--- title: Scans --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [Vulnerability Scanner](https://developers.cloudflare.com/api/typescript/resources/vulnerability_scanner) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Scans ##### [List scans](https://developers.cloudflare.com/api/typescript/resources/vulnerability_scanner/subresources/scans/methods/list) client.vulnerabilityScanner.scans.list(ScanListParams {account\_id, page, per\_page } params, RequestOptionsoptions?): V4PagePaginationArray< [ScanListResponse]() {id, scan\_type, status, 2 more } > GET/accounts/{account\_id}/vuln\_scanner/scans ##### [Create scan](https://developers.cloudflare.com/api/typescript/resources/vulnerability_scanner/subresources/scans/methods/create) client.vulnerabilityScanner.scans.create(ScanCreateParams {account\_id, credential\_sets, open\_api, 2 more } params, RequestOptionsoptions?): [ScanCreateResponse]() {id, scan\_type, status, 2 more } POST/accounts/{account\_id}/vuln\_scanner/scans ##### [Get scan](https://developers.cloudflare.com/api/typescript/resources/vulnerability_scanner/subresources/scans/methods/get) client.vulnerabilityScanner.scans.get(stringscanID, ScanGetParams {account\_id } params, RequestOptionsoptions?): [ScanGetResponse]() {id, scan\_type, status, 2 more } GET/accounts/{account\_id}/vuln\_scanner/scans/{scan\_id} ##### ModelsExpand Collapse
ScanListResponse {id, scan\_type, status, 2 more } id: string Scan identifier. formatuuid Link to this property scan\_type: "bola" The type of vulnerability scan. Link to this property
status: "created"| "scheduled"| "planning"| 3 more Current lifecycle status of the scan. One of the following: "created" Link to this property "scheduled" Link to this property "planning" Link to this property "running" Link to this property "finished" Link to this property "failed" Link to this property
Link to this property target\_environment\_id: string The target environment this scan runs against. formatuuid Link to this property
report?: Report| null Vulnerability report produced after the scan completes. The shape depends on the scan type. Present only for finished scans.
report: Report {summary, tests } Version 1 of the BOLA vulnerability scan report.
summary: Summary {verdict } Summary of all steps and findings.
verdict: "ok"| "warning"| "inconclusive" Overall verdict of the vulnerability scan. One of the following: "ok" Link to this property "warning" Link to this property "inconclusive" Link to this property
Link to this property
Link to this property
tests: Array<Test> List of tests that were run.
steps: Array<Step> Steps that were executed.
assertions: Array<Assertion> Assertions that were made against the received response. description: string Human-readable description of the assertion, explaining what was checked. Link to this property
kind: Kind {parameters, type } Kind of assertion.
parameters: Parameters {max, min } Range of HTTP status codes. max: number Maximum (inclusive) status code of the range. maximum65535 minimum0 Link to this property min: number Minimum (inclusive) status code of the range. maximum65535 minimum0 Link to this property
Link to this property type: "http\_status\_within\_range" Link to this property
Link to this property observed: number| null Observed value on which the assertion was made. Link to this property
outcome: "ok"| "fail"| "inconclusive" Outcome of the assertion. One of the following: "ok" Link to this property "fail" Link to this property "inconclusive" Link to this property
Link to this property
Link to this property
errors?: Array<Error> Errors the step encountered that may explain absent or incomplete fields. description: string Human-readable error description. Link to this property error\_code?: number| null Numeric error code identifying the class of error, if available. formatuint32 minimum0 Link to this property
Link to this property
request?: Request| null HTTP request that was made, if any.
credential\_set: CredentialSet {id, role } Credential set that was used. id: string ID of the credential set. formatuuid Link to this property
role: "owner"| "attacker" Role of the credential set. One of the following: "owner" Link to this property "attacker" Link to this property
Link to this property
Link to this property header\_names: Array<string> Names of headers that were sent. Link to this property
method: "GET"| "DELETE"| "PATCH"| 2 more HTTP method. One of the following: "GET" Link to this property "DELETE" Link to this property "PATCH" Link to this property "POST" Link to this property "PUT" Link to this property
Link to this property url: string Exact and full URL (including host, query parameters) that was requested. formaturi Link to this property
variable\_captures: Array<VariableCapture> Variable captures requested for this step. json\_path: string JSONPath expression used for capture, e.g. "$.id". Link to this property name: string Variable name, e.g. "resource_id". Link to this property
Link to this property body?: unknown Request body, if any. Link to this property
Link to this property
response?: Response| null HTTP response that was received, if any.
body: VulnScannerBOLABodyResponseNotFound {kind } | VulnScannerBOLABodyResponseBytes {contents, kind, truncated } | VulnScannerBOLABodyResponseText {contents, kind, truncated } | VulnScannerBOLABodyResponseJson {contents, kind, truncated } HTTP response body. One of the following:
VulnScannerBOLABodyResponseNotFound {kind } No body was received. kind: "not\_found" Link to this property
Link to this property
VulnScannerBOLABodyResponseBytes {contents, kind, truncated } Body received but unable to read as UTF-8. Raw bytes, base64-encoded. contents: string Link to this property kind: "bytes" Link to this property truncated: boolean Link to this property
Link to this property
VulnScannerBOLABodyResponseText {contents, kind, truncated } Body received as valid UTF-8 text but not valid JSON. contents: string Link to this property kind: "text" Link to this property truncated: boolean Link to this property
Link to this property
VulnScannerBOLABodyResponseJson {contents, kind, truncated } Body received as valid JSON. contents: string Link to this property kind: "json" Link to this property truncated: boolean Link to this property
Link to this property
Link to this property header\_names: Array<string> Names of headers that were received. Link to this property status: number HTTP status code. maximum65535 minimum0 Link to this property status\_text?: string| null HTTP status text, if available for the status code. Link to this property
Link to this property
Link to this property
verdict: "ok"| "warning"| "inconclusive" Verdict of this single test. One of the following: "ok" Link to this property "warning" Link to this property "inconclusive" Link to this property
Link to this property
preflight\_errors?: Array<PreflightError> Errors that prevented step execution. description: string Human-readable error description. Link to this property error\_code?: number| null Numeric error code identifying the class of error, if available. formatuint32 minimum0 Link to this property
Link to this property
Link to this property
Link to this property report\_schema\_version: "v1" Version of the report schema. Link to this property
Link to this property
[Link to this property](<#(resource)%20vulnerability_scanner.scans%20%3E%20(model)%20scan_list_response%20%3E%20(schema)>)
ScanCreateResponse {id, scan\_type, status, 2 more } id: string Scan identifier. formatuuid Link to this property scan\_type: "bola" The type of vulnerability scan. Link to this property
status: "created"| "scheduled"| "planning"| 3 more Current lifecycle status of the scan. One of the following: "created" Link to this property "scheduled" Link to this property "planning" Link to this property "running" Link to this property "finished" Link to this property "failed" Link to this property
Link to this property target\_environment\_id: string The target environment this scan runs against. formatuuid Link to this property
report?: Report| null Vulnerability report produced after the scan completes. The shape depends on the scan type. Present only for finished scans.
report: Report {summary, tests } Version 1 of the BOLA vulnerability scan report.
summary: Summary {verdict } Summary of all steps and findings.
verdict: "ok"| "warning"| "inconclusive" Overall verdict of the vulnerability scan. One of the following: "ok" Link to this property "warning" Link to this property "inconclusive" Link to this property
Link to this property
Link to this property
tests: Array<Test> List of tests that were run.
steps: Array<Step> Steps that were executed.
assertions: Array<Assertion> Assertions that were made against the received response. description: string Human-readable description of the assertion, explaining what was checked. Link to this property
kind: Kind {parameters, type } Kind of assertion.
parameters: Parameters {max, min } Range of HTTP status codes. max: number Maximum (inclusive) status code of the range. maximum65535 minimum0 Link to this property min: number Minimum (inclusive) status code of the range. maximum65535 minimum0 Link to this property
Link to this property type: "http\_status\_within\_range" Link to this property
Link to this property observed: number| null Observed value on which the assertion was made. Link to this property
outcome: "ok"| "fail"| "inconclusive" Outcome of the assertion. One of the following: "ok" Link to this property "fail" Link to this property "inconclusive" Link to this property
Link to this property
Link to this property
errors?: Array<Error> Errors the step encountered that may explain absent or incomplete fields. description: string Human-readable error description. Link to this property error\_code?: number| null Numeric error code identifying the class of error, if available. formatuint32 minimum0 Link to this property
Link to this property
request?: Request| null HTTP request that was made, if any.
credential\_set: CredentialSet {id, role } Credential set that was used. id: string ID of the credential set. formatuuid Link to this property
role: "owner"| "attacker" Role of the credential set. One of the following: "owner" Link to this property "attacker" Link to this property
Link to this property
Link to this property header\_names: Array<string> Names of headers that were sent. Link to this property
method: "GET"| "DELETE"| "PATCH"| 2 more HTTP method. One of the following: "GET" Link to this property "DELETE" Link to this property "PATCH" Link to this property "POST" Link to this property "PUT" Link to this property
Link to this property url: string Exact and full URL (including host, query parameters) that was requested. formaturi Link to this property
variable\_captures: Array<VariableCapture> Variable captures requested for this step. json\_path: string JSONPath expression used for capture, e.g. "$.id". Link to this property name: string Variable name, e.g. "resource_id". Link to this property
Link to this property body?: unknown Request body, if any. Link to this property
Link to this property
response?: Response| null HTTP response that was received, if any.
body: VulnScannerBOLABodyResponseNotFound {kind } | VulnScannerBOLABodyResponseBytes {contents, kind, truncated } | VulnScannerBOLABodyResponseText {contents, kind, truncated } | VulnScannerBOLABodyResponseJson {contents, kind, truncated } HTTP response body. One of the following:
VulnScannerBOLABodyResponseNotFound {kind } No body was received. kind: "not\_found" Link to this property
Link to this property
VulnScannerBOLABodyResponseBytes {contents, kind, truncated } Body received but unable to read as UTF-8. Raw bytes, base64-encoded. contents: string Link to this property kind: "bytes" Link to this property truncated: boolean Link to this property
Link to this property
VulnScannerBOLABodyResponseText {contents, kind, truncated } Body received as valid UTF-8 text but not valid JSON. contents: string Link to this property kind: "text" Link to this property truncated: boolean Link to this property
Link to this property
VulnScannerBOLABodyResponseJson {contents, kind, truncated } Body received as valid JSON. contents: string Link to this property kind: "json" Link to this property truncated: boolean Link to this property
Link to this property
Link to this property header\_names: Array<string> Names of headers that were received. Link to this property status: number HTTP status code. maximum65535 minimum0 Link to this property status\_text?: string| null HTTP status text, if available for the status code. Link to this property
Link to this property
Link to this property
verdict: "ok"| "warning"| "inconclusive" Verdict of this single test. One of the following: "ok" Link to this property "warning" Link to this property "inconclusive" Link to this property
Link to this property
preflight\_errors?: Array<PreflightError> Errors that prevented step execution. description: string Human-readable error description. Link to this property error\_code?: number| null Numeric error code identifying the class of error, if available. formatuint32 minimum0 Link to this property
Link to this property
Link to this property
Link to this property report\_schema\_version: "v1" Version of the report schema. Link to this property
Link to this property
[Link to this property](<#(resource)%20vulnerability_scanner.scans%20%3E%20(model)%20scan_create_response%20%3E%20(schema)>)
ScanGetResponse {id, scan\_type, status, 2 more } id: string Scan identifier. formatuuid Link to this property scan\_type: "bola" The type of vulnerability scan. Link to this property
status: "created"| "scheduled"| "planning"| 3 more Current lifecycle status of the scan. One of the following: "created" Link to this property "scheduled" Link to this property "planning" Link to this property "running" Link to this property "finished" Link to this property "failed" Link to this property
Link to this property target\_environment\_id: string The target environment this scan runs against. formatuuid Link to this property
report?: Report| null Vulnerability report produced after the scan completes. The shape depends on the scan type. Present only for finished scans.
report: Report {summary, tests } Version 1 of the BOLA vulnerability scan report.
summary: Summary {verdict } Summary of all steps and findings.
verdict: "ok"| "warning"| "inconclusive" Overall verdict of the vulnerability scan. One of the following: "ok" Link to this property "warning" Link to this property "inconclusive" Link to this property
Link to this property
Link to this property
tests: Array<Test> List of tests that were run.
steps: Array<Step> Steps that were executed.
assertions: Array<Assertion> Assertions that were made against the received response. description: string Human-readable description of the assertion, explaining what was checked. Link to this property
kind: Kind {parameters, type } Kind of assertion.
parameters: Parameters {max, min } Range of HTTP status codes. max: number Maximum (inclusive) status code of the range. maximum65535 minimum0 Link to this property min: number Minimum (inclusive) status code of the range. maximum65535 minimum0 Link to this property
Link to this property type: "http\_status\_within\_range" Link to this property
Link to this property observed: number| null Observed value on which the assertion was made. Link to this property
outcome: "ok"| "fail"| "inconclusive" Outcome of the assertion. One of the following: "ok" Link to this property "fail" Link to this property "inconclusive" Link to this property
Link to this property
Link to this property
errors?: Array<Error> Errors the step encountered that may explain absent or incomplete fields. description: string Human-readable error description. Link to this property error\_code?: number| null Numeric error code identifying the class of error, if available. formatuint32 minimum0 Link to this property
Link to this property
request?: Request| null HTTP request that was made, if any.
credential\_set: CredentialSet {id, role } Credential set that was used. id: string ID of the credential set. formatuuid Link to this property
role: "owner"| "attacker" Role of the credential set. One of the following: "owner" Link to this property "attacker" Link to this property
Link to this property
Link to this property header\_names: Array<string> Names of headers that were sent. Link to this property
method: "GET"| "DELETE"| "PATCH"| 2 more HTTP method. One of the following: "GET" Link to this property "DELETE" Link to this property "PATCH" Link to this property "POST" Link to this property "PUT" Link to this property
Link to this property url: string Exact and full URL (including host, query parameters) that was requested. formaturi Link to this property
variable\_captures: Array<VariableCapture> Variable captures requested for this step. json\_path: string JSONPath expression used for capture, e.g. "$.id". Link to this property name: string Variable name, e.g. "resource_id". Link to this property
Link to this property body?: unknown Request body, if any. Link to this property
Link to this property
response?: Response| null HTTP response that was received, if any.
body: VulnScannerBOLABodyResponseNotFound {kind } | VulnScannerBOLABodyResponseBytes {contents, kind, truncated } | VulnScannerBOLABodyResponseText {contents, kind, truncated } | VulnScannerBOLABodyResponseJson {contents, kind, truncated } HTTP response body. One of the following:
VulnScannerBOLABodyResponseNotFound {kind } No body was received. kind: "not\_found" Link to this property
Link to this property
VulnScannerBOLABodyResponseBytes {contents, kind, truncated } Body received but unable to read as UTF-8. Raw bytes, base64-encoded. contents: string Link to this property kind: "bytes" Link to this property truncated: boolean Link to this property
Link to this property
VulnScannerBOLABodyResponseText {contents, kind, truncated } Body received as valid UTF-8 text but not valid JSON. contents: string Link to this property kind: "text" Link to this property truncated: boolean Link to this property
Link to this property
VulnScannerBOLABodyResponseJson {contents, kind, truncated } Body received as valid JSON. contents: string Link to this property kind: "json" Link to this property truncated: boolean Link to this property
Link to this property
Link to this property header\_names: Array<string> Names of headers that were received. Link to this property status: number HTTP status code. maximum65535 minimum0 Link to this property status\_text?: string| null HTTP status text, if available for the status code. Link to this property
Link to this property
Link to this property
verdict: "ok"| "warning"| "inconclusive" Verdict of this single test. One of the following: "ok" Link to this property "warning" Link to this property "inconclusive" Link to this property
Link to this property
preflight\_errors?: Array<PreflightError> Errors that prevented step execution. description: string Human-readable error description. Link to this property error\_code?: number| null Numeric error code identifying the class of error, if available. formatuint32 minimum0 Link to this property
Link to this property
Link to this property
Link to this property report\_schema\_version: "v1" Version of the report schema. Link to this property
Link to this property
[Link to this property](<#(resource)%20vulnerability_scanner.scans%20%3E%20(model)%20scan_get_response%20%3E%20(schema)>)