Skip to main content
POST
Start Ingestion Scan

Permissions

Requires a service user or personal access token with the UseCodeScans permission at the organization level.

Behavior

Enqueues an ingestion-mode code scan. Instead of discovering issues from scratch, an ingestion scan takes findings produced elsewhere (for example a SAST report) and has Devin triage and validate them against the repository. The scan is launched asynchronously by the scan dispatcher and attributed to the calling principal. The enterprise-scoped equivalent is Start Ingestion Scan (Enterprise).

Request fields

Provide exactly one of repo_name or repos.
  • repo_name: full repository name, e.g. owner/repo.
  • repos: repositories covered by one multi-repo scan, as a list of objects with repo_name and an optional host (up to 200). The first entry is the scan’s primary repository.
  • profile_id (required): an ingest-mode scan profile. A discover-mode profile is rejected with 400.
  • host: Git host of the repository, if it cannot be inferred.
  • attachment_urls: Devin attachment URLs (for example an exported scanner report) to provide to the scan. Upload files first with the attachments API, which requires the UseDevinSessions permission.
  • effort: normal (default) uses lower model reasoning effort with larger triage and validation batches; deep runs the full pipeline.
  • platform: where the scan’s sessions run, either a platform label configured for the organization (for example linux, windows, or macos) or the name of an outpost pool, case-insensitive. Platforms take priority when a name matches both. Defaults to the organization default.

Errors

  • 400 when profile_id is not an ingestion-mode profile, or platform does not match a configured platform label or outpost pool (the error body lists the available values).
  • 404 when the repository or profile is not visible to the organization.
  • 409 when the organization’s scan backlog is at capacity. Retry later.
  • 422 when both or neither of repo_name and repos are provided, or repos is empty.

Authorizations

Authorization
string
header
required

Service User credential (prefix: cog_)

Path Parameters

org_id
string
required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Body

application/json

Request body for starting an ingestion-mode code scan.

Only accepts an ingestion (ingest-mode) scan profile: the profile is run against the given repository (or repositories).

profile_id
string
required

Ingestion-mode scan profile to run. Must be an ingest profile; non-ingest profiles are rejected with 400.

attachment_urls
string<uri>[] | null

Devin attachment URLs to provide to the scan, e.g. files uploaded via the attachments API. The attachments must belong to the organization being scanned.

Maximum array length: 10
Required string length: 1 - 2083
effort
enum<string> | null

Scan effort: 'normal' (default) uses lower model reasoning effort with larger triage and validation batches; 'deep' runs the full pipeline.

Available options:
normal,
deep
host
string | null

Git host of the repository, if known.

platform
string | null

Where the scan's sessions run: a platform label configured for the organization (e.g. 'linux', 'windows', 'macos') or the name of an outpost (BYOB) pool, case-insensitive; platforms take priority when a name matches both. Omitted means the organization default. Unrecognized values are rejected with a 400 whose error body lists the available platform labels and outpost pool names.

Maximum string length: 128
repo_name
string | null

Full name of the repository to scan. Provide exactly one of repo_name or repos.

repos
ScanRepoRequest · object[] | null

Repositories covered by one scan; the first entry is the scan's primary repository. Provide exactly one of repo_name or repos.

Maximum array length: 200

Response

Successful Response

A single code scan.

created_at
integer
required

When the scan was created (unix seconds).

effort
enum<string>
required

Scan effort: 'normal' uses lower model reasoning effort with larger investigation batches; 'deep' runs the full pipeline.

Available options:
normal,
deep
host
string | null
required

Git host of the repository, if known.

org_id
string
required

Organization the scan belongs to.

profile
CodeScanProfileResponse · object | null
required

Profile the scan ran under, if any.

repo_name
string
required

Primary repository of the scan. Multi-repo scans cover additional repositories not listed here.

scan_id
string
required

Unique identifier for the scan.

scan_type
enum<string>
required

Type of scan, stamped at creation.

Available options:
security,
performance,
db-queries,
test-coverage,
dead-code,
code-quality,
cleanup,
telemetry,
accessibility,
compliance,
general,
migration-docs
status
enum<string>
required

Scan status: waiting, pending, running, awaiting_user_input, completed, failed, or cancelled.

Available options:
waiting,
pending,
running,
awaiting_user_input,
completed,
failed,
cancelled
url
string
required

URL of the scan's page in the Devin webapp.

outpost_pool_id
string | null

Outpost pool the scan's sessions run on, if one is set.

platform
string | null

Hosted platform label the scan's sessions run on. Null when the scan runs on an outpost pool or the organization default.

repo_full_name
string | null

Host-qualified identity of the primary repository (e.g. github.com/org/repo). Null for Perforce depots, which have no git host.