Skip to main content
The Strix API lets you programmatically manage pentests, vulnerabilities, schedules, and webhook automations for your organization.

​
What you can automate

  • Pentests — Start pentests, rerun/cancel pentests, and download PDF reports
  • Vulnerabilities — List and update vulnerabilities for remediation workflows
  • Schedules — Create and trigger recurring schedules for continuous testing
  • Webhooks — Subscribe to pentest and vulnerability lifecycle events

​
Base URL

All API requests are made to: 
https://app.strix.ai/api/v1

​
Authentication

Every request must include a bearer token in the Authorization header: 
Authorization: Bearer <YOUR_API_TOKEN>
Tokens are org-scoped and can only access resources inside the organization they belong to. Create tokens from Settings > API Access in the Strix dashboard.

​
Scopes

Each token is assigned scopes that control what it can access. Apply least-privilege scopes per integration and rotate tokens regularly.
ScopeDescription
scans:readList pentests, read pentest detail, and download reports
scans:writeCreate pentests, rerun pentests, and cancel running pentests
vulnerabilities:readList vulnerabilities and read individual findings
vulnerabilities:writeUpdate vulnerability status and notes
schedules:readList schedules and inspect schedule runs
schedules:writeCreate, update, delete, and trigger schedules
assets:readRead domains and repositories target inventory
webhooks:readList webhook endpoints and delivery history
webhooks:writeCreate, update, delete, and rotate webhook secrets
tokens:writeCreate and revoke API tokens