← Help

How do I trigger a scan on deploy?

By default, Flows run on a schedule (daily or weekly). A deploy trigger lets you also run a domain’s flows right after a deploy — so a regression is caught minutes after the change that introduced it, instead of up to a day later.

The trigger supplements the schedule; it doesn’t replace it. Any run — triggered or scheduled — resets the clock, so “daily” becomes an “at least daily” floor. Frequent deployers effectively never wait for the timer.

Find your deploy URL

Each verified domain has its own deploy URL containing a secret token.

1. Open Domains from your dashboard and select the domain.
2. In the Deploy trigger section, click Generate deploy URL.
3. Copy the URL. It looks like:

https://app.accesslint.com/api/v1/deploys/POl3x…your-token…

Treat this URL like a password — anyone who has it can start runs on your domain. If it leaks, click Regenerate URL; the old URL stops working immediately.

Trigger a run

Send an HTTP POST to the URL. A bare request with no body is all you need — it runs every active flow on the domain:

curl -X POST https://app.accesslint.com/api/v1/deploys/POl3x…your-token…

Paste the same URL into a Vercel or Netlify deploy hook, or call it from a GitHub Actions step:

- name: Trigger AccessLint flows
  run: curl -X POST ${{ secrets.ACCESSLINT_DEPLOY_URL }}

Store the URL as a secret (e.g. ACCESSLINT_DEPLOY_URL) rather than committing it.

Optional: narrow the run and attach deploy info

You can send an optional JSON body. Every field is optional:

curl -X POST https://app.accesslint.com/api/v1/deploys/POl3x…your-token… \
  -H "Content-Type: application/json" \
  -d '{
        "flow": "your-flow-token",
        "deploy": { "sha": "a1b2c3d", "environment": "production", "url": "https://…" }
      }'

• flow — a flow’s token, to run just that one flow instead of every active flow on the domain. It’s the last path segment in the flow’s URL (…/flows/your-flow-token).
• deploy — a free-form object (commit SHA, environment, a link to the deploy). It’s stamped onto the run and shown in its history, so you can tell which deploy a run checked.

What to expect

• Runs are asynchronous. The webhook returns immediately (HTTP 202) and the run happens in the background — review the results on the flow’s page, where each run is labeled Triggered by deploy with a link to the deploy info you attached.
• Only active flows run. Paused, draft, and “needs dry run” flows are skipped — a deploy never overrides a deliberate pause.
• Rapid or repeated calls (CI retries, a monorepo that deploys several times) are collapsed into a single run, so you won’t stack up duplicate runs. Triggered runs are also capped at 24 per flow per day. These all return 202.
• A healthy pipeline never goes red because of Flows’ internal state: throttling, paused flows, and empty domains all return a success status.

Making CI fail a build on new violations (a synchronous pass/fail result) isn’t available yet — it’s a planned follow-up. For now, the deploy trigger runs the checks and reports the results; it doesn’t block the deploy.