Launch site scans | Modular DS

curl -X POST https://api.modulards.com/api/public/v1/site-scans \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "included": [
    "core",
    "database"
  ],
  "sites": [
    101,
    102,
    103
  ]
}'

{
  "data": [
    {
      "attributes": {
        "comment": null,
        "created_at": "2026-09-18T11:00:00.000000Z",
        "db_threats_detected": 0,
        "files_clean": 0,
        "files_infected": 0,
        "files_malicious": 0,
        "files_suspicious": 0,
        "has_threats": false,
        "method": "manual",
        "omitted": [],
        "site_id": 101,
        "status": "pending",
        "updated_at": "2026-09-18T11:00:00.000000Z",
        "verdict": "pending"
      },
      "id": "3050",
      "links": {
        "self": "https://api.modulards.com/api/public/v1/site-scans/3050"
      },
      "type": "site-scans"
    }
  ],
  "jsonapi": {
    "version": "1.1"
  },
  "meta": {
    "skipped": [
      {
        "message": "This website has no malware scans left for the requested areas until 2026-10-01.",
        "reason_code": "QUOTA_EXCEEDED",
        "site_id": 102,
        "site_name": "Acme Blog"
      },
      {
        "message": "This website has no Malware Scanner configuration; assign one first.",
        "reason_code": "UNSUPPORTED",
        "site_id": 103,
        "site_name": "Beta Shop"
      }
    ]
  }
}

Launches a malware scan on an explicit selection of websites, one scan per website, over each website’s configured areas unless included names them (core, plugins, themes, mu_plugins, content, uploads, database); each website’s own exclusions always apply. Answers 202 with data as site-scans resources - one per website the preflight accepted - and meta.skipped for every website it refused.

Body (JSON):

sites (array of website ids, required, 1 to 200).
included (array of string, optional) - areas to scan instead of each website’s configured ones.

Reason codes in meta.skipped, first match wins: PERMISSION_DENIED (the id is outside the token’s reach - site_name is null), SITE_UNREACHABLE (disconnected), UNSUPPORTED (no Malware Scanner configuration, or not yet registered with the scanning provider), CONFLICT (a scan of that website is already running) and QUOTA_EXCEEDED (no scan quota left for any of the requested areas this period - the message carries the reset date). When only one of the requested areas has quota left, that website’s scan still runs, on that area alone, and the response carries a meta.warnings entry naming the area left out.

A manual scan uses the website’s scan quota and does not move its scheduled scan; a scan can take hours - follow the launched ids with “List site scans” (filter[id][]) and read status/verdict.

Requires a full-access token (read-only tokens answer 403).

Launches a malware scan on an explicit selection of websites, one scan per website, over each website's configured areas unless `included` names them (`core`, `plugins`, `themes`, `mu_plugins`, `content`, `uploads`, `database`); each website's own exclusions always apply. Answers **202** with `data` as `site-scans` resources - one per website the preflight accepted - and `meta.skipped` for every website it refused. **Body** (JSON): - `sites` (array of website ids, required, 1 to 200). - `included` (array of string, optional) - areas to scan instead of each website's configured ones. Reason codes in `meta.skipped`, first match wins: `PERMISSION_DENIED` (the id is outside the token's reach - `site_name` is null), `SITE_UNREACHABLE` (disconnected), `UNSUPPORTED` (no Malware Scanner configuration, or not yet registered with the scanning provider), `CONFLICT` (a scan of that website is already running) and `QUOTA_EXCEEDED` (no scan quota left for any of the requested areas this period - the message carries the reset date). When only one of the requested areas has quota left, that website's scan still runs, on that area alone, and the response carries a `meta.warnings` entry naming the area left out. A manual scan uses the website's scan quota and does not move its scheduled scan; a scan can take hours - follow the launched ids with "List site scans" (`filter[id][]`) and read `status`/`verdict`. Requires a full-access token (read-only tokens answer 403).

Authentication

AuthorizationBearer

Personal access token created in the Modular DS dashboard; read-only tokens can only call GET endpoints.

Request

This endpoint expects an object.

includedlist of stringsOptional

siteslist of doublesOptional

Response

202 - Scans launched, two skipped

datalist of objectsOptional

jsonapiobjectOptional

metaobjectOptional

Body (JSON):

sites (array of website ids, required, 1 to 200).
included (array of string, optional) - areas to scan instead of each website’s configured ones.

Requires a full-access token (read-only tokens answer 403).