Usually I would call "iw dev wlan0 scan". But can be done when there is no wlan0 device configured?
Do I need to setup a temporary wifi configuration to be able to scan?
You can try something like iwinfo radio0 scan || iwinfo radio1 scan. This will either use an existing vif on radio0/radio1 for scanning or create one on demand if there is no suitable one yet.