Launch site scans | Modular DS

curl -X POST https://api.modulards.com/api/public/v1/site-scans \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "included": [
    "core",
    "database"
  ],
  "sites": [
    101,
    102
  ]
}'

{
  "data": [
    {
      "attributes": {
        "comment": null,
        "created_at": "2026-09-18T11:00:00.000000Z",
        "db_threats_detected": 0,
        "files_clean": 0,
        "files_infected": 0,
        "files_malicious": 0,
        "files_suspicious": 0,
        "has_threats": false,
        "method": "manual",
        "omitted": [],
        "site_id": 101,
        "status": "pending",
        "updated_at": "2026-09-18T11:00:00.000000Z",
        "verdict": "pending"
      },
      "id": "3050",
      "links": {
        "self": "https://api.modulards.com/api/public/v1/site-scans/3050"
      },
      "type": "site-scans"
    }
  ],
  "jsonapi": {
    "version": "1.1"
  },
  "meta": {
    "skipped": [
      {
        "message": "This website has no malware scans left for the requested areas until 2026-10-01.",
        "reason_code": "QUOTA_EXCEEDED",
        "site_id": 102,
        "site_name": "Acme Blog"
      }
    ]
  }
}

Launches a malware scan on an explicit selection of websites, one scan per website, over each website’s configured areas unless included names them (core, plugins, themes, mu_plugins, content, uploads, database); each website’s own exclusions always apply. Answers 202 with data as site-scans resources - one per website the preflight accepted - and meta.skipped for every website it refused.

Body (JSON):

sites (array of website ids, required, 1 to 200).
included (array of string, optional) - areas to scan instead of each website’s configured ones.

A website that is disconnected, has no Malware Scanner configuration, is not yet registered with the scanning provider, already has a scan running, or has no scan quota left for any of the requested areas this period is answered in meta.skipped with a reason_code (SITE_UNREACHABLE, UNSUPPORTED, CONFLICT, QUOTA_EXCEEDED - the last carries the reset date) instead of failing the call. When only one of the requested areas has quota left, that website’s scan still runs, on that area alone, and the response carries a meta.warnings entry naming the area left out.

A manual scan uses the website’s scan quota and does not move its scheduled scan; a scan can take hours - follow the launched ids with “List site scans” (filter[id][]) and read status/verdict.

Requires a full-access token (read-only tokens answer 403).

Launches a malware scan on an explicit selection of websites, one scan per website, over each website's configured areas unless `included` names them (`core`, `plugins`, `themes`, `mu_plugins`, `content`, `uploads`, `database`); each website's own exclusions always apply. Answers **202** with `data` as `site-scans` resources - one per website the preflight accepted - and `meta.skipped` for every website it refused. **Body** (JSON): - `sites` (array of website ids, required, 1 to 200). - `included` (array of string, optional) - areas to scan instead of each website's configured ones. A website that is disconnected, has no Malware Scanner configuration, is not yet registered with the scanning provider, already has a scan running, or has no scan quota left for any of the requested areas this period is answered in `meta.skipped` with a `reason_code` (`SITE_UNREACHABLE`, `UNSUPPORTED`, `CONFLICT`, `QUOTA_EXCEEDED` - the last carries the reset date) instead of failing the call. When only one of the requested areas has quota left, that website's scan still runs, on that area alone, and the response carries a `meta.warnings` entry naming the area left out. A manual scan uses the website's scan quota and does not move its scheduled scan; a scan can take hours - follow the launched ids with "List site scans" (`filter[id][]`) and read `status`/`verdict`. Requires a full-access token (read-only tokens answer 403).

Authentication

AuthorizationBearer

Personal access token created in the Modular DS dashboard; read-only tokens can only call GET endpoints.

Request

This endpoint expects an object.

includedlist of stringsOptional

siteslist of doublesOptional

Response

202 - Scans launched, one skipped

datalist of objectsOptional

jsonapiobjectOptional

metaobjectOptional

Body (JSON):

sites (array of website ids, required, 1 to 200).
included (array of string, optional) - areas to scan instead of each website’s configured ones.

Requires a full-access token (read-only tokens answer 403).