> ## Documentation Index > Fetch the complete documentation index at: https://docs.devin.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start Ingestion Scan (Devin API) > Start an ingestion-mode Devin code scan that triages findings from an external scanner using an ingest profile via the v3 organization API ## Permissions Requires a [service user](/api-reference/v3/service-users/members-service-users) or [personal access token](/api-reference/personal-access-tokens) with the `UseCodeScans` permission at the organization level. ## Behavior Enqueues an ingestion-mode code scan. Instead of discovering issues from scratch, an ingestion scan takes findings produced elsewhere (for example a SAST report) and has Devin triage and validate them against the repository. The scan is launched asynchronously by the scan dispatcher and attributed to the calling principal. The enterprise-scoped equivalent is [Start Ingestion Scan (Enterprise)](/api-reference/v3/code-scans/enterprise-code-scans-start-ingestion). ### Request fields Provide exactly one of `repo_name` or `repos`. * `repo_name`: full repository name, e.g. `owner/repo`. * `repos`: repositories covered by one multi-repo scan, as a list of objects with `repo_name` and an optional `host` (up to 200). The first entry is the scan's primary repository. * `profile_id` (required): an `ingest`-mode [scan profile](/api-reference/v3/code-scans/organizations-code-scans-profiles). A `discover`-mode profile is rejected with `400`. * `host`: Git host of the repository, if it cannot be inferred. * `attachment_urls`: Devin attachment URLs (for example an exported scanner report) to provide to the scan. Upload files first with the [attachments API](/api-reference/v3/attachments/post-organizations-attachments), which requires the `UseDevinSessions` permission. * `effort`: `normal` (default) uses lower model reasoning effort with larger triage and validation batches; `deep` runs the full pipeline. * `platform`: where the scan's sessions run, either a platform label configured for the organization (for example `linux`, `windows`, or `macos`) or the name of an outpost pool, case-insensitive. Platforms take priority when a name matches both. Defaults to the organization default. ### Errors * `400` when `profile_id` is not an ingestion-mode profile, or `platform` does not match a configured platform label or outpost pool (the error body lists the available values). * `404` when the repository or profile is not visible to the organization. * `409` when the organization's scan backlog is at capacity. Retry later. * `422` when both or neither of `repo_name` and `repos` are provided, or `repos` is empty. ## OpenAPI ````yaml v3-openapi.yaml POST /v3/organizations/{org_id}/code-scans/ingestion openapi: 3.1.0 info: description: Devin v3 API with Service User authentication and RBAC title: Devin API v3 version: 3.0.0 servers: [] security: - bearerAuth: [] paths: /v3/organizations/{org_id}/code-scans/ingestion: post: tags: - code-scans summary: Start Ingestion Scan description: >- Start an ingestion-mode code scan on one or more repositories in the organization. The scan is enqueued and launched asynchronously by the scan dispatcher. Only ingest-mode profiles are accepted; a non-ingest profile is rejected with ``400``. Optional attachment URLs (uploaded via the attachments API) are provided to the scan. Returns ``409`` when the organization's scan backlog is at capacity. operationId: >- handle_start_ingestion_scan_v3_organizations__org_id__code_scans_ingestion_post parameters: - description: 'Organization ID (prefix: org-)' in: path name: org_id required: true schema: example: org-abc123def456 title: Org Id type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/StartIngestionScanRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CodeScanResponse' description: Successful Response '401': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Not Found '409': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Conflict '422': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Unprocessable Content '429': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Too Many Requests components: schemas: StartIngestionScanRequest: description: |- Request body for starting an ingestion-mode code scan. Only accepts an ingestion (ingest-mode) scan profile: the profile is run against the given repository (or repositories). properties: attachment_urls: anyOf: - items: format: uri maxLength: 2083 minLength: 1 type: string maxItems: 10 type: array - type: 'null' description: >- Devin attachment URLs to provide to the scan, e.g. files uploaded via the attachments API. The attachments must belong to the organization being scanned. title: Attachment Urls effort: anyOf: - enum: - normal - deep type: string - type: 'null' description: >- Scan effort: 'normal' (default) uses lower model reasoning effort with larger triage and validation batches; 'deep' runs the full pipeline. title: Effort host: anyOf: - type: string - type: 'null' description: Git host of the repository, if known. title: Host platform: anyOf: - maxLength: 128 type: string - type: 'null' description: >- Where the scan's sessions run: a platform label configured for the organization (e.g. 'linux', 'windows', 'macos') or the name of an outpost (BYOB) pool, case-insensitive; platforms take priority when a name matches both. Omitted means the organization default. Unrecognized values are rejected with a 400 whose error body lists the available platform labels and outpost pool names. title: Platform profile_id: description: >- Ingestion-mode scan profile to run. Must be an ingest profile; non-ingest profiles are rejected with 400. title: Profile Id type: string repo_name: anyOf: - type: string - type: 'null' description: >- Full name of the repository to scan. Provide exactly one of repo_name or repos. title: Repo Name repos: anyOf: - items: $ref: '#/components/schemas/ScanRepoRequest' maxItems: 200 type: array - type: 'null' description: >- Repositories covered by one scan; the first entry is the scan's primary repository. Provide exactly one of repo_name or repos. title: Repos required: - profile_id title: StartIngestionScanRequest type: object CodeScanResponse: description: A single code scan. properties: attachments: description: Files attached to the scan when it was created. items: $ref: '#/components/schemas/CodeScanAttachmentResponse' title: Attachments type: array created_at: description: When the scan was created (unix seconds). title: Created At type: integer effort: description: >- Scan effort: 'normal' uses lower model reasoning effort with larger investigation batches; 'deep' runs the full pipeline. enum: - normal - deep title: Effort type: string host: anyOf: - type: string - type: 'null' description: Git host of the repository, if known. title: Host org_id: description: Organization the scan belongs to. title: Org Id type: string outpost_pool_id: anyOf: - type: string - type: 'null' description: Outpost pool the scan's sessions run on, if one is set. title: Outpost Pool Id platform: anyOf: - type: string - type: 'null' description: >- Hosted platform label the scan's sessions run on. Null when the scan runs on an outpost pool or the organization default. title: Platform profile: anyOf: - $ref: '#/components/schemas/CodeScanProfileResponse' - type: 'null' description: Profile the scan ran under, if any. repo_full_name: anyOf: - type: string - type: 'null' description: >- Host-qualified identity of the primary repository (e.g. github.com/org/repo). Null for Perforce depots, which have no git host. title: Repo Full Name repo_name: description: >- Primary repository of the scan. Multi-repo scans cover additional repositories not listed here. title: Repo Name type: string scan_id: description: Unique identifier for the scan. title: Scan Id type: string scan_type: description: Type of scan, stamped at creation. enum: - security - performance - db-queries - test-coverage - dead-code - code-quality - cleanup - telemetry - accessibility - compliance - general - migration-docs title: Scan Type type: string status: description: >- Scan status: waiting, pending, running, awaiting_user_input, completed, failed, or cancelled. enum: - waiting - pending - running - awaiting_user_input - completed - failed - cancelled title: Status type: string url: description: URL of the scan's page in the Devin webapp. title: Url type: string required: - scan_id - org_id - repo_name - host - status - profile - scan_type - created_at - effort - url title: CodeScanResponse type: object ProblemDetail: description: >- RFC 9457 application/problem+json error body for the v3 API. detail is retained from the legacy {"detail": ...} body for back-compat; the other members are additive. errors carries field-level validation failures (422 only). properties: detail: anyOf: - type: string - type: 'null' description: A human-readable explanation specific to this occurrence. title: Detail error_code: anyOf: - type: string - type: 'null' description: >- Machine-readable code for blocked-action refusals (e.g. "user_frozen", "migrated_session"). title: Error Code errors: anyOf: - items: additionalProperties: true type: object type: array - type: 'null' description: Field-level validation errors (422 responses only). title: Errors instance: anyOf: - type: string - type: 'null' description: A URI reference (the request path) for this occurrence. title: Instance status: description: The HTTP status code. title: Status type: integer title: description: A short, human-readable summary of the problem type. title: Title type: string type: default: about:blank description: A URI reference identifying the problem type. title: Type type: string required: - title - status title: ProblemDetail type: object ScanRepoRequest: description: A repository to include in a multi-repo scan. properties: host: anyOf: - type: string - type: 'null' description: Git host of the repository, if known. title: Host repo_name: description: Full name of the repository to scan. title: Repo Name type: string required: - repo_name title: ScanRepoRequest type: object CodeScanAttachmentResponse: description: A file attached to a code scan at creation. properties: filename: description: Name of the attached file. title: Filename type: string url: description: Devin attachment URL of the file. title: Url type: string required: - url - filename title: CodeScanAttachmentResponse type: object CodeScanProfileResponse: description: Summary of the profile a scan ran under. properties: name: description: Name of the profile. title: Name type: string profile_id: description: Unique identifier for the profile. title: Profile Id type: string required: - profile_id - name title: CodeScanProfileResponse type: object securitySchemes: bearerAuth: description: 'Service User credential (prefix: cog_)' scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.