Skip to main content
PATCH
Continue Scan Upload

Authorizations

CORGEA-TOKEN
string
header
required

API key for authentication

Headers

Upload-Offset
integer
required

Current byte offset of the upload

Upload-Length
integer
required

Total size of the file in bytes

Upload-Name
string
required

Name of the file being uploaded

CORGEA-SOURCE
enum<string>
default:api

Identifies the client that triggered the scan. Requests without this header are attributed to the API.

Available options:
api,
cli,
vscode,
vs2022,
intellij

Path Parameters

transfer_id
string<uuid>
required

The transfer ID from the initial scan request

Body

multipart/form-data
chunk_data
file
required

The next chunk of data for the scan

project_name
string
branch
string
repo_url
string
sha
string
partial_scan
enum<string>

Omit this field for a full scan. Send true only for a partial scan. The API treats any non-empty form value as a partial scan, including the string false.

Available options:
true
files_to_scan
string

Comma-separated list of files to scan

metadata
string

User-supplied scan metadata as a JSON object string, e.g. {"pipeline_url":"https://ci.example/run/123"}. Validated on every chunk request and attached to the scan once the upload completes. Must be a JSON object of at most 16,384 bytes; otherwise the request fails with 400.

dirty
enum<string>

Whether the uploaded worktree is dirty. The CLI sends true or false when it has repo info. Omit the field if dirtiness is unknown.

Available options:
true,
false
scan_configs
string

Comma-separated scan-type tokens applied when the upload completes (base, malicious, policy, secrets, pii, and others). The CLI maps --scan-type blast to base. Omit for server defaults.

target_policies
string

Comma-separated policy IDs applied when the upload completes. Invalid IDs return 400.

Response

Chunk accepted. Intermediate responses set Upload-Offset. Completing and already-in-progress responses do not.

status
enum<string>
required
Available options:
ok
Example:

"ok"

message
string
required
scan_id
string<uuid>

Present when the last chunk completes and a scan starts.

Example:

"1a5afaa3-72ac-458f-a492-ac40ffc88e76"

project_id
integer

Present with scan_id when a scan starts.