# Run discovery

`POST /app/discovery/run`

Queues a discovery run for a registrable domain the project has a verified asset under; 202 with the run, or with the one already running. At most 10 an hour per workspace. Also limited per workspace: 10 a hour.

Scope: `assets:write`.

## Request body

- `projectId` (integer, required)
- `domain` (string)

## Example

```bash
curl -X POST "https://api.fortwatch.ai/app/discovery/run" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "projectId": 42,
  "domain": "app.example.com"
}'
```

## Response 202

Accepted: the work is queued.

- `id` (number, required)
- `projectId` (number, required)
- `domain` (string, required)
- `status` (string, required)
- `trigger` (string, required)
- `foundCount` (number, required)
- `newCount` (number, required)
- `wildcardDns` (boolean, required)
- `error` (string | null, required)
- `createdByUserId` (number | null, required)
- `startedAt` (string (date-time) | null, required)
- `finishedAt` (string (date-time) | null, required)
- `createdAt` (string (date-time), required)

```json
{
  "id": 42,
  "projectId": 42,
  "domain": "app.example.com",
  "status": "string",
  "trigger": "string",
  "foundCount": 1,
  "newCount": 1,
  "wildcardDns": true,
  "error": "string",
  "createdByUserId": 42,
  "startedAt": "2026-10-16T12:00:00.000Z",
  "finishedAt": "2026-10-16T12:00:00.000Z",
  "createdAt": "2026-10-16T12:00:00.000Z"
}
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.