Activation scans

Before buying an activation scan

An activation scan is the first paid private evidence run for an authorized project. It can start only when the project belongs to the correct account, account scan coverage exists, the Activation scan project service is enabled, payment state is confirmed and the scan scope has been accepted. Use this page when Billing shows account coverage or a project payment instruction and you need to decide whether to continue setup, start checkout, enable the project service or wait for provider confirmation.

Check project eligibility

Follow the path `Project detail → Project services → Billing → Account entitlements → Activation scan`.

1. Open /projects and choose the project that needs its first paid private scan. Result: the project page shows Project services and the current Activation scan status.
2. Confirm setup, accepted scan scope and domain authorization. Result: the service blocker is limited to account coverage when the project prerequisites are done.
3. Open /billing while signed in as an owner, admin or billing manager for the account that owns the project. Result: Billing shows account entitlements, scan credits and project dependencies.
4. Read Account entitlements and Scan credits. Result: you know whether Free Snapshot, Scan Plan, an included stronger plan or a top-up can cover the activation scan.
5. Return to the project page and read Activation scan in Project services. Result: the project tells you whether to Enable service, accept scope, verify the domain, start checkout, wait for provider confirmation or switch accounts.

Start checkout safely

Click Start checkout only when Billing shows the selected account entitlement as eligible and checkout is enabled. The first paid scan checkout route is `/checkout/scan_plan` when Scan Plan is available. If Billing or the project shows Continue, use that action first because the project still needs setup, scope acceptance, domain authorization or service enablement before payment is useful.

• Free Snapshot is the no-payment proof step for a public URL preview.
• Scan Plan is the first paid plan for recurring scan evidence on one project.
• Monitor Plan is the next step when weekly checks, alerts and more scan allowance are needed.
• Fix Plan keeps scan coverage and adds generated remediation tasks after eligible report findings exist.
• Agency customers should use Agency Plan only when the project belongs to an eligible agency workspace.

Wait for payment and service readiness

After provider checkout, return to Billing and wait for payment confirmation before relying on the entitlement or credits. WebRiskOps uses provider-confirmed billing records rather than the browser return page as the source of truth. Then return to the project and enable Activation scan if it is not already enabled.

• Payment confirmation pending means checkout started, but the entitlement is not usable yet.
• Provider IDs pending means checkout cannot open because provider configuration is not ready.
• Scope acceptance required means billing may be ready, but the scanner cannot run until the accepted scope is confirmed.
• Project service blocked means the Activation scan service still needs project setup, scope, domain verification or account coverage before it can run.
• Buyer classification required means project intake does not yet prove whether the requested plan matches the account.
• Unsupported scope means reduce the scope; payment does not make unsupported targets eligible.
• Wrong account means switch to the account that owns the project and billing record.

Continue to the first live audit

When Billing no longer shows a payment or entitlement blocker, open [Accept scan scope](/docs/getting-started/accept-scan-scope) if scope is not accepted yet. After scope, billing and Activation scan service state are ready, continue to [Run the first live audit](/docs/getting-started/run-first-live-audit).