Update the asset discovery schedule
Sets when runs start (cron read in timezone), which verified domains they start from (seeds), the outcomes that send a notification, and the notification targets. Discovery schedules may recur hourly. The notification settings also apply to runs started by hand.
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Body
Fields you omit keep their current value.
A 5-field cron expression read in timezone, for example 0 9 * * 1 for every Monday at 09:00. It may fire as often as once an hour, for example 0 * * * * or 0 */2 * * *. The API accepts any cadence of one hour or longer, including cron expressions that the dashboard controls cannot represent. Send null to stop recurring runs. Strix rejects a malformed or too frequent expression with status 422.
An IANA timezone name, for example America/New_York. The default is UTC until you set it.
Replaces the full list. Each entry must be a domain that is verified for the organization, up to 25 domains. Send null to start scheduled runs from every verified domain, or from the first 25 in alphabetical order when more than 25 are verified. Strix rejects an empty list, a malformed domain, or a domain that is not verified with status 422. A domain that is removed later marks the next scheduled fire as failing until you update the list.
1 - 25 elementsReplaces the full list. Send an empty list to stop all notifications.
An outcome of a discovery run that sends a notification. new_assets is a completed run that found assets that were not in the inventory before. completed is every completed run. failed is a run that stopped without a result. A completed run with new assets sends one message, as new_assets when that event is on.
new_assets, completed, failed Post to Slack through the connected workspace.
A channel id from the connected Slack workspace, for example C0123456789. Strix rejects a channel that the workspace does not know with status 422. Send null to use the default channel of the Slack integration.
Replaces the full list. Send an empty list to stop email notifications.
10Response
The schedule.
The organization's recurring discovery settings and notification settings. Each scheduled run starts from the verified domains in seeds, or from every verified domain when seeds is null. The notification settings also apply to runs started by hand.