Start Ingestion Scan (Devin API)

Start Ingestion Scan

curl --request POST \
  --url https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "profile_id": "<string>",
  "repo_name": "<string>",
  "attachment_urls": [
    "<string>"
  ],
  "host": "<string>"
}
'

import requests

url = "https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion"

payload = {
    "profile_id": "<string>",
    "repo_name": "<string>",
    "attachment_urls": ["<string>"],
    "host": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    profile_id: '<string>',
    repo_name: '<string>',
    attachment_urls: ['<string>'],
    host: '<string>'
  })
};

fetch('https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'profile_id' => '<string>',
    'repo_name' => '<string>',
    'attachment_urls' => [
        '<string>'
    ],
    'host' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion"

	payload := strings.NewReader("{\n  \"profile_id\": \"<string>\",\n  \"repo_name\": \"<string>\",\n  \"attachment_urls\": [\n    \"<string>\"\n  ],\n  \"host\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"profile_id\": \"<string>\",\n  \"repo_name\": \"<string>\",\n  \"attachment_urls\": [\n    \"<string>\"\n  ],\n  \"host\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"profile_id\": \"<string>\",\n  \"repo_name\": \"<string>\",\n  \"attachment_urls\": [\n    \"<string>\"\n  ],\n  \"host\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "created_at": 123,
  "host": "<string>",
  "org_id": "<string>",
  "profile": {
    "name": "<string>",
    "profile_id": "<string>"
  },
  "repo_name": "<string>",
  "scan_id": "<string>",
  "scan_type": "security",
  "status": "waiting"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

POST

enterprise

organizations

{org_id}

code-scans

ingestion

Start Ingestion Scan

curl --request POST \
  --url https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "profile_id": "<string>",
  "repo_name": "<string>",
  "attachment_urls": [
    "<string>"
  ],
  "host": "<string>"
}
'

import requests

url = "https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion"

payload = {
    "profile_id": "<string>",
    "repo_name": "<string>",
    "attachment_urls": ["<string>"],
    "host": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    profile_id: '<string>',
    repo_name: '<string>',
    attachment_urls: ['<string>'],
    host: '<string>'
  })
};

fetch('https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'profile_id' => '<string>',
    'repo_name' => '<string>',
    'attachment_urls' => [
        '<string>'
    ],
    'host' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion"

	payload := strings.NewReader("{\n  \"profile_id\": \"<string>\",\n  \"repo_name\": \"<string>\",\n  \"attachment_urls\": [\n    \"<string>\"\n  ],\n  \"host\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"profile_id\": \"<string>\",\n  \"repo_name\": \"<string>\",\n  \"attachment_urls\": [\n    \"<string>\"\n  ],\n  \"host\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.devin.ai/v3/enterprise/organizations/{org_id}/code-scans/ingestion")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"profile_id\": \"<string>\",\n  \"repo_name\": \"<string>\",\n  \"attachment_urls\": [\n    \"<string>\"\n  ],\n  \"host\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "created_at": 123,
  "host": "<string>",
  "org_id": "<string>",
  "profile": {
    "name": "<string>",
    "profile_id": "<string>"
  },
  "repo_name": "<string>",
  "scan_id": "<string>",
  "scan_type": "security",
  "status": "waiting"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

{
  "status": 123,
  "title": "<string>",
  "detail": "<string>",
  "errors": [
    {}
  ],
  "instance": "<string>",
  "type": "about:blank"
}

Permissions

Requires a service user or personal access token with the UseAccountCodeScans permission at the enterprise level.

Behavior

Enqueues an ingestion-mode code scan. Instead of discovering issues from scratch, an ingestion scan takes findings produced elsewhere (for example a SAST report) and has Devin triage and validate them against the repository. The scan is launched asynchronously by the scan dispatcher and attributed to the calling principal.

Request fields

repo_name (required): full repository name, e.g. owner/repo.
profile_id (required): an ingest-mode scan profile. A discover-mode profile is rejected with 400.
host: Git host of the repository, if it cannot be inferred.
attachment_urls: Devin attachment URLs (for example an exported scanner report) to provide to the scan. Upload files first with the attachments API.

Errors

400 when profile_id is not an ingestion-mode profile.
404 when the organization, repository, or profile is not visible to the enterprise account.
409 when the organization’s scan backlog is at capacity. Retry later.

Authorizations

Authorization

string

header

required

Service User credential (prefix: cog_)

Path Parameters

org_id

string

required

Organization ID (prefix: org-)

Example:

"org-abc123def456"

Body

application/json

Request body for starting an ingestion-mode code scan.

Only accepts an ingestion (ingest-mode) scan profile: the profile is run against the given repository.

profile_id

string

required

Ingestion-mode scan profile to run. Must be an ingest profile; non-ingest profiles are rejected with 400.

repo_name

string

required

Full name of the repository to scan.

attachment_urls

string<uri>[] | null

Devin attachment URLs to provide to the scan, e.g. files uploaded via the attachments API. The attachments must belong to the organization being scanned.

Maximum array length: 10

Required string length: 1 - 2083

host

string | null

Git host of the repository, if known.

Response

Successful Response

A single code scan.

created_at

integer

required

When the scan was created (unix seconds).

host

string | null

required

Git host of the repository, if known.

org_id

string

required

Organization the scan belongs to.

profile

CodeScanProfileResponse · object | null

required

Profile the scan ran under, if any.

Show child attributes

repo_name

string

required

Primary repository of the scan. Multi-repo scans cover additional repositories not listed here.

scan_id

string

required

Unique identifier for the scan.

scan_type

enum<string>

required

Type of scan, stamped at creation.

Available options:

security,

performance,

db-queries,

test-coverage,

dead-code,

code-quality,

telemetry,

accessibility,

general,

migration-docs

status

enum<string>

required

Scan status: waiting, pending, running, awaiting_user_input, completed, failed, or cancelled.

Available options:

waiting,

pending,

running,

awaiting_user_input,

completed,

failed,

cancelled

⌘I

Getting Started

Concepts

Agent Lifecycle

Context Management

Environment Management

Automation

Integrations

Analytics

Observability

Devin for Security

Infrastructure

Identity & Access

Configuration

Legacy API v1

Legacy API v2

Start Ingestion Scan (Devin API)

Permissions

Behavior

Request fields

Errors

Authorizations

Path Parameters

Body

Response

​Permissions

​Behavior

​Request fields

​Errors

Authorizations

Path Parameters

Body

Response

Permissions

Behavior

Request fields

Errors