---
title: "Trigger a full scan"
method: POST
path: "/api/v2/scans/start"
tags: ["Scans"]
---

# Trigger a full scan

`POST /api/v2/scans/start`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/scans/start`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Start a full security scan on one or more repositories. Each repository is scanned on the specified branch (or its default scan target branch if not specified). Scans are queued and processed asynchronously — use scans.get to monitor progress. Triggering a scan on a repository that already has a running scan will queue the new scan to start after the current one completes.

## Request body

- ScansStartRequest: Input for triggering a full scan on one or more repositories.
  - `organizationId` string: Organization that owns the repositories to scan.
  - `repositories` object[], required: List of repositories to scan. Each can optionally specify a branch.
    - `id` string, required: Repository ID to scan.
    - `branch` string: Branch to scan. If omitted, uses the repository default scan target branch.

## Response `200`

Scans triggered

- ScansStartResponse
  - `scans` object[], required
    - `scanId` string, required: ID of the created scan.
    - `repositoryId` string, required: Repository being scanned.
    - `status` 'Scheduled' | 'Queued' | 'Running' | 'Errored' | 'Finished' | 'Cloning repository' | 'Scanning for vulnerabilities' | 'Generating patches' | 'Setting up repository' | 'Identifying application(s)' | 'Generating AST' | 'Identifying source(s)' | 'Detecting vulnerabilities' | 'Validating results', required: Initial scan status (typically "Queued" or "Running").

## Other responses

- `400`: Error Response
- `401`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)