---
title: "Trigger a scan (GitHub or GitLab)"
method: POST
path: "/scans"
---

# Trigger a scan (GitHub or GitLab)

`POST /scans`

## Request

- Base URL: `https://app.gecko.security/api/v1`
- URL: `https://app.gecko.security/api/v1/scans`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

## Headers

- `Idempotency-Key` string

## Request body

- CreateScanRequest
  - `name` string, required
  - `repository` string, required
  - `provider` 'github' | 'gitlab'
  - `branch` string
  - `commit` string: Scan exactly this commit instead of the branch tip. Full or abbreviated SHA; it must exist in the repository.
  - `base_commit` string: Analyze only the files changed from this commit to `commit` (a diff scan). Requires `commit`; findings land as repository findings.
  - `model` 'haiku' | 'sonnet' | 'opus'

## Response `201`

Scan created

- Scan
  - `object` 'scan', required
  - `id` string, uuid, required
  - `name` string, required
  - `status` string, nullable, required
  - `is_done` boolean, required
  - `progress` integer, nullable, required
  - `programming_language` string, nullable, required
  - `kind` 'main' | 'pr' | 'fix', required
  - `branch` string, nullable, required
  - `commit_sha` string, nullable, required
  - `pull_request_number` integer, nullable, required
  - `repository` string, nullable, required
  - `model` string, nullable, required
  - `vulnerability_counts` object, required
    - `critical` integer, required
    - `high` integer, required
    - `medium` integer, required
    - `low` integer, required
    - `total` integer, required
  - `created_at` string, required
  - `ended_at` string, nullable, required

## Other responses

- `401`: Authentication error
- `403`: Authorization error
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/gecko/apis/gecko-security-api.md) - [All operations](https://skmtc.dev/gecko/apis/gecko-security-api/llms.txt) - [OpenAPI document](https://skmtc.dev/gecko/apis/gecko-security-api/revisions/9da49dae8b07?raw)