---
title: "Start a vendor portfolio scan"
method: POST
path: "/_api/vendors/scan_start"
tags: ["Vendor risk"]
---

# Start a vendor portfolio scan

`POST /_api/vendors/scan_start`

## Request

- Base URL: `https://shadowalpha.online`
- URL: `https://shadowalpha.online/_api/vendors/scan_start`
- Auth: none declared

Accepts up to 300 vendor domains (CSV/TSV/semicolon or one per line; a name column and a 'critical' column are recognised). The scan runs in the background, usually 1–3 minutes; poll GET /_api/vendors/scan. Results are kept 30 days. Limits: 4 scans per client per hour, 40 per hour in total.

## Request body

- object
  - `text` string, required: Pasted list or file contents.
  - `company` string
  - `email` string: Optional: email the link when the scan is done.

## Response `200`

Scan queued.

- object
  - `id` string
  - `accepted` integer
  - `rejected` string[]
  - `truncated` integer

## Other responses

- `400`: No valid domains or invalid email.
- `429`: Rate limit reached.

---

[API](https://skmtc.dev/shadowalpha/apis/shadowgraph-api.md) · [All operations](https://skmtc.dev/shadowalpha/apis/shadowgraph-api/llms.txt) · [OpenAPI document](https://skmtc.dev/shadowalpha/apis/shadowgraph-api/revisions/1b62d5453408?raw)