---
title: "Create Scan"
method: POST
path: "/v1/scans"
tags: ["scans"]
---

# Create Scan

`POST /v1/scans`

Trigger a scan

## Headers

- `X-Team-Id` string

## Request body

- object
  - `targets` string[]
  - `templates` string[]
  - `assets` string[]
  - `private_templates` PrivateTemplates[]
    - `name` string, required
    - `contents` string, required
  - `name` string
  - `recommended` boolean
  - `all` boolean
  - `alerting_config_ids` string[]
  - `scan_config_ids` string[]
  - `reporting_config_ids` string[]
  - `early_templates` string[]
  - `exclude_targets` string[]
  - `enumeration_ids` EnumerationIds[]
    - `id` string, required
  - `schedule_only` boolean
  - `disable_global_alert_config` boolean
  - `disable_global_report_config` boolean
  - `disable_global_scan_config` boolean
  - `socks5_proxy` string
  - `agent_id` string
  - `agent_tags` string[]
  - `agent_networks` string[]
  - `agent_behavior` 'distribute' | 'mirror'
  - `automatic_scan` boolean
  - `scan_all_assets` boolean
  - `exclusions` string[] — Combined inclusion and exclusion patterns for scan scope. Exclusion patterns (e.g. `*.staging.company.com`) filter out matching targets. Inclusion patterns use a `+` prefix (e.g. `+prod-*.company.com`) to restrict scanning to only matching targets (allowlist mode). When inclusion patterns are present, targets must match at least one inclusion pattern and not match any exclusion pattern. Supports exact domains, wildcard patterns, IP addresses, and CIDR ranges.
  - `asset_filters` AssetFilters
    - `is_tech` boolean — Return records that have technologies
    - `is_favicon` boolean — Return the records that have favicon
    - `is_new` boolean — Filter by new content
    - `labels` string — Filter by comma separated labels, e.g-> labels=p1,p2
    - `host` string — Filter by comma separated hosts, e.g-> host=p1,p2
    - `port` string — Filter by comma separated ports, e.g-> port=p1,p2
    - `status_code` string — Filter by comma separated status codes, e.g-> status_code=p1,p2
    - `content_length` string — Filter by comma separated content lengths, e.g-> content_length=p1,p2
    - `title` string — Filter by comma separated titles, e.g-> title=p1,p2
    - `domain` string[] — Filter by comma separated domain names, e.g-> domain=domain1.com,domain2.com
    - `cname` string — Filter by comma separated cnames, e.g-> cname=p1,p2
    - `technologies` string — Filter by comma separated technologies, e.g-> technologies=p1,p2
    - `ip` string — Filter by comma separated ips, e.g-> ip=p1,p2
    - `is_screenshot` boolean — Return the records with screenshots
    - `time` 'last_day' | 'last_week' | 'last_month' | 'last_3_months' | 'last_6_months' | 'last_12_months' | 'all_time'
    - `start_date` string, date — Filter by start date
    - `end_date` string, date — Filter by end date
    - `custom_filter` string — Filter by custom filter. Double encode the query string.
    - `search` string — Search on the content name
    - `enumeration_ids` string[] — Filter by enumeration ids
    - `only_dns` boolean — Query only dns FQDN records
    - `only_ip` boolean — Query only dns IP records
    - `not_seen_for_days` integer — Return assets that haven't been seen in the last N days. An asset is only included if a scan that covers it has run during that period without rediscovering it, so assets that simply haven't been rescanned recently are not matched.

## Response `200`

Example response

- object
  - `id` string
  - `message` string, required
  - `truncated-scan-targets` integer

## Other responses

- `400` — Example response
- `401` — Example response
- `500` — Example response
- `default` — Example response

---

[API](https://skmtc.net/projectdiscovery/apis/pdcp-api.md) · [All operations](https://skmtc.net/projectdiscovery/apis/pdcp-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/projectdiscovery/pdcp-api/versions/220f0adf9efd/schema)