Skip to main content
The Code Scans API lets you start scans, poll them, and read findings without using the web app. Every operation is available at two scopes, following the same organization vs. enterprise split as the rest of the v3 API:
  • Organization (/v3/organizations/{org_id}/code-scans/...) operates on a single organization and requires the org-level UseCodeScans (writes) or ViewCodeScans (reads) permission.
  • Enterprise (/v3/enterprise/...) spans every organization in the enterprise and requires the enterprise-level UseAccountCodeScans (writes) or ViewAccountCodeScans (reads) permission. Scan-creation and remediation endpoints still take an org_id in the path because a scan belongs to one organization.
Both scopes authenticate with a service user API key or a personal access token, and share the same request and response shapes.

​
Endpoints

The same operations are also available on /v3beta1/... paths with identical request and response shapes. The table covers the scan workflow; the v3 OpenAPI spec additionally exposes Auto Scan scheduling (POST .../code-scans/{scan_id}/auto-scan) and profile reassignment (PUT .../code-scans/{scan_id}/profile) at both scopes. The steps below use the organization scope; swap in the enterprise paths and permissions if your credential is enterprise-scoped.

​
Typical flow

1

Pick a profile (optional)

Call List Code Scan Profiles and choose a discover-mode profile. Omit the profile for a default security scan.
2

Start the scan

The response is a 201 with the scan record. Keep scan_id. A 409 means the organization’s scan backlog is full; retry later.
3

Poll for completion

Call List Code Scans (filter by repo_name) until the scan’s status is completed (or failed / cancelled). Treat these three as terminal. awaiting_user_input only occurs for interactive scans started from the web app; API-started scans are non-interactive and do not enter it.
4

Read findings

Call List Code Scan Findings with scan_id to page through findings, optionally filtering by severity and status.
5

Remediate

Call Remediate Code Scan Finding to have Devin open a pull request fixing a finding.

​
Ingestion scans

To have Devin triage findings produced by another scanner, create an ingest-mode profile in the web app, upload the scanner’s report through the attachments API (an organization-scoped endpoint that requires the UseDevinSessions org permission in addition to the code-scan permissions), then call Start Ingestion Scan (or the enterprise equivalent) with the profile_id and attachment_urls.