Create a new scan

POST https://app.cyrion.ai/api/scans

Create and optionally start a new security scan for the authenticated user.

Enforces:

  • Plan feature access (Lite: web, repository, code and IP; Hacker adds mobile; Red Team adds cloud and AI applications)
  • Concurrent scan limits for your plan
  • Credit balance requirements

Request body

  • auth_config (object): Authentication configuration
  • auto_start (boolean): Automatically start the scan after creation
  • client_id (string): Optional clients.id pointer when the scan is created against a known client.
  • client_name (string): Client/company name for the scan
  • compliance_flags (object[]): Structured compliance regimes the agent must respect — list of {code, version?, rules?} objects (e.g. [{'code':'PCI-DSS','version':'4.0','rules':'no-pan-extraction'}]). Each flag is rendered as a directive block in the agent task with hard do-not-extract / redact rules and surfaced in the dashboard. Empty list = no regime declared.
  • context_files (object[]): List of context files with {upload_id, filename, file_type, file_path, extracted_content}
  • custom_cookie (string): Custom Cookie header
  • custom_user_agent (string): Custom User-Agent header
  • engagement_rules (string): Rules of engagement including scope, out-of-scope targets, and testing rules
  • max_iterations (integer): Maximum agent iterations (2000+ recommended for thorough testing)
  • max_requests_per_second (integer): Rate limiting - max requests per second
  • mobile_file_path (string): Host path to uploaded mobile app file
  • mobile_upload_id (string): Upload ID for mobile app file (APK/IPA)
  • red_team_config (object): AI red team config. When provided, scan_domain is set to 'ai_red_team'
  • run_name (string): Custom name for the scan run
  • scan_config (string): Additional scan configuration (JSON or text)
  • scan_mode (string): Scan mode: quick (30min, fewer agents), standard (balanced), aggressive (deep), thorough (max coverage)
  • scan_rules (object): Structured scan rules with validated scope, auth (incl. TOTP), vulnerability focus, and reporting config. Accepts JSON object or YAML string.
  • scheduled_at (string): ISO datetime to schedule the scan for (e.g., '2024-12-20T10:00:00')
  • stealth_mode (boolean): Route traffic through Tor for anonymity
  • target (string, required): Primary target URL, repository, or IP address
  • target_type (string): Type of target (auto-detected if not provided)
  • targets (string[]): Additional targets (for multi-target scans)
  • user_instructions (string): Additional instructions for the scan

Responses

  • 201 Successful Response
  • 422 Validation Error