--- title: Create scan --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Vulnerability Scanner](https://developers.cloudflare.com/api/go/resources/vulnerability_scanner) [Scans](https://developers.cloudflare.com/api/go/resources/vulnerability_scanner/subresources/scans) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Create scan client.VulnerabilityScanner.Scans.New(ctx, params) (\*[ScanNewResponse](), error) POST/accounts/{account\_id}/vuln\_scanner/scans Creates and starts a new vulnerability scan. The response may include non-fatal warnings in the `messages` array. ##### Security
API Token The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
##### ParametersExpand Collapse
params ScanNewParams AccountID param.Field\[string] Path param: Identifier. maxLength32 Link to this property
CredentialSets param.Field\[ScanNewParamsCredentialSets] Body param: Credential set references for a BOLA scan. The scanner uses the owner credentials for legitimate requests and the attacker credentials to attempt unauthorized access. Attacker string Credential set ID for the attacker. formatuuid Link to this property Owner string Credential set ID for the resource owner. formatuuid Link to this property
Link to this property OpenAPI param.Field\[string] Body param: OpenAPI schema definition for the API under test. The scanner uses this to discover endpoints and construct requests. Link to this property
ScanType param.Field\[ScanNewParamsScanType] Body param const ScanNewParamsScanTypeBOLA ScanNewParamsScanType = "bola" Link to this property
Link to this property TargetEnvironmentID param.Field\[string] Body param: The target environment to scan. formatuuid Link to this property
[Link to this property](<#(resource)%20vulnerability_scanner.scans%20%3E%20(method)%20create%20%3E%20(params)%20default>) ##### ReturnsExpand Collapse
type ScanNewResponse struct{…} ID string Scan identifier. formatuuid Link to this property ScanType ScanNewResponseScanType The type of vulnerability scan. Link to this property
Status ScanNewResponseStatus Current lifecycle status of the scan. One of the following: const ScanNewResponseStatusCreated ScanNewResponseStatus = "created" Link to this property const ScanNewResponseStatusScheduled ScanNewResponseStatus = "scheduled" Link to this property const ScanNewResponseStatusPlanning ScanNewResponseStatus = "planning" Link to this property const ScanNewResponseStatusRunning ScanNewResponseStatus = "running" Link to this property const ScanNewResponseStatusFinished ScanNewResponseStatus = "finished" Link to this property const ScanNewResponseStatusFailed ScanNewResponseStatus = "failed" Link to this property
Link to this property TargetEnvironmentID string The target environment this scan runs against. formatuuid Link to this property
Report ScanNewResponseReportOptional Vulnerability report produced after the scan completes. The shape depends on the scan type. Present only for finished scans.
Report ScanNewResponseReportReport Version 1 of the BOLA vulnerability scan report.
Summary ScanNewResponseReportReportSummary Summary of all steps and findings.
Verdict ScanNewResponseReportReportSummaryVerdict Overall verdict of the vulnerability scan. One of the following: const ScanNewResponseReportReportSummaryVerdictOk ScanNewResponseReportReportSummaryVerdict = "ok" Link to this property const ScanNewResponseReportReportSummaryVerdictWarning ScanNewResponseReportReportSummaryVerdict = "warning" Link to this property const ScanNewResponseReportReportSummaryVerdictInconclusive ScanNewResponseReportReportSummaryVerdict = "inconclusive" Link to this property
Link to this property
Link to this property
Tests \[]ScanNewResponseReportReportTest List of tests that were run.
Steps \[]ScanNewResponseReportReportTestsStep Steps that were executed.
Assertions \[]ScanNewResponseReportReportTestsStepsAssertion Assertions that were made against the received response. Description string Human-readable description of the assertion, explaining what was checked. Link to this property
Kind ScanNewResponseReportReportTestsStepsAssertionsKind Kind of assertion.
Parameters ScanNewResponseReportReportTestsStepsAssertionsKindParameters Range of HTTP status codes. Max int64 Maximum (inclusive) status code of the range. maximum65535 minimum0 Link to this property Min int64 Minimum (inclusive) status code of the range. maximum65535 minimum0 Link to this property
Link to this property Type ScanNewResponseReportReportTestsStepsAssertionsKindType Link to this property
Link to this property Observed int64 Observed value on which the assertion was made. Link to this property
Outcome ScanNewResponseReportReportTestsStepsAssertionsOutcome Outcome of the assertion. One of the following: const ScanNewResponseReportReportTestsStepsAssertionsOutcomeOk ScanNewResponseReportReportTestsStepsAssertionsOutcome = "ok" Link to this property const ScanNewResponseReportReportTestsStepsAssertionsOutcomeFail ScanNewResponseReportReportTestsStepsAssertionsOutcome = "fail" Link to this property const ScanNewResponseReportReportTestsStepsAssertionsOutcomeInconclusive ScanNewResponseReportReportTestsStepsAssertionsOutcome = "inconclusive" Link to this property
Link to this property
Link to this property
Errors \[]ScanNewResponseReportReportTestsStepsErrorOptional Errors the step encountered that may explain absent or incomplete fields. Description string Human-readable error description. Link to this property ErrorCode int64Optional Numeric error code identifying the class of error, if available. formatuint32 minimum0 Link to this property
Link to this property
Request ScanNewResponseReportReportTestsStepsRequestOptional HTTP request that was made, if any.
CredentialSet ScanNewResponseReportReportTestsStepsRequestCredentialSet Credential set that was used. ID string ID of the credential set. formatuuid Link to this property
Role ScanNewResponseReportReportTestsStepsRequestCredentialSetRole Role of the credential set. One of the following: const ScanNewResponseReportReportTestsStepsRequestCredentialSetRoleOwner ScanNewResponseReportReportTestsStepsRequestCredentialSetRole = "owner" Link to this property const ScanNewResponseReportReportTestsStepsRequestCredentialSetRoleAttacker ScanNewResponseReportReportTestsStepsRequestCredentialSetRole = "attacker" Link to this property
Link to this property
Link to this property HeaderNames \[]string Names of headers that were sent. Link to this property
Method ScanNewResponseReportReportTestsStepsRequestMethod HTTP method. One of the following: const ScanNewResponseReportReportTestsStepsRequestMethodGet ScanNewResponseReportReportTestsStepsRequestMethod = "GET" Link to this property const ScanNewResponseReportReportTestsStepsRequestMethodDelete ScanNewResponseReportReportTestsStepsRequestMethod = "DELETE" Link to this property const ScanNewResponseReportReportTestsStepsRequestMethodPatch ScanNewResponseReportReportTestsStepsRequestMethod = "PATCH" Link to this property const ScanNewResponseReportReportTestsStepsRequestMethodPost ScanNewResponseReportReportTestsStepsRequestMethod = "POST" Link to this property const ScanNewResponseReportReportTestsStepsRequestMethodPut ScanNewResponseReportReportTestsStepsRequestMethod = "PUT" Link to this property
Link to this property URL string Exact and full URL (including host, query parameters) that was requested. formaturi Link to this property
VariableCaptures \[]ScanNewResponseReportReportTestsStepsRequestVariableCapture Variable captures requested for this step. JsonPath string JSONPath expression used for capture, e.g. "$.id". Link to this property Name string Variable name, e.g. "resource_id". Link to this property
Link to this property Body unknownOptional Request body, if any. Link to this property
Link to this property
Response ScanNewResponseReportReportTestsStepsResponseOptional HTTP response that was received, if any.
Body ScanNewResponseReportReportTestsStepsResponseBody HTTP response body. One of the following:
type ScanNewResponseReportReportTestsStepsResponseBodyVulnScannerBOLABodyResponseNotFound struct{…} No body was received. Kind ScanNewResponseReportReportTestsStepsResponseBodyVulnScannerBOLABodyResponseNotFoundKind Link to this property
Link to this property
type ScanNewResponseReportReportTestsStepsResponseBodyVulnScannerBOLABodyResponseBytes struct{…} Body received but unable to read as UTF-8. Raw bytes, base64-encoded. Contents string Link to this property Kind ScanNewResponseReportReportTestsStepsResponseBodyVulnScannerBOLABodyResponseBytesKind Link to this property Truncated bool Link to this property
Link to this property
type ScanNewResponseReportReportTestsStepsResponseBodyVulnScannerBOLABodyResponseText struct{…} Body received as valid UTF-8 text but not valid JSON. Contents string Link to this property Kind ScanNewResponseReportReportTestsStepsResponseBodyVulnScannerBOLABodyResponseTextKind Link to this property Truncated bool Link to this property
Link to this property
type ScanNewResponseReportReportTestsStepsResponseBodyVulnScannerBOLABodyResponseJson struct{…} Body received as valid JSON. Contents string Link to this property Kind ScanNewResponseReportReportTestsStepsResponseBodyVulnScannerBOLABodyResponseJsonKind Link to this property Truncated bool Link to this property
Link to this property
Link to this property HeaderNames \[]string Names of headers that were received. Link to this property Status int64 HTTP status code. maximum65535 minimum0 Link to this property StatusText stringOptional HTTP status text, if available for the status code. Link to this property
Link to this property
Link to this property
Verdict ScanNewResponseReportReportTestsVerdict Verdict of this single test. One of the following: const ScanNewResponseReportReportTestsVerdictOk ScanNewResponseReportReportTestsVerdict = "ok" Link to this property const ScanNewResponseReportReportTestsVerdictWarning ScanNewResponseReportReportTestsVerdict = "warning" Link to this property const ScanNewResponseReportReportTestsVerdictInconclusive ScanNewResponseReportReportTestsVerdict = "inconclusive" Link to this property
Link to this property
PreflightErrors \[]ScanNewResponseReportReportTestsPreflightErrorOptional Errors that prevented step execution. Description string Human-readable error description. Link to this property ErrorCode int64Optional Numeric error code identifying the class of error, if available. formatuint32 minimum0 Link to this property
Link to this property
Link to this property
Link to this property ReportSchemaVersion ScanNewResponseReportReportSchemaVersion Version of the report schema. Link to this property
Link to this property
[Link to this property](<#(resource)%20vulnerability_scanner.scans%20%3E%20(model)%20ScanNewResponse%20%3E%20(schema)>) ### Create scan Go HTTPTypeScriptPythonGoTerraform ``` package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/option" "github.com/cloudflare/cloudflare-go/vulnerability_scanner" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) scan, err := client.VulnerabilityScanner.Scans.New(context.TODO(), vulnerability_scanner.ScanNewParams{ AccountID: cloudflare.F("023e105f4ecef8ad9ca31a8372d0c353"), CredentialSets: cloudflare.F(vulnerability_scanner.ScanNewParamsCredentialSets{ Attacker: cloudflare.F("182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"), Owner: cloudflare.F("182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"), }), OpenAPI: cloudflare.F("open_api"), ScanType: cloudflare.F(vulnerability_scanner.ScanNewParamsScanTypeBOLA), TargetEnvironmentID: cloudflare.F("182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", scan.ID) } ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "scan_type": "bola", "status": "created", "target_environment_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "report": { "report": { "summary": { "verdict": "ok" }, "tests": [ { "steps": [ { "assertions": [ { "description": "description", "kind": { "parameters": { "max": 0, "min": 0 }, "type": "http_status_within_range" }, "observed": 0, "outcome": "ok" } ], "errors": [ { "description": "description", "error_code": 0 } ], "request": { "credential_set": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "role": "owner" }, "header_names": [ "string" ], "method": "GET", "url": "https://example.com", "variable_captures": [ { "json_path": "json_path", "name": "name" } ], "body": {} }, "response": { "body": { "kind": "not_found" }, "header_names": [ "string" ], "status": 0, "status_text": "status_text" } } ], "verdict": "ok", "preflight_errors": [ { "description": "description", "error_code": 0 } ] } ] }, "report_schema_version": "v1" } }, "result_info": {} } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "scan_type": "bola", "status": "created", "target_environment_id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "report": { "report": { "summary": { "verdict": "ok" }, "tests": [ { "steps": [ { "assertions": [ { "description": "description", "kind": { "parameters": { "max": 0, "min": 0 }, "type": "http_status_within_range" }, "observed": 0, "outcome": "ok" } ], "errors": [ { "description": "description", "error_code": 0 } ], "request": { "credential_set": { "id": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "role": "owner" }, "header_names": [ "string" ], "method": "GET", "url": "https://example.com", "variable_captures": [ { "json_path": "json_path", "name": "name" } ], "body": {} }, "response": { "body": { "kind": "not_found" }, "header_names": [ "string" ], "status": 0, "status_text": "status_text" } } ], "verdict": "ok", "preflight_errors": [ { "description": "description", "error_code": 0 } ] } ] }, "report_schema_version": "v1" } }, "result_info": {} } ```