> ## Documentation Index
> Fetch the complete documentation index at: https://docs.devinenterprise.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Triggering Code Scans via the Devin API

> Guide to starting Devin code scans programmatically, polling their status, and reading findings with the v3 organization and enterprise APIs

The Code Scans API lets you start scans, poll them, and read findings without using the web app. Every operation is available at two scopes, following the same [organization vs. enterprise split](/api-reference/v3/overview) as the rest of the v3 API:

* **Organization** (`/v3/organizations/{org_id}/code-scans/...`) operates on a single organization and requires the org-level `UseCodeScans` (writes) or `ViewCodeScans` (reads) permission.
* **Enterprise** (`/v3/enterprise/...`) spans every organization in the enterprise and requires the enterprise-level `UseAccountCodeScans` (writes) or `ViewAccountCodeScans` (reads) permission. Scan-creation and remediation endpoints still take an `org_id` in the path because a scan belongs to one organization.

Both scopes authenticate with a [service user](/api-reference/v3/service-users/members-service-users) API key or a [personal access token](/api-reference/personal-access-tokens), and share the same request and response shapes.

## Endpoints

| Operation                   | Organization                                                                                                    | Enterprise                                                                                                          |
| --------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Start Code Scan             | [`POST /v3/organizations/{org_id}/code-scans`](/api-reference/v3/code-scans/organizations-code-scans-start)     | [`POST /v3/enterprise/organizations/{org_id}/code-scans`](/api-reference/v3/code-scans/enterprise-code-scans-start) |
| Start Ingestion Scan        | [`POST .../code-scans/ingestion`](/api-reference/v3/code-scans/organizations-code-scans-start-ingestion)        | [`POST .../code-scans/ingestion`](/api-reference/v3/code-scans/enterprise-code-scans-start-ingestion)               |
| List Code Scans             | [`GET /v3/organizations/{org_id}/code-scans/scans`](/api-reference/v3/code-scans/organizations-code-scans-list) | [`GET /v3/enterprise/code-scans/scans`](/api-reference/v3/code-scans/enterprise-code-scans-list)                    |
| List Code Scan Profiles     | [`GET .../code-scans/profiles`](/api-reference/v3/code-scans/organizations-code-scans-profiles)                 | [`GET /v3/enterprise/code-scans/profiles`](/api-reference/v3/code-scans/enterprise-code-scans-profiles)             |
| Get Code Scan Profile       | [`GET .../code-scans/profiles/{profile_id}`](/api-reference/v3/code-scans/organizations-code-scans-profile)     | [`GET /v3/enterprise/code-scans/profiles/{profile_id}`](/api-reference/v3/code-scans/enterprise-code-scans-profile) |
| List Code Scan Findings     | [`GET .../code-scans/findings`](/api-reference/v3/code-scans/organizations-code-scans-findings)                 | [`GET /v3/enterprise/code-scans/findings`](/api-reference/v3/code-scans/enterprise-code-scans-findings)             |
| Get Code Scan Metrics       | [`GET .../code-scans/metrics`](/api-reference/v3/code-scans/organizations-code-scans-metrics)                   | [`GET /v3/enterprise/code-scans/metrics`](/api-reference/v3/code-scans/enterprise-code-scans-metrics)               |
| Remediate Code Scan Finding | [`POST .../findings/{finding_id}/remediate`](/api-reference/v3/code-scans/organizations-code-scans-remediate)   | [`POST .../findings/{finding_id}/remediate`](/api-reference/v3/code-scans/enterprise-code-scans-remediate)          |

The same operations are also available on `/v3beta1/...` paths with identical request and response shapes. The table covers the scan workflow; the v3 OpenAPI spec additionally exposes Auto Scan scheduling (`POST .../code-scans/{scan_id}/auto-scan`) and profile reassignment (`PUT .../code-scans/{scan_id}/profile`) at both scopes.

The steps below use the organization scope; swap in the enterprise paths and permissions if your credential is enterprise-scoped.

## Typical flow

<Steps>
  <Step title="Pick a profile (optional)">
    Call [List Code Scan Profiles](/api-reference/v3/code-scans/organizations-code-scans-profiles) and choose a `discover`-mode profile. Omit the profile for a default security scan.
  </Step>

  <Step title="Start the scan">
    ```bash theme={null}
    curl -X POST "https://api.devin.ai/v3/organizations/$ORG_ID/code-scans" \
      -H "Authorization: Bearer $DEVIN_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{"repo_name": "acme/payments"}'
    ```

    The response is a `201` with the scan record. Keep `scan_id`. A `409` means the organization's scan backlog is full; retry later.
  </Step>

  <Step title="Poll for completion">
    Call [List Code Scans](/api-reference/v3/code-scans/organizations-code-scans-list) (filter by `repo_name`) until the scan's `status` is `completed` (or `failed` / `cancelled`). Treat these three as terminal. `awaiting_user_input` only occurs for interactive scans started from the web app; API-started scans are non-interactive and do not enter it.
  </Step>

  <Step title="Read findings">
    Call [List Code Scan Findings](/api-reference/v3/code-scans/organizations-code-scans-findings) with `scan_id` to page through findings, optionally filtering by `severity` and `status`.
  </Step>

  <Step title="Remediate">
    Call [Remediate Code Scan Finding](/api-reference/v3/code-scans/organizations-code-scans-remediate) to have Devin open a pull request fixing a finding.
  </Step>
</Steps>

## Ingestion scans

To have Devin triage findings produced by another scanner, create an `ingest`-mode profile in the web app, upload the scanner's report through the [attachments API](/api-reference/v3/attachments/post-organizations-attachments) (an organization-scoped endpoint that requires the `UseDevinSessions` org permission in addition to the code-scan permissions), then call [Start Ingestion Scan](/api-reference/v3/code-scans/organizations-code-scans-start-ingestion) (or the [enterprise equivalent](/api-reference/v3/code-scans/enterprise-code-scans-start-ingestion)) with the `profile_id` and `attachment_urls`.