Scheduled scans (API only)¶
No console UI
Recurring scan schedules are not available in the Vue console. Manage them with the REST API (or your own integration). See Plans & features.
What it does¶
Runs pentests on a daily or weekly cadence per organization. Each run creates a
normal scan in Reports. The worker job run_due_scan_schedules_job evaluates due
schedules about every 15 minutes.
Requirements¶
| Requirement | Detail |
|---|---|
| Plan | Essential or higher (scheduled_scans feature gate) |
| Role | Admin to create/update/delete; member can list/read |
| Target | Same domain verification and authorization rules as manual pentests |
| Quota | Active schedule cap per plan (max_active_schedules; 0 = unlimited) |
Endpoints¶
| Method | Path |
|---|---|
GET |
/api/v1/orgs/{org_id}/scan-schedules |
POST |
/api/v1/orgs/{org_id}/scan-schedules |
GET |
/api/v1/orgs/{org_id}/scan-schedules/{schedule_id} |
PATCH |
/api/v1/orgs/{org_id}/scan-schedules/{schedule_id} |
DELETE |
/api/v1/orgs/{org_id}/scan-schedules/{schedule_id} |
GET |
/api/v1/orgs/{org_id}/scan-schedules/{schedule_id}/diffs |
Query ?only_changes=true on diffs returns runs where findings changed.
Create example¶
curl -sS -X POST "https://<host>/api/v1/orgs/<org_id>/scan-schedules" \
-H "Authorization: Bearer <admin_jwt>" \
-H "Content-Type: application/json" \
-d '{
"target": "https://app.example.com",
"playbook": "full",
"cadence": "daily",
"hour": 3
}'
Weekly schedules require day_of_week (0 = Monday … 6 = Sunday). playbook must be a
known engine playbook (e.g. recon, full).
List diffs¶
curl -sS "https://<host>/api/v1/orgs/<org_id>/scan-schedules/<schedule_id>/diffs?only_changes=true" \
-H "Authorization: Bearer <jwt>"
Common errors¶
| HTTP | Meaning |
|---|---|
| 403 | Plan below Essential, or schedule quota exceeded |
| 404 | schedule_not_found |
| 400 | Invalid playbook, target policy, or weekly schedule without day_of_week |