Skip to main content
POST
Start Ingestion Scan

Permissions

Requires a service user or personal access token with the UseCodeScans permission at the organization level.

Behavior

Enqueues an ingestion-mode code scan. Instead of discovering issues from scratch, an ingestion scan takes findings produced elsewhere (for example a SAST report) and has Devin triage and validate them against the repository. The scan is launched asynchronously by the scan dispatcher and attributed to the calling principal. The enterprise-scoped equivalent is Start Ingestion Scan (Enterprise).

Request fields

  • repo_name (required): full repository name, e.g. owner/repo.
  • profile_id (required): an ingest-mode scan profile. A discover-mode profile is rejected with 400.
  • host: Git host of the repository, if it cannot be inferred.
  • attachment_urls: Devin attachment URLs (for example an exported scanner report) to provide to the scan. Upload files first with the attachments API, which requires the UseDevinSessions permission.

Errors

  • 400 when profile_id is not an ingestion-mode profile.
  • 404 when the repository or profile is not visible to the organization.
  • 409 when the organization’s scan backlog is at capacity. Retry later.

Authorizations

Authorization
string
header
required

Service User credential (prefix: cog_)

Path Parameters

org_id
string
required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Body

application/json

Request body for starting an ingestion-mode code scan.

Only accepts an ingestion (ingest-mode) scan profile: the profile is run against the given repository.

profile_id
string
required

Ingestion-mode scan profile to run. Must be an ingest profile; non-ingest profiles are rejected with 400.

repo_name
string
required

Full name of the repository to scan.

attachment_urls
string<uri>[] | null

Devin attachment URLs to provide to the scan, e.g. files uploaded via the attachments API. The attachments must belong to the organization being scanned.

Maximum array length: 10
Required string length: 1 - 2083
host
string | null

Git host of the repository, if known.

Response

Successful Response

A single code scan.

created_at
integer
required

When the scan was created (unix seconds).

host
string | null
required

Git host of the repository, if known.

org_id
string
required

Organization the scan belongs to.

profile
CodeScanProfileResponse · object | null
required

Profile the scan ran under, if any.

repo_name
string
required

Primary repository of the scan. Multi-repo scans cover additional repositories not listed here.

scan_id
string
required

Unique identifier for the scan.

scan_type
enum<string>
required

Type of scan, stamped at creation.

Available options:
security,
performance,
db-queries,
test-coverage,
dead-code,
code-quality,
telemetry,
accessibility,
general,
migration-docs
status
enum<string>
required

Scan status: waiting, pending, running, awaiting_user_input, completed, failed, or cancelled.

Available options:
waiting,
pending,
running,
awaiting_user_input,
completed,
failed,
cancelled