Record a proven reachability path between two known assets.

POST 
/v1/scans/:scan_id/reachability

Worker-facing endpoint. Records a directed can_reach edge — evidence that one asset in the scan's project can reach another (gateway fronts an internal admin port, SSRF reveals an internal endpoint). The edge is temporal: re-observation refreshes its verification stamp and resurrects a stale edge; at scan completion, edges the scan did NOT re-verify decay to stale (they are never deleted — a closed path is itself a finding). Both assets must already exist in the scan's project. Worker auth is required.

Request

Responses

200

Edge recorded or refreshed; returns the edge row.

400

Malformed payload.

401

Missing or invalid bearer token.

404

Unknown scan, or an asset id not found in the scan's project.