Record a discovery the worker observed during this scan.
POST/v1/scans/:scan_id/discoveries
Worker-facing endpoint. The scan's worker calls this whenever it observes a new URL during a scan. The endpoint resolves the scan to its project, applies the project's blacklist, then dedups the observation by canonical URL. source_scan_id is set server-side from the path. Worker auth is required (the public Bearer-token flow does not work here).
Request
Responses
- 200
- 204
- 400
- 401
Discovery recorded (or merged into an existing row). The response body is the asset row; deduped is true when an existing row was matched.
Discovery was dropped — the URL matched a blacklist pattern, or the scan is in a source_review project, or the scan isn't bound to a project. The worker should not retry.
Malformed request — missing or invalid fields.
Missing or invalid bearer token.