Update the asset discovery schedule
Sets when runs start (cron read in timezone), which verified domains they start from (seeds), the outcomes that send a notification, and the notification targets. Discovery schedules may recur hourly. The notification settings also apply to runs started by hand.
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Body
Fields you omit keep their current value.
A 5-field cron expression read in timezone, for example 0 9 * * 1 for every Monday at 09:00. It may fire as often as once an hour, for example 0 * * * * or 0 */2 * * *. The API accepts any cadence of one hour or longer, including cron expressions that the dashboard controls cannot represent. Send null to stop recurring runs. Strix rejects a malformed or too frequent expression with status 422.
Replaces the full list. Each entry must be a domain that is verified for the organization, up to 25 domains. Send null to start scheduled runs from every verified domain, or from the first 25 in alphabetical order when more than 25 are verified. Strix rejects an empty list, a malformed domain, or a domain that is not verified with status 422. A domain that is removed later marks the next scheduled fire as failing until you update the list.
1 - 25 elementsReplaces the full list. Send an empty list to stop all notifications.
An outcome of a discovery run that sends a notification. new_assets is a completed run that found assets that were not in the inventory before. completed is every completed run. failed is a run that stopped without a result. A completed run with new assets sends one message, as new_assets when that event is on.
new_assets, completed, failed