> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start asset discovery > Start a passive reconnaissance run that finds the hosts, certificates, and infrastructure that belong to the organization. The run starts from the verified domains you select. Strix runs one discovery per organization at a time. When a run is already in progress, the response returns that run with `reused` set to true. Asset Discovery is available on the Enterprise plan. ## OpenAPI ````yaml /openapi.json post /asset-discovery openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /asset-discovery: post: tags: - Asset Discovery summary: Start asset discovery description: >- Start a passive reconnaissance run that finds the hosts, certificates, and infrastructure that belong to the organization. The run starts from the verified domains you select. Strix runs one discovery per organization at a time. When a run is already in progress, the response returns that run with `reused` set to true. Asset Discovery is available on the Enterprise plan. operationId: startAssetDiscovery requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/StartAssetDiscoveryRequest' responses: '200': description: A run was already in progress. The response returns that run. content: application/json: schema: $ref: '#/components/schemas/StartAssetDiscoveryResponse' '201': description: The run started. content: application/json: schema: $ref: '#/components/schemas/StartAssetDiscoveryResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '402': $ref: '#/components/responses/PaymentRequired' '403': $ref: '#/components/responses/TierLimitError' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/ServiceUnavailable' security: - BearerAuth: - discovery:write components: schemas: StartAssetDiscoveryRequest: type: object properties: seeds: type: array items: type: string maxItems: 25 minItems: 1 description: >- Verified domains to start from. When omitted, the run starts from every verified domain. If you supply the list, each entry must be a valid, verified domain. Strix rejects an empty or malformed list with status 422. org_names: type: array items: type: string maxLength: 120 maxItems: 10 description: >- Legal or brand names of the organization. The agent uses them to pivot through certificate subjects and WHOIS data. instructions: type: string maxLength: 2000 description: >- Extra instructions for the agent, for example known hosting providers or brands to include. StartAssetDiscoveryResponse: type: object properties: run: $ref: '#/components/schemas/AssetDiscoveryRun' reused: type: boolean description: >- True when a run was already in progress and the response returns that run. required: - run - reused AssetDiscoveryRun: type: object properties: id: type: string format: uuid organization_id: type: string seeds: type: array items: type: string description: The verified domains the run started from. org_names: type: array items: type: string description: >- Organization names used to pivot through certificate subjects and registration data. instructions: type: - string - 'null' description: Extra instructions the agent followed. status: $ref: '#/components/schemas/AssetDiscoveryRunStatus' summary: type: - string - 'null' description: The agent's summary of what it found. Null until the run completes. asset_count: type: integer description: The number of assets the run reported. new_asset_count: type: integer description: The number of hosts this run added that no earlier run had recorded. schedule_id: type: - string - 'null' format: uuid description: >- The recurring schedule that started the run. Null for a run started by hand. failure_code: type: - string - 'null' enum: - launch_failed - no_results - budget_exhausted - other - null description: Why the run failed. Null unless status is `failed`. detail: type: - string - 'null' description: Human-readable failure detail. created_by: type: - string - 'null' created_at: type: string format: date-time queued_at: type: - string - 'null' format: date-time description: When the launch queue accepted the run. started_at: type: - string - 'null' format: date-time finished_at: type: - string - 'null' format: date-time required: - id - organization_id - seeds - org_names - status - asset_count - new_asset_count - created_at ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ScanCreditPaywallResponse: type: object description: >- Returned with status 402 when the workspace has no credits for the request. No scan or chat turn starts and no credits are consumed. properties: detail: type: string description: >- Human-readable explanation with the short recovery instruction. When `plan_trial` is present, the text also offers the Cloud plan trial. requiredTier: type: string code: type: string enum: - scan_credit_limit_reached - chat_credit_limit_reached reason: type: string description: >- Why automatic top-up did not refill the wallet, when the organization has it on. `chat_cap_reached` means the per-chat limit stopped the purchase. Lift it for that chat with `PUT /chat/{chatId}/auto-topup-limit`. `monthly_cap_reached` means the monthly cap stopped it. enum: - disabled - not_needed - exceeds_max_topup - monthly_cap_reached - chat_cap_reached - no_customer - no_payment_method - not_configured - charge_in_progress - authentication_required - charge_failed hint: type: string description: 'Short recovery instruction: how to buy credits, then retry.' topup_url: type: string format: uri description: The dashboard billing page where a user can buy credits. topup_options: type: array description: Ways to add credits, in the order a headless caller should try them. items: type: object properties: method: type: string enum: - GET - POST path: type: string description: The API path, relative to the API root. cli: type: string description: The matching Strix CLI command. description: type: string required: - method - path - cli - description plan_trial: type: object description: >- The Cloud plan trial. Present only when the workspace has not subscribed before and can still start the trial. The plan includes PR security reviews and does not include scan credits. properties: plan: type: string enum: - strix_cloud description: The `product` value for `POST /api/v1/billing/checkout`. trial_days: type: integer description: Maximum length of the free trial in days. includes: type: string description: What the plan includes. method: type: string enum: - POST path: type: string description: The API path, relative to the API root. cli: type: string description: The matching Strix CLI command. url: type: string format: uri description: The dashboard billing page where a user can start the trial. description: type: string required: - plan - trial_days - includes - method - path - cli - url - description required_credits: type: integer description: Total credits the request needs. available_credits: type: integer description: Credits currently in the workspace wallet. required: - detail - code - hint - topup_url - topup_options TierLimitErrorResponse: type: object properties: detail: type: string requiredTier: type: string code: type: string required: - detail AssetDiscoveryRunStatus: type: string enum: - pending - running - completed - failed ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' PaymentRequired: description: >- Out of credits. The body explains how to buy credits with the API, the CLI, or the dashboard, then retry the request. content: application/json: schema: $ref: '#/components/schemas/ScanCreditPaywallResponse' TierLimitError: description: Plan or credit limit reached. content: application/json: schema: $ref: '#/components/schemas/TierLimitErrorResponse' ValidationError: description: Request failed validation (e.g. malformed value or unsupported enum). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServiceUnavailable: description: Service unavailable. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ````