelled.
waiting, pending, running, awaiting_user_input, completed, failed, cancelled 
