---
title: "Create scan"
method: POST
path: "/api/scans"
tags: ["scans"]
---

# Create scan

`POST /api/scans`

Create and start a new security scan against a target URL.
The scan runs asynchronously — use the status endpoint or WebSocket to track progress.

## Request body

- CreateScanRequest
  - `target_url` string, uri, required — Target URL to scan
  - `scan_type` string — Scan type: full, hunter, manager, or focused agent names
  - `scan_depth` '' | 'quick' | 'standard' | 'thorough' — Exploitation depth: quick, standard, thorough
  - `safe_mode` boolean, nullable — Override global safe mode setting
  - `max_depth` integer — Maximum crawl depth
  - `max_urls` integer — Maximum URLs to crawl
  - `resume` boolean — Resume a previous scan
  - `use_vertical` boolean — Use vertical specialized agents
  - `focused_agents` string[] — List of focused agent names
  - `param` string, nullable — Specific parameter to target

## Response `201`

Scan created and started

- ScanStatusResponse
  - `scan_id` integer
  - `target` string
  - `status` 'PENDING' | 'INITIALIZING' | 'RUNNING' | 'PAUSED' | 'COMPLETED' | 'STOPPED' | 'FAILED' — Scan lifecycle status
  - `progress` integer
  - `uptime_seconds` number, nullable
  - `findings_count` integer
  - `active_agent` string, nullable
  - `phase` string, nullable
  - `origin` 'cli' | 'web' | 'unknown' — Where the scan was launched from

## Other responses

- `400` — Invalid request parameters
- `429` — Too many concurrent scans

---

[API](https://skmtc.net/bugtraceai/apis/bugtraceai-cli-api.md) · [All operations](https://skmtc.net/bugtraceai/apis/bugtraceai-cli-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bugtraceai/bugtraceai-cli-api/versions/312bfc1148dc/schema)