Start Code Scan (Devin API)
Start a new Devin code scan on a repository via the v3 organization API, optionally with a scan profile or commit SHA
Permissions
Requires a service user or personal access token with theUseCodeScans permission at the organization level.
Behavior
Enqueues a new code scan forrepo_name in the organization. The scan is launched asynchronously by the scan dispatcher; the response is the scan record with an initial status of waiting or pending. Poll List Code Scans to track progress, and List Code Scan Findings (filtered by scan_id) to read results once the scan reaches completed.
The scan is attributed to the calling principal (the service user or PAT that made the request). The enterprise-scoped equivalent is Start Code Scan (Enterprise).
Request fields
repo_name(required): full repository name, e.g.owner/repo. The repository must already be accessible through the organization’s Git integration.host: Git host of the repository, if it cannot be inferred.profile_id: a scan profile to apply. Use Start Ingestion Scan foringest-mode profiles.scan_type: type of scan to run. Must match the profile’s scan type whenprofile_idis given. Defaults to the profile’s type, orsecurityfor profile-less scans. Non-security scan types require a profile.commit_sha: commit to check out before scanning. Defaults to the repository’s default branch head.
Errors
400whenscan_typeconflicts with the profile, or a non-securityscan_typeis given without a profile.403when the organization is restricted to ingestion-only scans and noingest-mode profile is given.404when the repository or profile is not visible to the organization.409when the organization’s scan backlog is at capacity. Retry later.
Authorizations
Service User credential (prefix: cog_)
Path Parameters
Organization ID (prefix: org-)
"org-abc123def456"
Body
Request body for starting a new code scan.
Full name of the repository to scan.
Commit to check out before scanning.
Git host of the repository, if known.
Scan profile to apply to the scan.
Type of scan to run. Must match the profile's scan type when a profile is given; defaults to the profile's type, or 'security' for profile-less scans. Non-security types require a profile and are rejected without one.
security, performance, db-queries, test-coverage, dead-code, code-quality, telemetry, accessibility, general, migration-docs Response
Successful Response
A single code scan.
When the scan was created (unix seconds).
Git host of the repository, if known.
Organization the scan belongs to.
Profile the scan ran under, if any.
Primary repository of the scan. Multi-repo scans cover additional repositories not listed here.
Unique identifier for the scan.
Type of scan, stamped at creation.
security, performance, db-queries, test-coverage, dead-code, code-quality, telemetry, accessibility, general, migration-docs Scan status: waiting, pending, running, awaiting_user_input, completed, failed, or cancelled.
waiting, pending, running, awaiting_user_input, completed, failed, cancelled 
