# Start a scan

`POST /app/scans`

Starts every enabled scanner on a verified asset. With issueId it re-checks that issue (its scanner runs even when turned off for the asset). 409 with the running scan when one is in progress; 403 when the daily scan limits are reached.

Scope: `scans:write`.

## Request body

- `assetId` (integer)
- `issueId` (integer)

## Example

```bash
curl -X POST "https://api.fortwatch.ai/app/scans" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "assetId": 42,
  "issueId": 42
}'
```

## Response 201

Created.

- `id` (number, required)
- `assetId` (number, required)
- `status` (string, required)
- `triggeredBy` (string, required)
- `triggeredByUserId` (number | null, required)
- `failureCode` (string | null, required)
- `failureDetail` (string | null, required)
- `scannerIp` (string | null, required)
- `startedAt` (string (date-time) | null, required)
- `completedAt` (string (date-time) | null, required)
- `createdAt` (string (date-time), required)
- `updatedAt` (string (date-time), required)
- `asset` (object, required)
  - `id` (number, required)
  - `projectId` (number, required)
  - `name` (string | null, required)
  - `type` (string, required)
  - `value` (string, required)
  - `status` (string, required)
  - `canonicalUrl` (string | null, required)
  - `resolvedIp` (string | null, required)
  - `cdnProvider` (string | null, required)
  - `bucketProvider` (string | null, required)
  - `lastCheckedAt` (string (date-time) | null, required)
  - `failReason` (string | null, required)
  - `skippedRedirectHost` (string | null, required)
  - `disabledScannerTypes` (string[], required)
  - `portScanMode` (string, required)
  - `nucleiMinSeverity` (string, required)
  - `ownershipVerifiedAt` (string (date-time) | null, required)
  - `ownershipToken` (string, required)
  - `ownershipMethod` (string | null, required)
  - `createdAt` (string (date-time), required)
  - `updatedAt` (string (date-time), required)
  - `project` (object, required)
    - `id` (number, required)
    - `name` (string, required)
- `scanners` (string[], required)
- `forcedScanners` (string[], required)
- `jobsTotal` (number, required)
- `jobsDone` (number, required)

```json
{
  "id": 42,
  "assetId": 42,
  "status": "string",
  "triggeredBy": "string",
  "triggeredByUserId": 42,
  "failureCode": "string",
  "failureDetail": "string",
  "scannerIp": "string",
  "startedAt": "2026-10-16T12:00:00.000Z",
  "completedAt": "2026-10-16T12:00:00.000Z",
  "createdAt": "2026-10-16T12:00:00.000Z",
  "updatedAt": "2026-10-16T12:00:00.000Z",
  "asset": {
    "id": 42,
    "projectId": 42,
    "name": "Production",
    "type": "string",
    "value": "app.example.com",
    "status": "string",
    "canonicalUrl": "string",
    "resolvedIp": "string",
    "cdnProvider": "string",
    "bucketProvider": "string",
    "lastCheckedAt": "2026-10-16T12:00:00.000Z",
    "failReason": "string",
    "skippedRedirectHost": "string",
    "disabledScannerTypes": [
      "string"
    ],
    "portScanMode": "string",
    "nucleiMinSeverity": "string",
    "ownershipVerifiedAt": "2026-10-16T12:00:00.000Z",
    "ownershipToken": "string",
    "ownershipMethod": "string",
    "createdAt": "2026-10-16T12:00:00.000Z",
    "updatedAt": "2026-10-16T12:00:00.000Z",
    "project": {
      "id": 42,
      "name": "Production"
    }
  },
  "scanners": [
    "string"
  ],
  "forcedScanners": [
    "string"
  ],
  "jobsTotal": 1,
  "jobsDone": 1
}
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.