code-scan

Ingest Code Scan

Ingest ONE code-scan run and reconcile the project's findings (Developer+).

THE SUBMITTED SET IS AUTHORITATIVE. Every finding already known to this project that is absent from this body is flipped to gone. Post the full result of one scan, never a partial page — a truncated body retires findings that are still hardcoded in the source.

Identity is file + string (+ an occurrence ordinal), not the line number: a finding keeps its identity, and its treated mark, when code moves around it. line/column are refreshed each run as position metadata.

A run that would retire most of the project's live findings is refused (422) unless confirm_mass_gone is set — the usual cause is a scan over a partial checkout, which would hide findings that are still in the code. Every run is written to the audit log.

post/v1/projects/{project_id}/code-scan

Request

  • Base URL: https://api.sonenta.dev
  • URL: https://api.sonenta.dev/v1/projects/{project_id}/code-scan
  • Auth: none declared

Path parameters

project_idstring required

Request body

metaobject nullable

Free-form run context (tool, version, sha).

confirm_mass_goneboolean

Set true ONLY when a run that retires most of the project's live findings is intended. Without it, such a run is refused (422) — the usual cause is a scan over a PARTIAL checkout, which would hide findings that are still in the code.

Response

Successful Response

scan_idstring required
created_atstring date-time required
submittedinteger required
newinteger required
persistinginteger required
treatedinteger required
goneinteger required
formulaobject required

Changes

No recorded changes to this operation across all 1 revision of this API.