How do I trigger a scan on deploy?

By default, Flows run on a schedule (daily or weekly). A deploy trigger lets you also run a domain’s flows right after a deploy, so a regression is caught minutes after the change that introduced it, instead of up to a day later.

The trigger supplements the schedule; it doesn’t replace it. Any run, triggered or scheduled, resets the clock, so “daily” becomes an “at least daily” floor. Frequent deployers effectively never wait for the timer.

Deploy triggers need a paid plan (Starter or Pro). On a free account the domain page shows an upgrade prompt instead of the URL generator, and the endpoint returns 403. See How do I change or cancel my plan?

Find your deploy URL

Each verified domain has its own deploy URL containing a secret token.

Open Domains from your dashboard and select the domain.
In the Deploy trigger section, click Generate deploy URL.
Copy the URL. It looks like:

https://app.accesslint.com/api/v1/deploys/POl3x…your-token…

Treat this URL like a password: anyone who has it can start runs on your domain. If it leaks, click Regenerate URL; the old URL stops working immediately.

Trigger a run

Send an HTTP POST to the URL. A bare request with no body is all you need. It runs every active flow on the domain:

curl -X POST https://app.accesslint.com/api/v1/deploys/POl3x…your-token…

Paste the same URL into a Vercel or Netlify deploy hook, or call it from a GitHub Actions step:

- name: Trigger AccessLint flows
  run: curl -X POST ${{ secrets.ACCESSLINT_DEPLOY_URL }}

Store the URL as a secret (e.g. ACCESSLINT_DEPLOY_URL) rather than committing it.

Optional: narrow the run and attach deploy info

You can send an optional JSON body. Every field is optional:

curl -X POST https://app.accesslint.com/api/v1/deploys/POl3x…your-token… \
  -H "Content-Type: application/json" \
  -d '{
        "flow": "your-flow-token",
        "deploy": { "sha": "a1b2c3d", "environment": "production", "url": "https://…" }
      }'

flow: a flow’s token, to run just that one flow instead of every active flow on the domain. It’s the last path segment in the flow’s URL (…/flows/your-flow-token).
deploy: a free-form object (commit SHA, environment, a link to the deploy). It’s stamped onto the run and shown in its history, so you can tell which deploy a run checked.

What to expect

Runs are asynchronous. The webhook returns immediately (HTTP 202) and the run happens in the background: review the results on the flow’s page, where each run is labeled Triggered by deploy with a link to the deploy info you attached.
Only flows that are eligible to run do. Paused, draft, and “needs dry run” flows are skipped, so a deploy never overrides a deliberate pause. A flow is also skipped if its domain is unverified, if its sign-in hasn’t succeeded yet, or if it’s over your plan’s flow limit.
Rapid or repeated calls (CI retries, a monorepo that deploys several times) are collapsed into a single run, so you won’t stack up duplicate runs. Triggered runs are also capped at 24 per flow per day. These all return 202.
A healthy pipeline never goes red because of Flows’ internal state: throttling, paused flows, and empty domains all return a success status.

Making CI fail a build on new violations (a synchronous pass/fail result) isn’t available yet: it’s a planned follow-up. For now, the deploy trigger runs the checks and reports the results; it doesn’t block the deploy.