---
title: "Submit libraries for vulnerability scanning"
method: POST
path: "/api/v2/static-analysis-sca/dependencies/scan"
tags: ["Static Analysis"]
---

# Submit libraries for vulnerability scanning

`POST /api/v2/static-analysis-sca/dependencies/scan`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/static-analysis-sca/dependencies/scan`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `code_analysis_read`

## Request body

- McpScanRequest: The top-level request object for submitting an MCP SCA dependency scan.
  - `data` McpScanRequestData, required: The data object in an MCP SCA scan request, containing the scan attributes and request type.
    - `attributes` McpScanRequestDataAttributes, required: The attributes of an MCP SCA scan request, describing the libraries to scan and their context.
      - `commit_hash` string, required: The commit hash of the source code being scanned.
      - `libraries` McpScanRequestDataAttributesLibrariesItems[], required: The list of libraries to scan for vulnerabilities.
        - `exclusions` string[]: The list of dependency PURLs to exclude when resolving transitive dependencies for this library.
        - `is_dev` boolean, required: Whether this library is a development-only dependency.
        - `is_direct` boolean, required: Whether this library is a direct (rather than transitive) dependency.
        - `package_manager` string, required: The package manager that produced this library entry (for example, `npm`, `pip`, `nuget`).
        - `purl` string, required: The Package URL (PURL) uniquely identifying the library and its version.
        - `target_frameworks` string[]: The list of target framework identifiers associated with the library.
      - `resource_name` string, required: The name of the resource (typically the repository or project name) being scanned.
    - `id` string: An optional identifier for this scan request.
    - `type` 'mcpscanrequest', required: The type identifier for MCP SCA scan requests.

## Response `202`

Accepted

- McpScanRequestResponse: The top-level response object returned when an MCP SCA dependency scan request has been accepted.
  - `data` McpScanRequestResponseData, required: The data object returned when a scan request has been accepted.
    - `attributes` McpScanRequestResponseDataAttributes, required: The attributes returned when a scan request has been accepted, containing the job identifier used to poll for results.
      - `job_id` string, required: The job identifier assigned to the scan, used to retrieve the scan result.
    - `id` string, required: The job identifier assigned to the scan.
    - `type` 'mcpscanrequestresponse', required: The type identifier for MCP SCA scan request responses.

## Other responses

- `400`: Bad Request
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)