---
title: "Trigger security scan"
method: POST
path: "/v1/projects/{project_id}/security-scans"
tags: ["security-governance"]
---

# Trigger security scan

`POST /v1/projects/{project_id}/security-scans`

**Plan:** `Business or higher`

Starts a security scan for the project's latest commit and returns a scan_id.

## Path parameters

- `project_id` string, required — Project ID

## Response `200`

OK

- V1TriggerSecurityScanResponseBody
  - `message` string — Human-readable status message
  - `scan_id` string, required — Scan invocation ID. Poll GET /v1/projects/{project_id}/security-scans/{scan_id} for status (running | completed | failed) and findings.
  - `status` string, required — One of: started, running, completed. More values may be added; clients must tolerate unknown values.

## Other responses

- `401` — Missing or invalid API key.
- `402` — This operation or requested configuration requires a workspace plan that includes this feature.
- `403` — The key or caller lacks the required scope or permission.
- `406` — The Accept header excludes every media type this endpoint produces.
- `429` — Too many requests. Retry after the interval in Retry-After when present.
- `default` — Error. The response body uses the standard error envelope; status matches the HTTP status code and type is a machine-readable error code.

---

[API](https://skmtc.net/lovable/apis/lovable-api.md) · [All operations](https://skmtc.net/lovable/apis/lovable-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lovable/lovable-api/revisions/aa8d44585147/schema)