curl --request PATCH \
--url https://www.corgea.app/api/v1/start-scan/{transfer_id}/ \
--header 'CORGEA-TOKEN: <api-key>' \
--header 'Content-Type: multipart/form-data' \
--header 'Upload-Length: <upload-length>' \
--header 'Upload-Name: <upload-name>' \
--header 'Upload-Offset: <upload-offset>' \
--form chunk_data='@example-file' \
--form 'project_name=<string>' \
--form 'branch=<string>' \
--form 'repo_url=<string>' \
--form 'sha=<string>' \
--form partial_scan=true \
--form 'files_to_scan=<string>' \
--form 'metadata=<string>' \
--form 'scan_configs=<string>' \
--form 'target_policies=<string>'import requests
url = "https://www.corgea.app/api/v1/start-scan/{transfer_id}/"
files = { "chunk_data": ("example-file", open("example-file", "rb")) }
payload = {
"project_name": "<string>",
"branch": "<string>",
"repo_url": "<string>",
"sha": "<string>",
"partial_scan": "true",
"files_to_scan": "<string>",
"metadata": "<string>",
"scan_configs": "<string>",
"target_policies": "<string>"
}
headers = {
"Upload-Offset": "<upload-offset>",
"Upload-Length": "<upload-length>",
"Upload-Name": "<upload-name>",
"CORGEA-TOKEN": "<api-key>"
}
response = requests.patch(url, data=payload, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('chunk_data', '<string>');
form.append('project_name', '<string>');
form.append('branch', '<string>');
form.append('repo_url', '<string>');
form.append('sha', '<string>');
form.append('partial_scan', 'true');
form.append('files_to_scan', '<string>');
form.append('metadata', '<string>');
form.append('scan_configs', '<string>');
form.append('target_policies', '<string>');
const options = {
method: 'PATCH',
headers: {
'Upload-Offset': '<upload-offset>',
'Upload-Length': '<upload-length>',
'Upload-Name': '<upload-name>',
'CORGEA-TOKEN': '<api-key>'
}
};
options.body = form;
fetch('https://www.corgea.app/api/v1/start-scan/{transfer_id}/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://www.corgea.app/api/v1/start-scan/{transfer_id}/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"chunk_data\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"project_name\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"branch\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"repo_url\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"sha\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"partial_scan\"\r\n\r\ntrue\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files_to_scan\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadata\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"scan_configs\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"target_policies\"\r\n\r\n<string>\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"CORGEA-TOKEN: <api-key>",
"Content-Type: multipart/form-data",
"Upload-Length: <upload-length>",
"Upload-Name: <upload-name>",
"Upload-Offset: <upload-offset>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://www.corgea.app/api/v1/start-scan/{transfer_id}/"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"chunk_data\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"project_name\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"branch\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"repo_url\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"sha\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"partial_scan\"\r\n\r\ntrue\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files_to_scan\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadata\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"scan_configs\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"target_policies\"\r\n\r\n<string>\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Upload-Offset", "<upload-offset>")
req.Header.Add("Upload-Length", "<upload-length>")
req.Header.Add("Upload-Name", "<upload-name>")
req.Header.Add("CORGEA-TOKEN", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://www.corgea.app/api/v1/start-scan/{transfer_id}/")
.header("Upload-Offset", "<upload-offset>")
.header("Upload-Length", "<upload-length>")
.header("Upload-Name", "<upload-name>")
.header("CORGEA-TOKEN", "<api-key>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"chunk_data\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"project_name\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"branch\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"repo_url\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"sha\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"partial_scan\"\r\n\r\ntrue\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files_to_scan\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadata\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"scan_configs\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"target_policies\"\r\n\r\n<string>\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://www.corgea.app/api/v1/start-scan/{transfer_id}/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Upload-Offset"] = '<upload-offset>'
request["Upload-Length"] = '<upload-length>'
request["Upload-Name"] = '<upload-name>'
request["CORGEA-TOKEN"] = '<api-key>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"chunk_data\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"project_name\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"branch\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"repo_url\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"sha\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"partial_scan\"\r\n\r\ntrue\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files_to_scan\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadata\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"scan_configs\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"target_policies\"\r\n\r\n<string>\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"status": "ok",
"message": "Chunk received."
}Continue Scan Upload
Continue a BLAST chunked upload. This path requires a trailing slash. Intermediate responses include the Upload-Offset header and no scan_id. When the last chunk completes the archive, the JSON body includes scan_id and project_id and does not set Upload-Offset.
curl --request PATCH \
--url https://www.corgea.app/api/v1/start-scan/{transfer_id}/ \
--header 'CORGEA-TOKEN: <api-key>' \
--header 'Content-Type: multipart/form-data' \
--header 'Upload-Length: <upload-length>' \
--header 'Upload-Name: <upload-name>' \
--header 'Upload-Offset: <upload-offset>' \
--form chunk_data='@example-file' \
--form 'project_name=<string>' \
--form 'branch=<string>' \
--form 'repo_url=<string>' \
--form 'sha=<string>' \
--form partial_scan=true \
--form 'files_to_scan=<string>' \
--form 'metadata=<string>' \
--form 'scan_configs=<string>' \
--form 'target_policies=<string>'import requests
url = "https://www.corgea.app/api/v1/start-scan/{transfer_id}/"
files = { "chunk_data": ("example-file", open("example-file", "rb")) }
payload = {
"project_name": "<string>",
"branch": "<string>",
"repo_url": "<string>",
"sha": "<string>",
"partial_scan": "true",
"files_to_scan": "<string>",
"metadata": "<string>",
"scan_configs": "<string>",
"target_policies": "<string>"
}
headers = {
"Upload-Offset": "<upload-offset>",
"Upload-Length": "<upload-length>",
"Upload-Name": "<upload-name>",
"CORGEA-TOKEN": "<api-key>"
}
response = requests.patch(url, data=payload, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('chunk_data', '<string>');
form.append('project_name', '<string>');
form.append('branch', '<string>');
form.append('repo_url', '<string>');
form.append('sha', '<string>');
form.append('partial_scan', 'true');
form.append('files_to_scan', '<string>');
form.append('metadata', '<string>');
form.append('scan_configs', '<string>');
form.append('target_policies', '<string>');
const options = {
method: 'PATCH',
headers: {
'Upload-Offset': '<upload-offset>',
'Upload-Length': '<upload-length>',
'Upload-Name': '<upload-name>',
'CORGEA-TOKEN': '<api-key>'
}
};
options.body = form;
fetch('https://www.corgea.app/api/v1/start-scan/{transfer_id}/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://www.corgea.app/api/v1/start-scan/{transfer_id}/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"chunk_data\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"project_name\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"branch\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"repo_url\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"sha\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"partial_scan\"\r\n\r\ntrue\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files_to_scan\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadata\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"scan_configs\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"target_policies\"\r\n\r\n<string>\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"CORGEA-TOKEN: <api-key>",
"Content-Type: multipart/form-data",
"Upload-Length: <upload-length>",
"Upload-Name: <upload-name>",
"Upload-Offset: <upload-offset>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://www.corgea.app/api/v1/start-scan/{transfer_id}/"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"chunk_data\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"project_name\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"branch\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"repo_url\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"sha\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"partial_scan\"\r\n\r\ntrue\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files_to_scan\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadata\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"scan_configs\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"target_policies\"\r\n\r\n<string>\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Upload-Offset", "<upload-offset>")
req.Header.Add("Upload-Length", "<upload-length>")
req.Header.Add("Upload-Name", "<upload-name>")
req.Header.Add("CORGEA-TOKEN", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://www.corgea.app/api/v1/start-scan/{transfer_id}/")
.header("Upload-Offset", "<upload-offset>")
.header("Upload-Length", "<upload-length>")
.header("Upload-Name", "<upload-name>")
.header("CORGEA-TOKEN", "<api-key>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"chunk_data\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"project_name\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"branch\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"repo_url\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"sha\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"partial_scan\"\r\n\r\ntrue\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files_to_scan\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadata\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"scan_configs\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"target_policies\"\r\n\r\n<string>\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://www.corgea.app/api/v1/start-scan/{transfer_id}/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Upload-Offset"] = '<upload-offset>'
request["Upload-Length"] = '<upload-length>'
request["Upload-Name"] = '<upload-name>'
request["CORGEA-TOKEN"] = '<api-key>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"chunk_data\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"project_name\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"branch\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"repo_url\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"sha\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"partial_scan\"\r\n\r\ntrue\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"files_to_scan\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"metadata\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"scan_configs\"\r\n\r\n<string>\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"target_policies\"\r\n\r\n<string>\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"status": "ok",
"message": "Chunk received."
}Authorizations
API key for authentication
Headers
Current byte offset of the upload
Total size of the file in bytes
Name of the file being uploaded
Identifies the client that triggered the scan. Requests without this header are attributed to the API.
api, cli, vscode, vs2022, intellij Path Parameters
The transfer ID from the initial scan request
Body
The next chunk of data for the scan
Omit this field for a full scan. Send true only for a partial scan. The API treats any non-empty form value as a partial scan, including the string false.
true Comma-separated list of files to scan
User-supplied scan metadata as a JSON object string, e.g. {"pipeline_url":"https://ci.example/run/123"}. Validated on every chunk request and attached to the scan once the upload completes. Must be a JSON object of at most 16,384 bytes; otherwise the request fails with 400.
Whether the uploaded worktree is dirty. The CLI sends true or false when it has repo info. Omit the field if dirtiness is unknown.
true, false Comma-separated scan-type tokens applied when the upload completes (base, malicious, policy, secrets, pii, and others). The CLI maps --scan-type blast to base. Omit for server defaults.
Comma-separated policy IDs applied when the upload completes. Invalid IDs return 400.
Response
Chunk accepted. Intermediate responses set Upload-Offset. Completing and already-in-progress responses do not.
Was this page helpful?
