---
title: "Start scan"
method: POST
path: "/api/v1/tools/start_scan"
tags: ["guarded"]
---

# Start scan

`POST /api/v1/tools/start_scan`

## Request

- Base URL: `https://www.affiliatespy.io`
- URL: `https://www.affiliatespy.io/api/v1/tools/start_scan`
- Auth: HTTP bearer

Start a creator scan for an app (spends scan credits). Same gates as the dashboard: active subscription required, and a queued/running scan for the app refuses with scan_in_progress. Guarded: without approval_token it returns {error:"approval_required", approval_token, summary} for the user to confirm; call again with the token. Every dashboard guardrail still applies: this is exactly what a user clicking the dashboard could do, no more. GUARDED: requires the account's Unrestricted MCP setting; returns 403 {error:'restricted'} otherwise.

## Request body

- object
  - `app_id` string, uuid, required: An app id from list_apps.
  - `type` 'quick' | 'full', required: quick = fast pass; full = complete scan.
  - `approval_token` string: Approval token from a previous approval_required response, after the user said yes.

## Response `200`

The tool's JSON result (same payload the MCP tool returns).

- unknown

## Other responses

- `400`: Arguments failed validation; body lists the issues.
- `401`: Missing or invalid API key.
- `403`: Guarded tool with Unrestricted MCP off.
- `429`: Rate limited (60 requests per minute per key).

---

[API](https://skmtc.dev/affiliatespy/apis/affiliatespy-api.md) · [All operations](https://skmtc.dev/affiliatespy/apis/affiliatespy-api/llms.txt) · [OpenAPI document](https://skmtc.dev/affiliatespy/apis/affiliatespy-api/revisions/0300d370b356?raw)