--- title: "List Account's Scheduled Scans" method: GET path: "/scheduledscans/" tags: ["Scheduled Scans"] --- # List Account's Scheduled Scans `GET /scheduledscans/` ## Query parameters - `id` string[] - `is_id_404_validation` boolean - `label` string[] - `length` integer - `ordering` string - `page` integer - `search` string - `target` string[] - `team` string[] ## Response `200` - PaginatedScheduledScanList - `count` integer — Total number of results. - `page_total` integer — Total number of pages. - `page` integer — Number of the current page. The first page is 1. Defaults to 1 if no specific page is requested. - `length` integer — Number of results returned per page. - `results` ScheduledScan[] - `id` string, required — A unique Base58 value identifying this object. - `target` SimpleScope, required - `id` string, required - `name` string — Name of the target. The maximum length is 255 characters. - `site` Target — Mixin to handle obfuscation of sensitive fields in serializers. - `id` string, required — A unique Base58 value identifying this object. - `name` string — Name of the target or extra host. The maximum length is 255 characters. - `desc` string, nullable — Description of the target. - `url` string, uri, required — URL of the target. - `host` string, required — Hostname of the target. - `has_form_login` boolean — If true, the target authentication is done through a login form. Read more about [how to set up target authentication (login form)](https://help.probely.com/en/articles/3292779-how-to-set-up-target-authentication-login-form). Defaults to false. - `form_login_url` string, uri — URL of the login form of the target. - `form_login_check_pattern` string — Pattern to check a successful login. The maximum length is 255 characters. - `form_login` SensitiveFormLogin[] — Field and value pairs to fill the login form. - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `logout_detection_enabled` boolean — If true, detects any undesired logouts that may occur during scans to log back in. Requires `check_session_url` and `logout_detectors` to be defined. Defaults to false. - `has_sequence_login` boolean — If true, the target authentication is done through a recorded login sequence. Read more about [how to set up target authentication (login sequence)](https://help.probely.com/en/articles/5402869-how-to-record-a-sequence-with-probely-s-sequence-recorder-plugin). Defaults to false. - `has_basic_auth` boolean — If true, the target authentication is done through username and password credentials. Defaults to false. - `basic_auth` BasicAuth — Mixin to handle obfuscation of sensitive fields in serializers. - `username` string, required - `password` string, required - `password_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `password` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `headers` SensitiveHeader[] — Custom headers to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `cookies` SensitiveCookies[] — Custom cookies to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `whitelist` unknown - `blacklist` unknown - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `auth_enabled` boolean — If true, the target has authentication. Defaults to false. - `logout_condition` 'any' | 'all' — Type of combination of the logout conditions: * `any` - Is logged out if any condition is verified. * `all` - Is logged out only if all condition are verified. - `check_session_url` string — URL to check session. - `check_session_operation_name` string — GraphQL operation name for the check session request. - `has_otp` boolean — If true, the target has two-factor authentication (2FA). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). Defaults to false. - `otp_secret` string — The seed/secret obtained when the QR code is displayed to be scanned by the third-party authenticator (TPA) app installed on the phone (e.g., Google Authenticator, 1Password, Authy, Microsoft Authenticator, etc.). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). - `otp_secret_is_sensitive` boolean, required — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `otp_secret` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. Read-only. - `otp_algorithm` 'SHA1' | 'SHA256' | 'SHA512' — Secure hash algorithm (SHA) to generate the one-time password (OTP): (Defaults to `SHA1`) * `SHA1` - Sha1 * `SHA256` - Sha256 * `SHA512` - Sha512 - `otp_digits` 6 | 7 | 8 — Number of digits of the one-time password (OTP): (Defaults to `6`) * `6` - Six * `7` - Seven * `8` - Eight - `otp_field` string — CSS selector of the HTML element in the page to enter the one-time password (OTP). For example, a text input field. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_submit` string — CSS selector of the HTML element in the page to submit the one-time password (OTP). For example, a button. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_login_sequence_totp_value` string — One-time password (OTP) obtained at the time when the login sequence was recorded, i.e., the time-based one-time password (TOTP). Defaults to "". - `otp_type` string - `otp_url` string, required - `is_mtls_active` boolean, required — If true, mTLS is configured and enabled for the target. - `is_signature_active` boolean, required — If true, message signature is configured and enabled for the target. - `is_mle_active` boolean, required — If true, MLE (Message Level Encryption) is configured and enabled for the target. - `postman_authentication_enabled` boolean — If true, use Postman authentication when performing the check session request. - `postman_check_session_folder` string - `has_authentication` boolean, required - `stack` Framework[] — Technologies identified in the target during scans. The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `verified` boolean, required — If true, the domain is verified. Read-only. - `verification_token` string, required — Token used to verify the domain. Read-only. - `verification_date` string, date-time, required — Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only. - `verification_method` 'file' | 'back_office' | 'existing_domain' | 'dns_txt' | 'dns' | 'dns_cname' | 'meta_tag' | 'whitelist' | 'email' | 'aws_route53' | 'cloudflare' | 'waved' | 'akamai', required — Method used in the domain verification: * `file` - Verifies the domain against a text file in the root directory of the website. Learn more in [this article](https://help.probely.com/en/articles/3289281-how-to-verify-the-ownership-of-a-target-using-a-txt-file). * `back_office` - Automatically set if manually verified in the back-office. Read-only. * `existing_domain` - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only. * `dns_txt` - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/3285635-how-to-verify-the-ownership-of-a-target-using-dns-txt-records). * `dns` - Same as `dns_txt`. * `dns_cname` - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/5642359-how-to-verify-the-ownership-of-a-target-using-dns-cname-records). * `meta_tag` - Verifies the domain against a meta tag in the index page of the website. Learn more in [this article](https://help.probely.com/en/articles/5642393-how-to-verify-the-ownership-of-a-target-using-a-meta-tag). * `whitelist` - Automatically verifies if the domain is in the whitelist * `email` - Automatically verifies a domain if the user's email is in the same domain as the target * `aws_route53` - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone. * `cloudflare` - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone. * `waved` - Automatically verifies a domain if there is a waver agreement. * `akamai` - Automatically verifies a domain if the host name exists as an AkamaiHost. - `verification_last_error` string, required — Error of the last verification of the domain. Read-only. - `api_scan_settings` APIScanSettings, required — Mixin to handle obfuscation of sensitive fields in serializers. - `api_schema_type` 'openapi' | 'postman' | 'graphql' — Type of schema that defines the API: * `openapi` - OpenAPI schema. * `postman` - Postman collection. * `graphql` - GraphQL schema. - `api_schema_url` string, nullable - `api_schema_file` string, nullable - `api_schema_method` 'url' | 'file' | 'introspection' | '' | 'null', nullable — Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'. * `url` - Fetch schema from URL * `file` - Upload schema file * `introspection` - Auto-discover via GraphQL introspection - `custom_api_parameters` APIParameter[] - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `media_type` 'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql' — Format of the payload: * `application/json` - The payload is in JSON format in the request body. * `application/x-www-form-urlencoded` - The payload is encoded in the request URL. * `application/graphql` - The payload is a raw GraphQL query string. - `api_login_url` string — URL to make the authentication request to the API. The maximum length is 2048 characters. - `api_login_payload` string — Payload to send in the authentication request. The maximum length is 4096 characters. - `api_login_payload_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `api_login_enabled` boolean - `api_login_token_field` string — Field containing the authentication token in the response to the authentication request. The maximum length is 256 characters. - `token_prefix` string — Prefix to add to the authentication token. For example, "Bearer" or "JWT". The maximum length is 16 characters. - `token_parameter_name` string — Parameter name to send the authentication token. For example, "Authorization". The maximum length is 256 characters. - `token_parameter_location` 'cookie' | 'header' — Where to send the parameter name with the authentication token and the prefix: * `cookie` - Cookie * `header` - Header - `api_login_method` 'api_login' | 'headers_or_cookies' — Method used for API Target authentication. * `api_login` - API Login * `headers_or_cookies` - Headers/Cookie - `api_payload_login_enabled_secondary` boolean — Enable secondary payload auth for authorization (BOLA) testing . - `api_headers_cookies_login_enabled_secondary` boolean — Enable secondary static headers/cookies auth for authorization (BOLA) testing. - `api_login_payload_secondary` string — Payload to send in the secondary authentication request, used for BOLA detection. - `api_login_payload_secondary_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload_secondary` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `openapi_check_session_method` string - `openapi_check_session_media_type` string - `openapi_check_session_expired_payload` string, nullable - `type` string — Type of target. Possible values are "single" for a web application and "api" for an API. Defaults to "single". - `desc` string, nullable — Description of the target. Defaults to "". - `labels` ScopeLabel[] - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the label. The maximum length is 255 characters. - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green. - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `has_assets` boolean, required - `report_fileformat` 'pdf' | 'docx' — [Report format](https://help.probely.com/en/articles/6649585-how-to-switch-between-different-report-formats) for the target: (Defaults to `pdf`) * `pdf` - PDF file format. * `docx` - DOCX file format. - `scanning_agent` ScanningAgent — Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in `to_internal_value`. This is for the drf-spectacular documentation generation. - `id` string - `name` string, required - `installer_generated` boolean, required - `online` boolean, required - `fallback` boolean, required - `rx_bytes` integer, required - `tx_bytes` integer, required - `latest_handshake` integer, required - `teams` SimpleTeam[], required - `id` string — A unique Base58 value identifying this object. - `name` string, required - `blackout_period` BlackoutPeriod, required - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27". - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27". - `weekdays` integer[], required - `enabled` boolean — If true, the blackout period is enabled. - `timezone` string - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `date_time` string, date-time, required — Date and time of next scan scheduled. - `recurrence` 'h' | 'd' | 'w' | 'm' | 'q' | '' — Scheduled scan recurrence. * `h` - Hourly * `d` - Daily * `w` - Weekly * `m` - Monthly * `q` - Quarterly - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `blackout_period` BlackoutPeriod, required - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27". - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27". - `weekdays` integer[], required - `enabled` boolean — If true, the blackout period is enabled. - `timezone` string - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `timezone` string — Timezone in which `date_time` will run. Expects values from TZ Database. Case sensitive. E.g: `US/Central`, `WET`. Defaults to `UTC`. - `run_on_day_of_week` boolean — Schedule scan to run on specific monthly day of week (for monthly/quarterly recurrence). - `scheduled_day_of_week` 1 | 2 | 3 | 4 | 5 | 6 | 7 | null, nullable — Day of week to run scan on - monday to sunday (for run on day of week option). * `1` - Monday * `2` - Tuesday * `3` - Wednesday * `4` - Thursday * `5` - Friday * `6` - Saturday * `7` - Sunday - `week_index` 'first' | 'second' | 'third' | 'fourth' | 'last' | '' | 'null', nullable — Which week of the month to run scan on (with `run_on_day_of_week` enabled). * `first` - First * `second` - Second * `third` - Third * `fourth` - Fourth * `last` - Last - `partial_scan` boolean — Future scans set as partial scans, use in conjunction with `incremental` and `reduced_scope`. - `override_target_settings` boolean — Override scan target's scan settings, use in conjunction with `override_target_settings`. - `incremental` boolean — Future scans set to incremental, use in conjunction with `partial_scan` and `override_target_settings`. - `reduced_scope` boolean — Future scans set as reduced scope, use in conjunction with `partial_scan` and `override_target_settings`. - `scan_profile` string, nullable — Scan profile to use. Use the endpoint [List Scan Profiles](#tag/Scan-Profiles/operation/scan_profiles_list) to get all the available scan profiles. If no scan profile is specified, the scan profile will be the one specified in the target settings. - `unlimited` string, required ## Other responses - `400` - `401` - `500` --- [API](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation.md) · [All operations](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/probely/snyk-api-web-s-api-reference-documentation/versions/e29879bff01b/schema)