Introduction

The Strix API lets you programmatically manage pentests, vulnerabilities, schedules, and webhook automations for your organization.

What you can automate

Pentests — Start pentests, rerun/cancel pentests, and download PDF reports
Vulnerabilities — List and update vulnerabilities for remediation workflows
Schedules — Create and trigger recurring schedules for continuous testing
Webhooks — Subscribe to pentest and vulnerability lifecycle events

Base URL

All API requests are made to:

https://app.strix.ai/api/v1

Authentication

Every request must include a bearer token in the Authorization header:

Authorization: Bearer <YOUR_API_TOKEN>

Tokens are org-scoped and can only access resources inside the organization they belong to. Create tokens from Settings > API Access in the Strix dashboard.

Scopes

Each token is assigned scopes that control what it can access. Apply least-privilege scopes per integration and rotate tokens regularly.

Scope	Description
`scans:read`	List pentests, read pentest detail, and download reports
`scans:write`	Create pentests, rerun pentests, and cancel running pentests
`vulnerabilities:read`	List vulnerabilities and read individual findings
`vulnerabilities:write`	Update vulnerability status and notes
`schedules:read`	List schedules and inspect schedule runs
`schedules:write`	Create, update, delete, and trigger schedules
`assets:read`	Read domains and repositories target inventory
`webhooks:read`	List webhook endpoints and delivery history
`webhooks:write`	Create, update, delete, and rotate webhook secrets
`tokens:write`	Create and revoke API tokens

Getting Started

Guides

Introduction

What you can automate

Base URL

Authentication

Scopes

​What you can automate

​Base URL

​Authentication

​Scopes

What you can automate

Base URL

Authentication

Scopes