Request security scans for installed repositories
curl --request POST \
--url https://api.coderabbit.ai/v1/security/scans \
--header 'Content-Type: application/json' \
--header 'x-coderabbitai-api-key: <api-key>' \
--data '
{
"repository_ids": [
"<string>"
],
"targets": [],
"org_id": "<string>",
"org_name": "<string>",
"spend_limit_cents": 50000500,
"allow_cap_overage": true
}
'import requests
url = "https://api.coderabbit.ai/v1/security/scans"
payload = {
"repository_ids": ["<string>"],
"targets": [],
"org_id": "<string>",
"org_name": "<string>",
"spend_limit_cents": 50000500,
"allow_cap_overage": True
}
headers = {
"x-coderabbitai-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-coderabbitai-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
repository_ids: ['<string>'],
targets: [],
org_id: '<string>',
org_name: '<string>',
spend_limit_cents: 50000500,
allow_cap_overage: true
})
};
fetch('https://api.coderabbit.ai/v1/security/scans', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"results": [
{
"repo": "<string>",
"status": "triggered",
"triggered": [
"<string>"
],
"skipped": [
"<string>"
],
"blocked": [
"<string>"
],
"failed": [
"<string>"
],
"blockedReason": "<string>",
"blockedRetryAfterSeconds": 123,
"message": "<string>"
}
],
"triggeredCount": 1,
"requestedRepos": 1,
"targets": [
"<string>"
]
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "forbidden",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "not_found",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "head_changed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "precondition_failed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "payload_too_large",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "rate_limit_exceeded",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "internal_error",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unavailable",
"message": "<string>",
"retry_after": 1
}
}Request security scans for installed repositories
Uses existing scan admission, product flags, permission checks and billing. Explicit paid usage confirmation still requires subscription management permission. A triggered result means dispatch was accepted, not that the scan completed.
POST
/
v1
/
security
/
scans
Request security scans for installed repositories
curl --request POST \
--url https://api.coderabbit.ai/v1/security/scans \
--header 'Content-Type: application/json' \
--header 'x-coderabbitai-api-key: <api-key>' \
--data '
{
"repository_ids": [
"<string>"
],
"targets": [],
"org_id": "<string>",
"org_name": "<string>",
"spend_limit_cents": 50000500,
"allow_cap_overage": true
}
'import requests
url = "https://api.coderabbit.ai/v1/security/scans"
payload = {
"repository_ids": ["<string>"],
"targets": [],
"org_id": "<string>",
"org_name": "<string>",
"spend_limit_cents": 50000500,
"allow_cap_overage": True
}
headers = {
"x-coderabbitai-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-coderabbitai-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({
repository_ids: ['<string>'],
targets: [],
org_id: '<string>',
org_name: '<string>',
spend_limit_cents: 50000500,
allow_cap_overage: true
})
};
fetch('https://api.coderabbit.ai/v1/security/scans', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"results": [
{
"repo": "<string>",
"status": "triggered",
"triggered": [
"<string>"
],
"skipped": [
"<string>"
],
"blocked": [
"<string>"
],
"failed": [
"<string>"
],
"blockedReason": "<string>",
"blockedRetryAfterSeconds": 123,
"message": "<string>"
}
],
"triggeredCount": 1,
"requestedRepos": 1,
"targets": [
"<string>"
]
}{
"error": {
"code": "invalid_request",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unauthenticated",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "forbidden",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "not_found",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "head_changed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "precondition_failed",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "payload_too_large",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "rate_limit_exceeded",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "internal_error",
"message": "<string>",
"retry_after": 1
}
}{
"error": {
"code": "unavailable",
"message": "<string>",
"retry_after": 1
}
}- CLI Tool
- MCP Server
coderabbit api request /security/scans --input request.json
An agent connected to the CodeRabbit MCP server runs this operation as the
start_security_scans tool. The connection selects the organization, so the arguments have no org_id or org_name.{
"method": "tools/call",
"params": {
"name": "start_security_scans",
"arguments": {
"repository_ids": [],
"targets": [],
"scan_mode": "map"
}
}
}
Authorizations
See Authentication for the key types and where to create a key.
Body
application/json
Organization for a workspace key: the Git-provider organization ID (scope.provider_organization_id) or the CodeRabbit organization ID (scope.id, or id from list organizations). Supply either org_id or org_name, never both. Omit for organization keys and MCP connections.
Minimum string length:
1Was this page helpful?