> ## Documentation Index > Fetch the complete documentation index at: https://docs.devin.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start Code Scan (Devin API) > Start a new Devin code scan on one or more repositories via the v3 organization API, optionally with a scan profile, commit SHA, or effort ## Permissions Requires a [service user](/api-reference/v3/service-users/members-service-users) or [personal access token](/api-reference/personal-access-tokens) with the `UseCodeScans` permission at the organization level. ## Behavior Enqueues a new code scan for the given repository (`repo_name`) or repositories (`repos`) in the organization. The scan is launched asynchronously by the scan dispatcher; the response is the scan record with an initial `status` of `waiting` or `pending`. Poll [List Code Scans](/api-reference/v3/code-scans/organizations-code-scans-list) to track progress, and [List Code Scan Findings](/api-reference/v3/code-scans/organizations-code-scans-findings) (filtered by `scan_id`) to read results once the scan reaches `completed`. The scan is attributed to the calling principal (the service user or PAT that made the request). The enterprise-scoped equivalent is [Start Code Scan (Enterprise)](/api-reference/v3/code-scans/enterprise-code-scans-start). ### Request fields Provide exactly one of `repo_name` or `repos`. * `repo_name`: full repository name, e.g. `owner/repo`. The repository must already be accessible through the organization's Git integration. * `host`: Git host of the repository, if it cannot be inferred. * `repos`: repositories covered by one multi-repo scan, as a list of objects with `repo_name` and an optional `host` (up to 200). The first entry is the scan's primary repository. * `profile_id`: a [scan profile](/api-reference/v3/code-scans/organizations-code-scans-profiles) to apply. Use [Start Ingestion Scan](/api-reference/v3/code-scans/organizations-code-scans-start-ingestion) for `ingest`-mode profiles. * `scan_type`: type of scan to run. Must match the profile's scan type when `profile_id` is given. Defaults to the profile's type, or `security` for profile-less scans. Non-security scan types require a profile. * `commit_sha`: commit to check out before scanning. Defaults to the repository's default branch head. * `effort`: `normal` (default) uses lower model reasoning effort with larger investigation batches; `deep` runs the full pipeline. * `interactive`: when `true`, the scan pauses in `awaiting_user_input` for user review between threat modeling and investigation. Defaults to `false`. Only security scans support interactive review; other scan types run unattended. * `platform`: where the scan's sessions run, either a platform label configured for the organization (for example `linux`, `windows`, or `macos`) or the name of an outpost pool, case-insensitive. Platforms take priority when a name matches both. Defaults to the organization default. ### Errors * `400` when `scan_type` conflicts with the profile, a non-security `scan_type` is given without a profile, or `platform` does not match a configured platform label or outpost pool (the error body lists the available values). * `403` when the organization is restricted to ingestion-only scans and no `ingest`-mode profile is given. * `404` when the repository or profile is not visible to the organization. * `409` when the organization's scan backlog is at capacity. Retry later. * `422` when both or neither of `repo_name` and `repos` are provided, or `repos` is empty. ## OpenAPI ````yaml v3-openapi.yaml POST /v3/organizations/{org_id}/code-scans openapi: 3.1.0 info: description: Devin v3 API with Service User authentication and RBAC title: Devin API v3 version: 3.0.0 servers: [] security: - bearerAuth: [] paths: /v3/organizations/{org_id}/code-scans: post: tags: - code-scans summary: Start Code Scan description: |- Start a new code scan on a repository in the organization. The scan is enqueued and launched asynchronously by the scan dispatcher. The scan is attributed to the calling principal (the service user or PAT that made the request). Returns ``409`` when the organization's scan backlog is at capacity. operationId: handle_start_code_scan_v3_organizations__org_id__code_scans_post parameters: - description: 'Organization ID (prefix: org-)' in: path name: org_id required: true schema: example: org-abc123def456 title: Org Id type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/OrgCodeScanCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CodeScanResponse' description: Successful Response '401': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Not Found '409': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Conflict '422': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Unprocessable Content '429': content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' description: Too Many Requests components: schemas: OrgCodeScanCreateRequest: description: Request body for starting a new code scan. properties: commit_sha: anyOf: - type: string - type: 'null' description: Commit to check out before scanning. title: Commit Sha devin_mode: anyOf: - enum: - fusion - swe-2 type: string - type: 'null' description: >- Agent the scan's sessions run on: 'fusion' or 'swe-2' (SWE-2 Max for 'deep' effort, SWE-2 High for 'normal'). Applies only when the mode is enabled for the organization; otherwise, and when omitted, the scan runs on the default agent. title: Devin Mode effort: anyOf: - enum: - normal - deep type: string - type: 'null' description: >- Scan effort: 'normal' (default) uses lower model reasoning effort with larger investigation batches; 'deep' runs the full pipeline. title: Effort host: anyOf: - type: string - type: 'null' description: Git host of the repository, if known. title: Host interactive: default: false description: >- When true, the scan pauses for user review between threat modeling and investigation. title: Interactive type: boolean locale: anyOf: - type: string - type: 'null' description: >- BCP-47 language tag (e.g. 'ja') for the scan's user-facing output: finding titles, descriptions, and reports. Omitted means English. title: Locale new_budget: anyOf: - $ref: '#/components/schemas/NewScanBudget' - type: 'null' description: >- Give the scan its own ACU budget. Requires the ManageAccountServiceUsers and ManageAcuLimits permissions. platform: anyOf: - maxLength: 128 type: string - type: 'null' description: >- Where the scan's sessions run: a platform label configured for the organization (e.g. 'linux', 'windows', 'macos') or the name of an outpost (BYOB) pool, case-insensitive; platforms take priority when a name matches both. Omitted means the organization default. Unrecognized values are rejected with a 400 whose error body lists the available platform labels and outpost pool names. title: Platform profile_id: anyOf: - type: string - type: 'null' description: Scan profile to apply to the scan. title: Profile Id repo_name: anyOf: - type: string - type: 'null' description: >- Full name of the repository to scan. Provide exactly one of repo_name or repos. title: Repo Name repos: anyOf: - items: $ref: '#/components/schemas/ScanRepoRequest' maxItems: 200 type: array - type: 'null' description: >- Repositories covered by one scan; the first entry is the scan's primary repository. Provide exactly one of repo_name or repos. title: Repos scan_type: anyOf: - enum: - security - performance - db-queries - test-coverage - dead-code - code-quality - cleanup - telemetry - accessibility - compliance - general - migration-docs type: string - type: 'null' description: >- Type of scan to run. Must match the profile's scan type when a profile is given; defaults to the profile's type, or 'security' for profile-less scans. Non-security types require a profile and are rejected without one. title: Scan Type title: OrgCodeScanCreateRequest type: object CodeScanResponse: description: A single code scan. properties: attachments: description: Files attached to the scan when it was created. items: $ref: '#/components/schemas/CodeScanAttachmentResponse' title: Attachments type: array created_at: description: When the scan was created (unix seconds). title: Created At type: integer effort: description: >- Scan effort: 'normal' uses lower model reasoning effort with larger investigation batches; 'deep' runs the full pipeline. enum: - normal - deep title: Effort type: string host: anyOf: - type: string - type: 'null' description: Git host of the repository, if known. title: Host org_id: description: Organization the scan belongs to. title: Org Id type: string outpost_pool_id: anyOf: - type: string - type: 'null' description: Outpost pool the scan's sessions run on, if one is set. title: Outpost Pool Id platform: anyOf: - type: string - type: 'null' description: >- Hosted platform label the scan's sessions run on. Null when the scan runs on an outpost pool or the organization default. title: Platform profile: anyOf: - $ref: '#/components/schemas/CodeScanProfileResponse' - type: 'null' description: Profile the scan ran under, if any. repo_full_name: anyOf: - type: string - type: 'null' description: >- Host-qualified identity of the primary repository (e.g. github.com/org/repo). Null for Perforce depots, which have no git host. title: Repo Full Name repo_name: description: >- Primary repository of the scan. Multi-repo scans cover additional repositories not listed here. title: Repo Name type: string scan_id: description: Unique identifier for the scan. title: Scan Id type: string scan_type: description: Type of scan, stamped at creation. enum: - security - performance - db-queries - test-coverage - dead-code - code-quality - cleanup - telemetry - accessibility - compliance - general - migration-docs title: Scan Type type: string status: description: >- Scan status: waiting, pending, running, awaiting_user_input, completed, failed, or cancelled. enum: - waiting - pending - running - awaiting_user_input - completed - failed - cancelled title: Status type: string url: description: URL of the scan's page in the Devin webapp. title: Url type: string required: - scan_id - org_id - repo_name - host - status - profile - scan_type - created_at - effort - url title: CodeScanResponse type: object ProblemDetail: description: >- RFC 9457 application/problem+json error body for the v3 API. detail is retained from the legacy {"detail": ...} body for back-compat; the other members are additive. errors carries field-level validation failures (422 only). properties: detail: anyOf: - type: string - type: 'null' description: A human-readable explanation specific to this occurrence. title: Detail error_code: anyOf: - type: string - type: 'null' description: >- Machine-readable code for blocked-action refusals (e.g. "user_frozen", "migrated_session"). title: Error Code errors: anyOf: - items: additionalProperties: true type: object type: array - type: 'null' description: Field-level validation errors (422 responses only). title: Errors instance: anyOf: - type: string - type: 'null' description: A URI reference (the request path) for this occurrence. title: Instance status: description: The HTTP status code. title: Status type: integer title: description: A short, human-readable summary of the problem type. title: Title type: string type: default: about:blank description: A URI reference identifying the problem type. title: Type type: string required: - title - status title: ProblemDetail type: object NewScanBudget: properties: acu_limit: description: >- Per-cycle ACU limit of a new budget that pays for the scan, its child sessions and its remediations. maximum: 1000000 minimum: 0 title: Acu Limit type: integer required: - acu_limit title: NewScanBudget type: object ScanRepoRequest: description: A repository to include in a multi-repo scan. properties: host: anyOf: - type: string - type: 'null' description: Git host of the repository, if known. title: Host repo_name: description: Full name of the repository to scan. title: Repo Name type: string required: - repo_name title: ScanRepoRequest type: object CodeScanAttachmentResponse: description: A file attached to a code scan at creation. properties: filename: description: Name of the attached file. title: Filename type: string url: description: Devin attachment URL of the file. title: Url type: string required: - url - filename title: CodeScanAttachmentResponse type: object CodeScanProfileResponse: description: Summary of the profile a scan ran under. properties: name: description: Name of the profile. title: Name type: string profile_id: description: Unique identifier for the profile. title: Profile Id type: string required: - profile_id - name title: CodeScanProfileResponse type: object securitySchemes: bearerAuth: description: 'Service User credential (prefix: cog_)' scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.