> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Continue Scan Upload

> Continue a BLAST chunked upload. This path requires a trailing slash. Intermediate responses include the `Upload-Offset` header and no `scan_id`. When the last chunk completes the archive, the JSON body includes `scan_id` and `project_id` and does not set `Upload-Offset`.



## OpenAPI

````yaml /api-reference/openapi.json patch /start-scan/{transfer_id}/
openapi: 3.0.0
info:
  title: Corgea API
  version: 1.0.0
  description: >-
    API for interacting with Corgea's scanning and vulnerability management
    features
servers:
  - url: https://www.corgea.app/api/v1
    description: Production server
security:
  - CorgeaToken: []
  - BearerAuth: []
paths:
  /start-scan/{transfer_id}/:
    patch:
      tags:
        - Starting Corgea Scan
      summary: Continue Scan Upload
      description: >-
        Continue a BLAST chunked upload. This path requires a trailing slash.
        Intermediate responses include the `Upload-Offset` header and no
        `scan_id`. When the last chunk completes the archive, the JSON body
        includes `scan_id` and `project_id` and does not set `Upload-Offset`.
      operationId: continueScanUpload
      parameters:
        - name: transfer_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
          description: The transfer ID from the initial scan request
        - name: Upload-Offset
          in: header
          required: true
          schema:
            type: integer
          description: Current byte offset of the upload
        - name: Upload-Length
          in: header
          required: true
          schema:
            type: integer
          description: Total size of the file in bytes
        - name: Upload-Name
          in: header
          required: true
          schema:
            type: string
          description: Name of the file being uploaded
        - name: CORGEA-SOURCE
          in: header
          required: false
          schema:
            type: string
            enum:
              - api
              - cli
              - vscode
              - vs2022
              - intellij
            default: api
          description: >-
            Identifies the client that triggered the scan. Requests without this
            header are attributed to the API.
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - chunk_data
              properties:
                chunk_data:
                  type: string
                  format: binary
                  description: The next chunk of data for the scan
                project_name:
                  type: string
                branch:
                  type: string
                repo_url:
                  type: string
                sha:
                  type: string
                partial_scan:
                  type: string
                  enum:
                    - 'true'
                  description: >-
                    Omit this field for a full scan. Send `true` only for a
                    partial scan. The API treats any non-empty form value as a
                    partial scan, including the string `false`.
                files_to_scan:
                  type: string
                  description: Comma-separated list of files to scan
                metadata:
                  type: string
                  description: >-
                    User-supplied scan metadata as a JSON object string, e.g.
                    {"pipeline_url":"https://ci.example/run/123"}. Validated on
                    every chunk request and attached to the scan once the upload
                    completes. Must be a JSON object of at most 16,384 bytes;
                    otherwise the request fails with 400.
                dirty:
                  type: string
                  enum:
                    - 'true'
                    - 'false'
                  description: >-
                    Whether the uploaded worktree is dirty. The CLI sends true
                    or false when it has repo info. Omit the field if dirtiness
                    is unknown.
                scan_configs:
                  type: string
                  description: >-
                    Comma-separated scan-type tokens applied when the upload
                    completes (base, malicious, policy, secrets, pii, and
                    others). The CLI maps --scan-type blast to base. Omit for
                    server defaults.
                target_policies:
                  type: string
                  description: >-
                    Comma-separated policy IDs applied when the upload
                    completes. Invalid IDs return 400.
      responses:
        '200':
          description: >-
            Chunk accepted. Intermediate responses set `Upload-Offset`.
            Completing and already-in-progress responses do not.
          headers:
            Upload-Offset:
              schema:
                type: integer
              description: Next byte offset. Set on intermediate chunk responses only.
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - message
                properties:
                  status:
                    type: string
                    enum:
                      - ok
                    example: ok
                  message:
                    type: string
                  scan_id:
                    type: string
                    format: uuid
                    description: Present when the last chunk completes and a scan starts.
                    example: 1a5afaa3-72ac-458f-a492-ac40ffc88e76
                  project_id:
                    type: integer
                    description: Present with scan_id when a scan starts.
              examples:
                intermediate:
                  summary: Intermediate chunk
                  value:
                    status: ok
                    message: Chunk received.
                complete:
                  summary: Upload complete
                  value:
                    status: ok
                    message: Upload complete and file processed successfully.
                    scan_id: 1a5afaa3-72ac-458f-a492-ac40ffc88e76
                    project_id: 1
                in_progress:
                  summary: Scan already in progress
                  value:
                    status: ok
                    message: A scan for this commit is already in progress.
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  status:
                    type: string
                    example: error
                  message:
                    type: string
                    example: 'Invalid request: ''chunk_data'' file not found.'
                  internal_detail:
                    type: string
        '403':
          description: Permission denied
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Permission denied
components:
  securitySchemes:
    CorgeaToken:
      type: apiKey
      in: header
      name: CORGEA-TOKEN
      description: API key for authentication
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth2 access token (JWT) in the Authorization header

````