Kicks off a fleet-wide scan that checks which credentials actually hold elevated roles (like sysadmin) on their target servers, and lets you check when that scan last ran. Results land back in List Credentials's elevatedRoleFindings, not in this call's own response.

There's no per-request status poll -- unlike some other "enqueue a request, check on it later" flows in this API, this one only exposes the last scan's timestamps, not a status for the specific request you just made.

Having trouble reaching the API, or logging in from another machine? See Network Access & Authentication Security -- by default the Api only answers localhost, and PowerShell needs an extra flag once it does answer elsewhere.

Order of Operations

  1. Authenticate to the API.
  2. Request the scan.
  3. (Later) Check when the last scan started/completed.

The calls

POST /api/elevated-role-scan-requests
GET  /api/elevated-role-scan-status

Permission needed: Credential.Manage to request a scan, Credential.View to check its status.

C# example

var jsonOptions = new JsonSerializerOptions(JsonSerializerDefaults.Web);

// Step 1: Authenticate to the API.
using var handler = new HttpClientHandler { UseDefaultCredentials = true };
using var client = new HttpClient(handler) { BaseAddress = new Uri("http://your-minion-agent-server:5443") };
client.DefaultRequestHeaders.Add("X-App-Name", "MyIntegration");

// Step 2: Request the scan.
var response = await client.PostAsync("/api/elevated-role-scan-requests", null);
response.EnsureSuccessStatusCode();
var created = await response.Content.ReadFromJsonAsync<CreatedRequestId>(jsonOptions);
Console.WriteLine($"Requested scan, request id {created!.ElevatedRoleScanRequestID}");

// Step 3: (Later) Check when the last scan started/completed.
var status = await client.GetFromJsonAsync<ElevatedRoleScanStatusResponse>("/api/elevated-role-scan-status", jsonOptions);
Console.WriteLine($"Last started: {status!.LastStartedAt}, last completed: {status.LastCompletedAt}");

record CreatedRequestId(long ElevatedRoleScanRequestID);
record ElevatedRoleScanStatusResponse(DateTime? LastStartedAt, DateTime? LastCompletedAt);

Not on a domain machine? Swap in the app-account login from Calling the API From Your Own Code.

PowerShell example

# Step 1: Authenticate to the API.
$headers = @{ "X-App-Name" = "MyIntegration" }

# Step 2: Request the scan. (-AllowUnencryptedAuthentication: PowerShell requires this for Windows auth over plain http to anything but localhost -- see "Network Access & Authentication Security".)
$created = Invoke-RestMethod -Uri "http://your-minion-agent-server:5443/api/elevated-role-scan-requests" `
    -Method Post -UseDefaultCredentials -AllowUnencryptedAuthentication -Headers $headers
"Requested scan, request id $($created.elevatedRoleScanRequestID)"

# Step 3: (Later) Check when the last scan started/completed.
$status = Invoke-RestMethod -Uri "http://your-minion-agent-server:5443/api/elevated-role-scan-status" -UseDefaultCredentials -AllowUnencryptedAuthentication -Headers $headers
"Last started: $($status.lastStartedAt), last completed: $($status.lastCompletedAt)"

What you get back

POST -- 201 Created:

{ "elevatedRoleScanRequestID": 41 }

GET -- 200 OK:

{ "lastStartedAt": "2026-09-16T02:00:00Z", "lastCompletedAt": "2026-09-16T02:04:12Z" }

Both fields come back null if a scan has never run.

Codes this call can return

See API Response Codes for what each one means in general. For this specific call:

  • 201 -- scan requested.
  • 200 -- status returned (even if never run).
  • 403 -- you don't have the required permission (Credential.Manage for the POST, Credential.View for the GET).

What gets audited

The POST is recorded as ElevatedRoleScanRequest / Request Elevated Role Scan, with the requesting host in the after-state. The GET status check isn't audited (it's a read).

Configuring which roles count as "elevated" in the first place is a separate, Security.Manage-gated catalog (GET/PUT /api/elevated-role-definitions) -- see the Security & Audit category.

See also: List Credentials, Set a Credential's Elevated Flag.