---
title: "Scan Websites"
method: POST
path: "/api/cmp/v1/webscans"
tags: ["Scans"]
---

# Scan Websites

`POST /api/cmp/v1/webscans`

Use this API to start scans for the specified domains.

## Query parameters

- `externalOrgId` string

## Request body

- ScanWebsiteRequest[]
  - `domain` string — The website domain being managed.
  - `numberOfPages` integer, required — The total number of web pages found during scanning.
  - `independentPaths` boolean — The unique URL paths discovered during the scanning process.
  - `includedQueryParams` string — The query parameters that are included in the scan.
  - `siteMapsUris` string — The URLs of sitemaps used for the scanning process.
  - `geoLocation` string — The geographic location settings for the scan.
  - `limitScanToSitemap` boolean — This flag indicates whether to restrict scanning to sitemap URLs only.
  - `googleLoginState` boolean — The login state for Google-authenticated scanning.
  - `captureDelayedCookies` boolean — This flag indicates whether to capture cookies that load after the initial page load.
  - `delayTimeInSeconds` integer — The time duration in seconds to wait before capturing delayed cookies.
  - `targetPageInputs` TargetPagesScanEntityDto[] — The input parameters for specific pages to be scanned.
    - `pageListName` string, required — Name of the page list.
    - `targetType` 'IncludeOnly' | 'Exclude' | 'Target', required — Type of targeting for the URLs
    - `urlType` 'Page' | 'Path' | 'Subdomain', required — Specify which level of inclusion or exclusion is desired
    - `pageUrls` string, required — List of valid URLs, one per line. URLs should start with "https://" or "http://"

## Response `200`

OK

- ServiceResponseDto[]
  - `consentPolicyId` string — Consent policy associated with the scan.
  - `domainId` string, uuid — ID of the domain under scan.
  - `message` string — Scan response message.
  - `notificationTemplateId` string — Notification template associated with the scan.
  - `ok` boolean
  - `rescan` boolean — Flag to indicate if the rescan is required or not.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500` — Internal Server Error

---

[API](https://skmtc.net/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.net/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/versions/21de3aa0b170/schema)