> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devinenterprise.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Start Code Scan (Devin API)

> Start a new Devin code scan on a repository via the v3 organization API, optionally with a scan profile or commit SHA

## Permissions

Requires a [service user](/api-reference/v3/service-users/members-service-users) or [personal access token](/api-reference/personal-access-tokens) with the `UseCodeScans` permission at the organization level.

## Behavior

Enqueues a new code scan for `repo_name` in the organization. The scan is launched asynchronously by the scan dispatcher; the response is the scan record with an initial `status` of `waiting` or `pending`. Poll [List Code Scans](/api-reference/v3/code-scans/organizations-code-scans-list) to track progress, and [List Code Scan Findings](/api-reference/v3/code-scans/organizations-code-scans-findings) (filtered by `scan_id`) to read results once the scan reaches `completed`.

The scan is attributed to the calling principal (the service user or PAT that made the request). The enterprise-scoped equivalent is [Start Code Scan (Enterprise)](/api-reference/v3/code-scans/enterprise-code-scans-start).

### Request fields

* `repo_name` (required): full repository name, e.g. `owner/repo`. The repository must already be accessible through the organization's Git integration.
* `host`: Git host of the repository, if it cannot be inferred.
* `profile_id`: a [scan profile](/api-reference/v3/code-scans/organizations-code-scans-profiles) to apply. Use [Start Ingestion Scan](/api-reference/v3/code-scans/organizations-code-scans-start-ingestion) for `ingest`-mode profiles.
* `scan_type`: type of scan to run. Must match the profile's scan type when `profile_id` is given. Defaults to the profile's type, or `security` for profile-less scans. Non-security scan types require a profile.
* `commit_sha`: commit to check out before scanning. Defaults to the repository's default branch head.

### Errors

* `400` when `scan_type` conflicts with the profile, or a non-security `scan_type` is given without a profile.
* `403` when the organization is restricted to ingestion-only scans and no `ingest`-mode profile is given.
* `404` when the repository or profile is not visible to the organization.
* `409` when the organization's scan backlog is at capacity. Retry later.


## OpenAPI

````yaml v3-openapi.yaml POST /v3/organizations/{org_id}/code-scans
openapi: 3.1.0
info:
  description: Devin v3 API with Service User authentication and RBAC
  title: Devin API v3
  version: 3.0.0
servers: []
security:
  - bearerAuth: []
paths:
  /v3/organizations/{org_id}/code-scans:
    post:
      tags:
        - code-scans
      summary: Start Code Scan
      description: |-
        Start a new code scan on a repository in the organization.

        The scan is enqueued and launched asynchronously by the scan dispatcher.
        The scan is attributed to the calling principal (the service user or PAT
        that made the request). Returns ``409`` when the organization's scan
        backlog is at capacity.
      operationId: handle_start_code_scan_v3_organizations__org_id__code_scans_post
      parameters:
        - description: 'Organization ID (prefix: org-)'
          in: path
          name: org_id
          required: true
          schema:
            example: org-abc123def456
            title: Org Id
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CodeScanCreateRequest'
        required: true
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CodeScanResponse'
          description: Successful Response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unauthorized
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Forbidden
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Not Found
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Conflict
        '422':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Unprocessable Content
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProblemDetail'
          description: Too Many Requests
components:
  schemas:
    CodeScanCreateRequest:
      description: Request body for starting a new code scan.
      properties:
        commit_sha:
          anyOf:
            - type: string
            - type: 'null'
          description: Commit to check out before scanning.
          title: Commit Sha
        host:
          anyOf:
            - type: string
            - type: 'null'
          description: Git host of the repository, if known.
          title: Host
        profile_id:
          anyOf:
            - type: string
            - type: 'null'
          description: Scan profile to apply to the scan.
          title: Profile Id
        repo_name:
          description: Full name of the repository to scan.
          title: Repo Name
          type: string
        scan_type:
          anyOf:
            - enum:
                - security
                - performance
                - db-queries
                - test-coverage
                - dead-code
                - code-quality
                - telemetry
                - accessibility
                - general
                - migration-docs
              type: string
            - type: 'null'
          description: >-
            Type of scan to run. Must match the profile's scan type when a
            profile is given; defaults to the profile's type, or 'security' for
            profile-less scans. Non-security types require a profile and are
            rejected without one.
          title: Scan Type
      required:
        - repo_name
      title: CodeScanCreateRequest
      type: object
    CodeScanResponse:
      description: A single code scan.
      properties:
        created_at:
          description: When the scan was created (unix seconds).
          title: Created At
          type: integer
        host:
          anyOf:
            - type: string
            - type: 'null'
          description: Git host of the repository, if known.
          title: Host
        org_id:
          description: Organization the scan belongs to.
          title: Org Id
          type: string
        profile:
          anyOf:
            - $ref: '#/components/schemas/CodeScanProfileResponse'
            - type: 'null'
          description: Profile the scan ran under, if any.
        repo_name:
          description: >-
            Primary repository of the scan. Multi-repo scans cover additional
            repositories not listed here.
          title: Repo Name
          type: string
        scan_id:
          description: Unique identifier for the scan.
          title: Scan Id
          type: string
        scan_type:
          description: Type of scan, stamped at creation.
          enum:
            - security
            - performance
            - db-queries
            - test-coverage
            - dead-code
            - code-quality
            - telemetry
            - accessibility
            - general
            - migration-docs
          title: Scan Type
          type: string
        status:
          description: >-
            Scan status: waiting, pending, running, awaiting_user_input,
            completed, failed, or cancelled.
          enum:
            - waiting
            - pending
            - running
            - awaiting_user_input
            - completed
            - failed
            - cancelled
          title: Status
          type: string
      required:
        - scan_id
        - org_id
        - repo_name
        - host
        - status
        - profile
        - scan_type
        - created_at
      title: CodeScanResponse
      type: object
    ProblemDetail:
      description: >-
        RFC 9457 application/problem+json error body for the v3 API.


        detail is retained from the legacy {"detail": ...} body for back-compat;
        the

        other members are additive. errors carries field-level validation
        failures

        (422 only).
      properties:
        detail:
          anyOf:
            - type: string
            - type: 'null'
          description: A human-readable explanation specific to this occurrence.
          title: Detail
        errors:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          description: Field-level validation errors (422 responses only).
          title: Errors
        instance:
          anyOf:
            - type: string
            - type: 'null'
          description: A URI reference (the request path) for this occurrence.
          title: Instance
        status:
          description: The HTTP status code.
          title: Status
          type: integer
        title:
          description: A short, human-readable summary of the problem type.
          title: Title
          type: string
        type:
          default: about:blank
          description: A URI reference identifying the problem type.
          title: Type
          type: string
      required:
        - title
        - status
      title: ProblemDetail
      type: object
    CodeScanProfileResponse:
      description: Summary of the profile a scan ran under.
      properties:
        name:
          description: Name of the profile.
          title: Name
          type: string
        profile_id:
          description: Unique identifier for the profile.
          title: Profile Id
          type: string
      required:
        - profile_id
        - name
      title: CodeScanProfileResponse
      type: object
  securitySchemes:
    bearerAuth:
      description: 'Service User credential (prefix: cog_)'
      scheme: bearer
      type: http

````