scans
Create and manage scans.
List scans visible to the caller, with optional filters.
List scans visible to the caller, with optional filters.
Create a new source-mode scan.
Kicks off a scan and returns the scan record. When `auto_delta` is true
Look up a scan's status and metadata.
Look up a scan's status and metadata.
Update the scan's name, tags, or project assignment.
Update the scan's name, tags, or project assignment.
Delete a scan and all of its artifacts.
Refuses to delete a scan that's still queued or running — cancel it first.
Cancel a running or queued scan.
Cancel a running or queued scan.
Finish a running scan's research phase now
Ask a running scan's research phase to finish now ('Finish stage now'). The coordinator and any in-flight researcher worker stop at their next agent step boundary and the scan continues to deduplication / review / artifact generation. Idempotent; no-op once the scan is no longer running.
Re-run an existing scan.
Re-run an existing scan.
Trigger a HackerOne-eligibility review against the scan's current findings.
Tier-gated. Requires both `allow_disclosure_tracking` and `allow_h1_review` on the active tier, and the scan must have been created with disclosure tracking enabled. Runs asynchronously — the response confirms the review was started.
Free the scan's on-disk clone(s) without deleting findings.
Free the scan's on-disk clone(s) without deleting findings.
Exhaustiveness check — known routes this scan never probed.
Worker-facing query. Diffs the project's KNOWN url corpus (code/doc/scan discoveries, grouped per host and first path segment) against the routes this scan actually probed (successful active_scan responses). Returns per-area gap lists so the agent can close exhaustiveness gaps before wrapping up. Worker auth is required.
Prior knowledge about this scan's target assets.
Worker-facing query. Returns what earlier scans of the project learned about THIS scan's target assets — discovery notes (schemas, endpoint semantics, auth quirks), the tech fingerprint, and discovered_from provenance. A split worker's local database has no project_assets rows, so this is how its coordinator sees the asset library. Worker auth is required.
Record one completed HTTP response (any status) as a probe observation.
Worker-facing endpoint. Every completed http_request response — including 401/404/5xx — lands here as a response-class probe record, the substrate behind surface coverage's tested / blocked / missing / error distinction. Deliberately separate from the discoveries endpoint: probes never mint asset rows, but an auth-walled route stops masquerading as 'never touched' and becomes blocked-route signal. Re-probes of the same URL in the same scan upsert (latest status wins, count accumulates). Worker auth is required.
Record a proven reachability path between two known assets.
Worker-facing endpoint. Records a directed ``can_reach`` edge — evidence that one asset in the scan's project can reach another (gateway fronts an internal admin port, SSRF reveals an internal endpoint). The edge is temporal: re-observation refreshes its verification stamp and resurrects a stale edge; at scan completion, edges the scan did NOT re-verify decay to ``stale`` (they are never deleted — a closed path is itself a finding). Both assets must already exist in the scan's project. Worker auth is required.
Record a discovery the worker observed during this scan.
Worker-facing endpoint. The scan's worker calls this whenever it observes a new URL during a scan. The endpoint resolves the scan to its project, applies the project's blacklist, then dedups the observation by canonical URL. ``source_scan_id`` is set server-side from the path. Worker auth is required (the public Bearer-token flow does not work here).
Walk the scan's log messages and record every URL/host match as a discovery.
Worker-facing backfill for the discovery feed. Parses every ``scan_logs.message`` for URL and ``host:port`` patterns, runs each match through the same dedup + blacklist path as ``/discoveries``, and returns the resulting rows.
List a scan's findings with a severity-count summary.
List a scan's findings with a severity-count summary.