---
issue: 128
title: "Scanner: POST /intents returns 200 instead of 201 for new resource creation"
severity: low
domain: Scanner
labels: [scanner, api-contract]
status: open
created: 2026-05-30
source: Full Codebase Audit 2026-05-30
---

# Scanner: POST /intents returns 200 instead of 201 for new resource creation

**Severity:** low
**Domain:** Scanner
**Labels:** scanner, api-contract

## Description

`scanner/api.go:234` returns HTTP 200 for both new intent creation and idempotent replays. REST convention is 201 for new resource creation and 200 for idempotent replays. Clients that check status codes to distinguish creation from replay cannot do so currently.

## Options

1. Return 201 on new creation, 200 on idempotent replay.
2. Always 201.
3. Add a header/body flag indicating replay vs new.

## Recommendation

Return 201 for new resources and 200 for idempotent replays. Could affect clients keyed on status codes.

## Affected Files

- `scanner/api.go:234`

## References

- [Full Codebase Audit 2026-05-30](../09%20-%20Audits/Full%20Codebase%20Audit%20-%202026-05-30.md) — DEC-63