How do I launch a scan through the API?

Steps

1. Authenticate each request with your Bearer token. Read how to authenticate if you have not done this yet.
2. Find the profile you want to scan and note its ID.
3. Call POST /api/scans. The reference describes it as "Launch a scan for a profile" and lists scan:run as the permission.
4. For a pipeline, send POST /api/ci/scan with a profileId in the body and, if you wish, a commitSha. That route needs ci:trigger and returns a scanId.
5. Follow the run with GET /api/scans/:id or, for the CI route, GET /api/ci/result/:scanId, and keep checking until the response says the scan has finished, because a typical scan of a small app takes roughly an hour.

Good to know

This page lists the route and the permission, but it does not spell out every field of the request body for the general launch call. The ⤓ OpenAPI button on the page downloads the full spec, so check there for the exact body.

A launched scan behaves like a button press in the app. You will see it in Recent Scans, and the scan detail page shows who started it. It runs with your permissions and group scope, and you can stop a run by calling POST /api/scans/:id/cancel, which needs scan:cancel. That keeps a mistaken launch from running to the end.

Looking for the CI route in more detail? See how to trigger a scan from your pipeline.

Related questions

• How do I trigger a Cyberlop scan from my CI pipeline?
• How do I check a CI-triggered scan's result through the API?
• How do I pull the findings for one scan through the API?
• How do I authenticate requests to the Cyberlop API?
• Can I trigger a CI scan by profile name instead of profile ID?

Full tutorial

Cyberlop API reference: authentication, permissions and the OpenAPI spec

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre