# POST /api/v1/app/{appId}/perch/start

**Start a hosted scan**

## Start a Scan

Provisions the resources needed to run a hosted security scan and starts the scan asynchronously.

### Prerequisites

- The application must be a Hosted application type
- The target domain must be verified for hosted scanning
- No scan should already be running for this application

### Request Body

| Parameter | Default | Description |
|:---:|:---:|:---:|
|id|""||
|name|""||
|command|{}||

### Response

| Parameter | Default | Description |
|:---:|:---:|:---:|
|scanKey|""||

```json
{
	"scanKey": ""
}
```

### Errors

- **409 Conflict**: A scan is already running for this application
- **400 Bad Request**: The application is not verified for cloud scanning or is not a cloud application
- **404 Not Found**: Application not found or user doesn't have access

> 👥 Teams Supported
> If the application belongs to a StackHawk [Team](https://docs.stackhawk.com/web-app/teams.html), only members of the Team can call this endpoint.
> 🧾 Audited
> This is recorded as `SCAN_STARTED` [User Activity](https://apidocs.stackhawk.com/reference/listauditactivity#user-activity-types).

> Requires `write:scan` permission.

## Parameters

- `appId` (in: path, string<uuid>) *(required)* — UUID identifier for this StackHawk Application.
- `envId` (in: query, string<uuid>) — Optional UUID identifier of the environment to scan. Defaults to the app's default environment.

## Request Body

### application/json

- `command` (perch.PerchCommand)
  - `command` (string)
  - `config` (string)
  - `errors` (perch.PerchError[])
    - `errorType` (string)
    - `message` (string)
  - `id` (string)
  - `name` (string)
- `id` (string)
- `name` (string)

## Responses

### 200 — OK

#### application/json

- `scanKey` (string)

#### application/x-protobuf

- `scanKey` (string)

### 400 — Bad Request

- (no body)

### 401 — Unauthorized

- (no body)