> ## Documentation Index > Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start Analysis > Initiates a background analysis task for a repository ## OpenAPI ````yaml /openapi.json post /api/analysis/start openapi: 3.0.3 info: title: CodeAnt AI API description: >- API for code analysis (SAST, SCA, secrets, IaC) and developer productivity metrics. Supports GitHub, GitLab, Bitbucket, and Azure DevOps. version: 1.0.0 servers: - url: https://api.codeant.ai description: Production server security: [] tags: - name: Analysis description: Code analysis operations - name: Agent Analysis description: >- AI-powered agent analysis operations. Uses LLM-based code exploration agents to perform deep security threat hunting, bug finding, and custom analysis with reflection-based false positive filtering. - name: Developer Metrics - Teams description: >- Manage developer teams: create, update, delete teams and manage team membership. Teams are used to organize developers and scope metrics. - name: Developer Metrics description: >- Developer productivity and activity metrics: active developers, PR throughput, individual comparisons, and AI-generated summaries. All endpoints support GitHub, GitLab, Bitbucket, and Azure DevOps. - name: Audit Logs description: >- Read-only access to your organization's audit trail for compliance, ETL and SIEM ingestion. Events are immutable, retained for 180 days, and cover security-relevant actions: user management, access control, credentials, scan triggers, configuration changes and data exports. Secrets and tokens are redacted and never appear in any response format. - name: Container Scanning description: >- Container image vulnerability scanning across AWS ECR, Azure ACR, and GCP GAR registries. List tracked containers with their latest scan, then fetch the full vulnerability findings of a scan — the same data shown on the Cloud Security → Container Scanning page. Authenticate with a CodeAnt API token (requires the `view_cloud_security: read` permission when token scoping is configured). - name: Security Hotlist description: >- The organization-wide security Hotlist: every SCA, SAST, secrets, IaC, cloud (CSPM) and AI-exploitation finding, deduplicated and priority-scored into one ranked list with live ticket, assignee and SLA state. Query it with filters, facets and cursor pagination, or export the full filtered list as an Excel workbook. Authenticate with a CodeAnt API token (requires the `view_code_security: read` permission when token scoping is configured). paths: /api/analysis/start: post: tags: - Analysis summary: Start Analysis description: Initiates a background analysis task for a repository operationId: startAnalysis requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AnalysisStartRequest' examples: github: summary: GitHub repository example value: repo: owner/repository commit_id: abc123def456 access_token: ghp_xxxxxxxxxxxx service: github branch: main include_files: src/**/*.py,lib/**/*.js,app/**/*.ts exclude_files: tests/**,node_modules/**,dist/** azuredevops: summary: Azure DevOps repository example value: repo: organization/project/repository commit_id: abc123def456 access_token: pat_xxxxxxxxxxxx service: azuredevops branch: main include_files: src/**/*.cs,src/**/*.js exclude_files: tests/**,bin/**,obj/** sca_only: summary: SCA-only scan value: repo: owner/repository commit_id: '' access_token: cdt_xxxxxxxxxxxx service: github branch: main scan_types: - sca responses: '200': description: Analysis successfully started content: application/json: schema: $ref: '#/components/schemas/SuccessResponse' example: message: Analysis started '400': description: Unknown scan type content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: >- Unknown scan_types: ['dast']. Valid: ['secrets', 'sast', 'sca', 'iac', 'sbom', 'duplicate_code', 'docstring', 'antipatterns', 'dead_code'] '401': description: Invalid access token content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Access token invalid '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: Error running analysis components: schemas: AnalysisStartRequest: type: object required: - repo - commit_id - access_token - service properties: repo: type: string description: Repository identifier (format varies by service) example: owner/repository commit_id: type: string description: Git commit SHA or identifier example: abc123def456 access_token: type: string description: Authentication token for the service example: ghp_xxxxxxxxxxxx service: type: string description: Version control service provider enum: - github - azuredevops - gitlab - bitbucket example: github branch: type: string description: Git branch name example: main include_files: type: string description: Comma-separated file patterns to include in analysis example: src/**/*.py,lib/**/*.js,app/**/*.ts exclude_files: type: string description: Comma-separated file patterns to exclude from analysis example: tests/**,node_modules/**,dist/** scan_types: type: array description: >- Subset of scanners to run. Omit (or send an empty list) to run the full analysis. Scanners left out report `status: done` with empty results for that commit. items: type: string enum: - sast - sca - secrets - iac - sbom - duplicate_code - docstring - antipatterns - dead_code example: - sca SuccessResponse: type: object properties: message: type: string description: Success message ErrorResponse: type: object properties: error: type: string description: Error message ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.