Aikido Scan

Aikido Scan
Certified
Scan an Aikido code repository

Triggers a rescan of a code repository. The API call itself is fire-and-forget (no scan id); set waitForCompletion to poll the repository's last_scanned_at timestamp until the scan finishes.

yaml
type: io.kestra.plugin.aikido.repositories.Scan

Examples

Trigger a SAST + secrets scan on a repository after a deployment

yaml
id: aikido_scan_on_deploy
namespace: company.security

inputs:
  - id: repo_id
    type: STRING
    description: Aikido code repository ID to scan

tasks:
  - id: scan
    type: io.kestra.plugin.aikido.repositories.Scan
    clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
    clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
    repositoryId: "{{ inputs.repo_id }}"
    sast: true
    secrets: true
    iac: true
    waitForCompletion: true

  - id: log_result
    type: io.kestra.plugin.core.log.Log
    message: "Scan completed for repo {{ inputs.repo_id }} — status: {{ outputs.scan.completed }}"

Properties

clientId *string

OAuth2 client ID

Client ID of an Aikido API client with the OAuth2 scopes required by the tasks and triggers being used (for example issues: read, repositories: write). Client credentials are created in the Aikido console under Settings > API access.

clientSecret *string

OAuth2 client secret

Client secret of the Aikido API client. Exchanged for a short-lived JWT Bearer token on first use (and transparently refreshed before it expires); never logged or included in error messages.

repositoryId *string

Code repository ID

baseUrl string

Defaulthttps://app.aikido.dev

Aikido API base URL

Base URL of the Aikido Security application for your account's region: https://app.aikido.dev (Europe, default), https://app.us.aikido.dev (United States), https://app.au.aikido.dev (Australia), or https://app.me.aikido.dev (Middle East). The OAuth2 token endpoint is derived from this same host, so a region override applies to both authentication and API calls.

iac booleanstring

Defaulttrue

Run an IaC scan

Defaults to true.

maxDuration string

DefaultPT1H

Maximum wait duration

Maximum time to wait for the scan to complete before failing. Only used when waitForCompletion is true. Defaults to PT1H.

pluginDefaultsRef string

Reference (ref) of the pluginDefaults to apply to this task.

pollInterval string

DefaultPT10S

Poll interval

How often to re-check last_scanned_at while waiting for completion. Only used when waitForCompletion is true. Defaults to PT10S.

sast booleanstring

Defaulttrue

Run a SAST scan

Defaults to true.

secrets booleanstring

Defaulttrue

Run a secrets scan

Defaults to true.

waitForCompletion booleanstring

Defaultfalse

Wait for scan completion

When true, polls the resource's last_scanned_at timestamp after triggering the scan until it advances past its pre-scan value, then returns. Caveat: Aikido's scan-trigger endpoints are fire-and-forget with no scan id and no status endpoint, so this observes "a scan finished" on the resource, not necessarily "the scan this task started finished" — a concurrent scan on the same resource can also satisfy it. The wait blocks a worker thread for its whole duration (up to maxDuration), so budget worker slots accordingly when running many scans concurrently with this enabled. Defaults to false, so the task returns immediately after triggering.

Outputs

completed boolean

Whether the task waited for and observed scan completion

Always false when waitForCompletion is false.