---
title: "Trigger a pentest scan"
method: POST
path: "/scans"
tags: ["REST API - Scans"]
---

# Trigger a pentest scan

`POST /scans`

## Request body

- RestCreateScanDto
  - `cost_estimation_id` string, required — Completed cost estimation UUID
  - `repos` RestRepoDto[], required — Repositories to scan
    - `url` string, required — Repository URL
    - `branch` string, required — Branch name
    - `source` 'connected' | 'public' | 'upload' — Repository source
  - `target_urls` string[] — Target URLs for pentest
  - `auth_instructions` string — Authentication instructions for the target
  - `custom_context` string — Custom context for the pentest
  - `context_document_ids` string[] — Context document UUIDs to include

## Response `201`

- RestCreateScanResponseDto
  - `id` string, required
  - `task_id` string, required
  - `status` string, required
  - `message` string, required

## Other responses

- `402` — Insufficient credits

---

[API](https://skmtc.dev/hacktron/apis/hacktron-rest-api.md) · [All operations](https://skmtc.dev/hacktron/apis/hacktron-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hacktron/hacktron-rest-api/revisions/6a361244ce2c/schema)