---
title: "Create a single discovery request"
method: POST
path: "/single-discovery"
tags: ["Organizations"]
---

# Create a single discovery request

`POST /single-discovery`

## Request

- Base URL: `https://api.xfa.tech`
- URL: `https://api.xfa.tech/single-discovery`
- Auth: HTTP bearer

## Request body

- SingleDiscoveryRequest: Request for a single (accountless) discovery scan. Two variants: the delegated (auth-code) variant supplies `code` + `redirect_uri`; the Microsoft app-only (admin-consent) variant supplies `tenant_id` instead (no OAuth code) and requires `email` as the report recipient. Only `type` is required for every request; the remaining fields are validated conditionally based on which variant is used.
  - `code` string: Authorization code (delegated variant)
  - `redirect_uri` string: Redirect URI for the auth service (delegated variant)
  - `tenant_id` string, uuid: Microsoft Entra tenant id. When set, selects the app-only (admin-consent) variant, which persists an app-only connection and does not exchange an OAuth code. Microsoft only.
  - `type` 'Google' | 'Microsoft', required: type of auth service
  - `email` string: Report recipient email. Optional for the delegated variant (derived from the connecting user when omitted); required for the app-only variant, which has no connecting user.

## Response `201`

Single discovery request created

- SingleDiscoveryResponse
  - `application_id` string: ID of the application

---

[API](https://skmtc.dev/xfa/apis/xfa-api.md) · [All operations](https://skmtc.dev/xfa/apis/xfa-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xfa/apis/xfa-api/revisions/1a1be0e8972b?raw)