---
title: "Submit an asynchronous code scan"
method: POST
path: "/api/v2/async-code-scans/submit"
tags: ["Async Code Scans"]
---

# Submit an asynchronous code scan

`POST /api/v2/async-code-scans/submit`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/async-code-scans/submit`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Authenticates with the existing ZeroPath API token path, resolves the requested target, stores a queued scan job, and starts background processing for the supplied diff, file, files, or snippets payload. Repository targets use repository authorization. Auto targets use repository context when an accessible remote URL resolves to exactly one repository, otherwise they run standalone.

## Request body

- AsyncCodeScanSubmitRequest: Submit caller-provided code or diff content for an authenticated asynchronous security scan. applicationInfoId is intentionally not required; repository, application, and threat-model context are resolved from target when a linked repository is available.
  - `organizationId` string: Optional organization context. Required only when the caller credential or session does not already imply a single organization.
  - `target` union, required
    - AsyncCodeScanRepositoryTarget
      - `kind` 'repository', required
      - `repositoryId` string, required: Repository that owns the submitted code context.
    - AsyncCodeScanAutoTarget
      - `kind` 'auto', required
      - `remoteUrl` string: Optional caller-provided Git remote URL. When it matches exactly one accessible linked repository, that repository context is used; otherwise the scan runs standalone.
      - `label` string: Optional caller-provided target label for standalone tracking.
    - AsyncCodeScanStandaloneTarget
      - `kind` 'standalone', required
      - `remoteUrl` string: Optional caller-provided Git remote URL for audit and abuse tracking.
      - `label` string: Optional caller-provided target label for audit and display.
  - `input` union, required
    - object
      - `kind` 'diff', required
      - `diff` string, required
    - AsyncCodeScanFileInput
      - `kind` 'file', required
      - `path` string, required
      - `content` string, required
      - `language` string
    - object
      - `kind` 'files', required
      - `files` AsyncCodeScanSourceFile[], required
        - `path` string, required
        - `content` string, required
        - `language` string
    - object
      - `kind` 'snippets', required
      - `snippets` AsyncCodeScanSnippetInput[], required
        - `label` string
        - `content` string, required
        - `language` string
  - `additionalContext` string: Optional supplemental caller context. It is treated as untrusted background information, not as scanner instructions.
  - `metadata` AsyncCodeScanMetadata
    - `caller` 'cli' | 'ide' | 'mcp' | 'pre_commit' | 'api' | 'agent'
    - `workingTreeRef` string
    - `baseRef` string
    - `headRef` string

## Response `202`

Scan job accepted and queued

- AsyncCodeScanSubmitResponse
  - `jobId` string, required: Asynchronous code scan job ID.
  - `status` 'queued' | 'running' | 'completed' | 'failed', required
  - `createdAt` string, date-time, required

## Other responses

- `400`: Error Response
- `401`: Error Response
- `403`: Error Response
- `413`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)