Why does the Scan method fail for some products when clean is false or omitted?

Overview

The clean input of the Scan method (method id 1006) tells the product whether to try to remediate threats found during the scan.

• true: the product scans and attempts to remediate detected threats (clean, quarantine, or delete, depending on the product).

• false (default): the product scans and reports threats without remediating them.

What the SDK does when you call Scan

1. The SDK fills in clean: false if you did not pass it.

2. The SDK hands the call to the integration for the product identified by signature.

3. The product integration checks whether the product can run the requested scan with the given clean value.

4. If the product cannot run a scan-only operation (clean: false), the SDK returns an error and does not start the scan.

This behavior is the same on Windows, macOS, and Linux. Which products are affected depends on the product, and for some products on which scanner component is installed on the endpoint.

Error reference

Codes -11 and -12 can also mean that another requested option is not supported, such as the scan_type value. Check the other inputs before assuming clean is the cause.

Solution

If Scan returns WAAPI_ERROR_COMPONENT_METHOD_NOT_SUPPORTED (code -11) or WAAPI_ERROR_COMPONENT_METHOD_NOT_IMPLEMENTED (code -12) while clean is false or omitted, the product only supports scanning together with remediation. Your options:

• If remediation is acceptable for your use case, call Scan again with clean: true.

• If you need a scan that never changes the endpoint (for example, an audit or compliance check), do not retry with clean: true. Treat the product as not supporting a scan-only operation.

Pass clean as a JSON boolean (true), not as a string ("true") or a number (1). Some product integrations reject other types.

If Further Assistance is required, please proceed to log a support case or chatting with our support engineer.