---
title: "UpdateScanRequest"
method: PATCH
path: "/v1/namespaces/{object.tenant_meta.namespace}/scan-requests"
tags: ["ScanRequestService"]
---

# UpdateScanRequest

`PATCH /v1/namespaces/{object.tenant_meta.namespace}/scan-requests`

## Request

- Base URL: `https://api.endorlabs.com`
- URL: `https://api.endorlabs.com/v1/namespaces/{object.tenant_meta.namespace}/scan-requests`
- Auth: none declared

Updates a scan request with the information in the request
body.

## Path parameters

- `object.tenant_meta.namespace` string, required

## Request body

- ScanRequestServiceUpdateScanRequestBody: Request to update the scan request.
  - `object` object: ScanRequest represents a request to scan a particular PR and is only used by the system.
    - `meta` V1Meta: Common fields for all Endor Labs resources.
      - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller.
      - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
      - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key.
      - `description` string: Resource description. Must be less than 1024 bytes.
      - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object.
        - `data` string[]
        - `search_score` number, float: search_score is the score of the resource for search. Internal use only.
        - `tenant` string
        - `will_be_deleted_at` string, date-time: Time that the resource will be deleted.
      - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name().
      - `name` string, required: Resource name. Must be 63 characters or less.
      - `parent_kind` string: Parent object resource kind, for example, Project.
      - `parent_uuid` string: Parent object UUID.
      - `references` object: Map of objects referenced in a query API.
      - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less.
      - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
      - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509.
      - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
      - `version` string: Message version.
    - `spec` V1ScanRequestSpec
      - `azure_payload` V1AzurePayload: AzurePayload carries SCM-specific webhook data for an Azure DevOps-originated scan. Mirrors GitHubPayload so downstream components (e.g., AI SAST baseline lookup) can recover the originating PR number on merge-to-main webhook events where pull_request_id is intentionally blank.
        - `pull_request_payload` object: pull_request_payload contains the raw Azure DevOps pull request Service Hook payload as JSON. The originating PR number lives at "resource.pullRequestId".
      - `bitbucket_payload` V1BitbucketPayload: BitbucketPayload carries SCM-specific webhook data for a Bitbucket-originated scan (Bitbucket Cloud or Bitbucket Data Center). Mirrors GitHubPayload so downstream components (e.g., AI SAST baseline lookup) can recover the originating PR number on merge-to-main webhook events where pull_request_id is intentionally blank.
        - `pull_request_payload` object: pull_request_payload contains the raw Bitbucket pull request webhook payload as JSON. The originating PR number lives at "pullrequest.id" (Bitbucket Cloud) or "pullRequest.id" (Bitbucket Data Center).
      - `commit_sha` string: The commit sha of the request that will be checked out.
      - `external_scm_reference` string: external_reference to the ID of the SCM tool that has initiated this requested.
      - `finding_refresh` SpecFindingRefresh: FindingRefresh carries metadata specific to SCAN_REQUEST_TYPE_FINDING_REFRESH requests. Unset for all other scan-request types.
        - `ingestion_time` string, date-time: ingestion_time is the OSS IngestionState watermark (last_vuln_ingestion_time or last_malware_ingestion_time) that triggered this finding-refresh. It correlates the scan back to its ingestion event and drives end-to-end latency tracking.
        - `trigger` 'TRIGGER_UNSPECIFIED' | 'TRIGGER_VULN' | 'TRIGGER_MALWARE': Trigger identifies which ingestion type caused this finding-refresh. - TRIGGER_UNSPECIFIED: No trigger has been set. - TRIGGER_VULN: A vulnerability ingestion triggered this finding-refresh. - TRIGGER_MALWARE: A malware ingestion triggered this finding-refresh.
      - `github_payload` V1GitHubPayload: GitHubPayload carries SCM-specific webhook data for a GitHub-originated scan.
        - `pull_request_payload` object: pull_request_payload contains the GitHub Pull Request payload associated with this scan request, when available. This allows downstream components (e.g., security review scanner) to avoid refetching PR data from GitHub and instead map this JSON to internal structures on demand.
      - `gitlab_payload` V1GitlabPayload: GitlabPayload carries SCM-specific webhook data for a GitLab-originated scan. Mirrors GitHubPayload so downstream components (e.g., AI SAST baseline lookup) can recover the originating MR number on merge-to-main webhook events where pull_request_id is intentionally blank.
        - `merge_request_payload` object: merge_request_payload contains the raw GitLab merge request webhook payload as JSON. The originating MR number lives at "object_attributes.iid".
      - `installation_uuid` string: Specifies the UUID of the installation.
      - `is_on_premise` boolean: is_on_premise specifies if this scan request is processed by scheduler on premise.
      - `origin` 'SCAN_REQUEST_ORIGIN_UNSPECIFIED' | 'SCAN_REQUEST_ORIGIN_GITHUB' | 'SCAN_REQUEST_ORIGIN_GITLAB' | 'SCAN_REQUEST_ORIGIN_BITBUCKET' | 'SCAN_REQUEST_ORIGIN_AZURE'
      - `pr_check_run_conclusion` string: pr_check_run_conclusion is the conclusion of the PR check run.
      - `pr_run_uuid` string: pr_run_uuid is the UUID of the PR run that executed this request.
      - `project_uuid` string: Specifies the UUID of the project.
      - `pull_request_id` string: The PR for which this request is been created. If no PR is provided, it is assumed that this is merge to the default branch and it will be executed with the --pr flag.
      - `ref` string: The ref of the base branch that the PR is being merged into.
      - `request_full_scan` boolean: request_full_scan is a flag to indicate if the scan should be a full scan.
      - `request_pr_comments` boolean: request_pr_comments is a flag to indicate if the scan should comment on the PR.
      - `request_pr_incremental` boolean: request_pr_incremental is a flag to request a PR incremental scan.
      - `request_rescan` boolean: request_rescan is a flag to request rescan.
      - `result` SpecScanRequestResult
        - `ci_run_uuid` string: The execution id of the scan.
        - `scan_time` number, float: scan_time in seconds is the total time to process this scan request calculated in seconds.
        - `status` 'SCAN_REQUEST_RESULT_STATUS_UNSPECIFIED' | 'SCAN_REQUEST_RESULT_STATUS_SUCCESS' | 'SCAN_REQUEST_RESULT_STATUS_FAIL' | 'SCAN_REQUEST_RESULT_STATUS_NEUTRAL' | 'SCAN_REQUEST_RESULT_STATUS_ACTION_REQUIRED'
      - `scheduled_time` string, date-time: scheduled_time is the time at which the scan is scheduled to run.
      - `status` 'SCAN_REQUEST_STATUS_UNSPECIFIED' | 'SCAN_REQUEST_STATUS_QUEUED' | 'SCAN_REQUEST_STATUS_IN_PROGRESS' | 'SCAN_REQUEST_STATUS_COMPLETE' | 'SCAN_REQUEST_STATUS_FAILED'
      - `tenant_name` string: tenant_name is the tenant (and not the namespace) that is the owner of this scan request.
      - `type` 'SCAN_REQUEST_TYPE_UNSPECIFIED' | 'SCAN_REQUEST_TYPE_WEBHOOK' | 'SCAN_REQUEST_TYPE_SCHEDULED' | 'SCAN_REQUEST_TYPE_ANALYTICS' | 'SCAN_REQUEST_TYPE_FINDING_REFRESH': - SCAN_REQUEST_TYPE_UNSPECIFIED: Type is undefined. - SCAN_REQUEST_TYPE_WEBHOOK: SCAN_REQUEST_TYPE_WEBHOOK is a scan is an event driven request. - SCAN_REQUEST_TYPE_SCHEDULED: SCAN_REQUEST_TYPE_SCHEDULE is a periodic schedule scan request. - SCAN_REQUEST_TYPE_ANALYTICS: SCAN_REQUEST_TYPE_ANALYTICS is a request only for analytics. - SCAN_REQUEST_TYPE_FINDING_REFRESH: SCAN_REQUEST_TYPE_FINDING_REFRESH is a lightweight re-evaluation of findings from persisted DependencyMetadata, without a full re-scan of the repository.
    - `tenant_meta` object: ScanRequests are associated with a tenant.
    - `uuid` string: The UUID of the source control scan request.
  - `request` V1UpdateRequest: Message used for all update requests.
    - `force` boolean: Force will force the update of the resource if any checks fail.
    - `update_mask` string: Fields to update. Defaults to all fields.

## Response `200`

A successful response.

- V1ScanRequest: ScanRequest represents a request to scan a particular PR and is only used by the system.
  - `meta` V1Meta, required: Common fields for all Endor Labs resources.
    - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller.
    - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key.
    - `description` string: Resource description. Must be less than 1024 bytes.
    - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object.
      - `data` string[]
      - `search_score` number, float: search_score is the score of the resource for search. Internal use only.
      - `tenant` string
      - `will_be_deleted_at` string, date-time: Time that the resource will be deleted.
    - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name().
    - `name` string, required: Resource name. Must be 63 characters or less.
    - `parent_kind` string: Parent object resource kind, for example, Project.
    - `parent_uuid` string: Parent object UUID.
    - `references` object: Map of objects referenced in a query API.
    - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less.
    - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509.
    - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `version` string: Message version.
  - `spec` V1ScanRequestSpec
    - `azure_payload` V1AzurePayload: AzurePayload carries SCM-specific webhook data for an Azure DevOps-originated scan. Mirrors GitHubPayload so downstream components (e.g., AI SAST baseline lookup) can recover the originating PR number on merge-to-main webhook events where pull_request_id is intentionally blank.
      - `pull_request_payload` object: pull_request_payload contains the raw Azure DevOps pull request Service Hook payload as JSON. The originating PR number lives at "resource.pullRequestId".
    - `bitbucket_payload` V1BitbucketPayload: BitbucketPayload carries SCM-specific webhook data for a Bitbucket-originated scan (Bitbucket Cloud or Bitbucket Data Center). Mirrors GitHubPayload so downstream components (e.g., AI SAST baseline lookup) can recover the originating PR number on merge-to-main webhook events where pull_request_id is intentionally blank.
      - `pull_request_payload` object: pull_request_payload contains the raw Bitbucket pull request webhook payload as JSON. The originating PR number lives at "pullrequest.id" (Bitbucket Cloud) or "pullRequest.id" (Bitbucket Data Center).
    - `commit_sha` string: The commit sha of the request that will be checked out.
    - `external_scm_reference` string: external_reference to the ID of the SCM tool that has initiated this requested.
    - `finding_refresh` SpecFindingRefresh: FindingRefresh carries metadata specific to SCAN_REQUEST_TYPE_FINDING_REFRESH requests. Unset for all other scan-request types.
      - `ingestion_time` string, date-time: ingestion_time is the OSS IngestionState watermark (last_vuln_ingestion_time or last_malware_ingestion_time) that triggered this finding-refresh. It correlates the scan back to its ingestion event and drives end-to-end latency tracking.
      - `trigger` 'TRIGGER_UNSPECIFIED' | 'TRIGGER_VULN' | 'TRIGGER_MALWARE': Trigger identifies which ingestion type caused this finding-refresh. - TRIGGER_UNSPECIFIED: No trigger has been set. - TRIGGER_VULN: A vulnerability ingestion triggered this finding-refresh. - TRIGGER_MALWARE: A malware ingestion triggered this finding-refresh.
    - `github_payload` V1GitHubPayload: GitHubPayload carries SCM-specific webhook data for a GitHub-originated scan.
      - `pull_request_payload` object: pull_request_payload contains the GitHub Pull Request payload associated with this scan request, when available. This allows downstream components (e.g., security review scanner) to avoid refetching PR data from GitHub and instead map this JSON to internal structures on demand.
    - `gitlab_payload` V1GitlabPayload: GitlabPayload carries SCM-specific webhook data for a GitLab-originated scan. Mirrors GitHubPayload so downstream components (e.g., AI SAST baseline lookup) can recover the originating MR number on merge-to-main webhook events where pull_request_id is intentionally blank.
      - `merge_request_payload` object: merge_request_payload contains the raw GitLab merge request webhook payload as JSON. The originating MR number lives at "object_attributes.iid".
    - `installation_uuid` string: Specifies the UUID of the installation.
    - `is_on_premise` boolean: is_on_premise specifies if this scan request is processed by scheduler on premise.
    - `origin` 'SCAN_REQUEST_ORIGIN_UNSPECIFIED' | 'SCAN_REQUEST_ORIGIN_GITHUB' | 'SCAN_REQUEST_ORIGIN_GITLAB' | 'SCAN_REQUEST_ORIGIN_BITBUCKET' | 'SCAN_REQUEST_ORIGIN_AZURE'
    - `pr_check_run_conclusion` string: pr_check_run_conclusion is the conclusion of the PR check run.
    - `pr_run_uuid` string: pr_run_uuid is the UUID of the PR run that executed this request.
    - `project_uuid` string: Specifies the UUID of the project.
    - `pull_request_id` string: The PR for which this request is been created. If no PR is provided, it is assumed that this is merge to the default branch and it will be executed with the --pr flag.
    - `ref` string: The ref of the base branch that the PR is being merged into.
    - `request_full_scan` boolean: request_full_scan is a flag to indicate if the scan should be a full scan.
    - `request_pr_comments` boolean: request_pr_comments is a flag to indicate if the scan should comment on the PR.
    - `request_pr_incremental` boolean: request_pr_incremental is a flag to request a PR incremental scan.
    - `request_rescan` boolean: request_rescan is a flag to request rescan.
    - `result` SpecScanRequestResult
      - `ci_run_uuid` string: The execution id of the scan.
      - `scan_time` number, float: scan_time in seconds is the total time to process this scan request calculated in seconds.
      - `status` 'SCAN_REQUEST_RESULT_STATUS_UNSPECIFIED' | 'SCAN_REQUEST_RESULT_STATUS_SUCCESS' | 'SCAN_REQUEST_RESULT_STATUS_FAIL' | 'SCAN_REQUEST_RESULT_STATUS_NEUTRAL' | 'SCAN_REQUEST_RESULT_STATUS_ACTION_REQUIRED'
    - `scheduled_time` string, date-time: scheduled_time is the time at which the scan is scheduled to run.
    - `status` 'SCAN_REQUEST_STATUS_UNSPECIFIED' | 'SCAN_REQUEST_STATUS_QUEUED' | 'SCAN_REQUEST_STATUS_IN_PROGRESS' | 'SCAN_REQUEST_STATUS_COMPLETE' | 'SCAN_REQUEST_STATUS_FAILED'
    - `tenant_name` string: tenant_name is the tenant (and not the namespace) that is the owner of this scan request.
    - `type` 'SCAN_REQUEST_TYPE_UNSPECIFIED' | 'SCAN_REQUEST_TYPE_WEBHOOK' | 'SCAN_REQUEST_TYPE_SCHEDULED' | 'SCAN_REQUEST_TYPE_ANALYTICS' | 'SCAN_REQUEST_TYPE_FINDING_REFRESH': - SCAN_REQUEST_TYPE_UNSPECIFIED: Type is undefined. - SCAN_REQUEST_TYPE_WEBHOOK: SCAN_REQUEST_TYPE_WEBHOOK is a scan is an event driven request. - SCAN_REQUEST_TYPE_SCHEDULED: SCAN_REQUEST_TYPE_SCHEDULE is a periodic schedule scan request. - SCAN_REQUEST_TYPE_ANALYTICS: SCAN_REQUEST_TYPE_ANALYTICS is a request only for analytics. - SCAN_REQUEST_TYPE_FINDING_REFRESH: SCAN_REQUEST_TYPE_FINDING_REFRESH is a lightweight re-evaluation of findings from persisted DependencyMetadata, without a full re-scan of the repository.
  - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource.
    - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app".
  - `uuid` string: The UUID of the source control scan request.

## Other responses

- `default`: An unexpected error response.

## Changes

- **2026-11-03** `4acd9fe15140`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:object.tenant_meta.namespace/scan-requests/patch.md)

---

[API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)