> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update the asset discovery schedule > Sets when runs start (`cron` read in `timezone`), which verified domains they start from (`seeds`), the outcomes that send a notification, and the notification targets. Discovery schedules may recur hourly. The notification settings also apply to runs started by hand. ## OpenAPI ````yaml /openapi.json patch /asset-discovery/schedule openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /asset-discovery/schedule: patch: tags: - Asset Discovery summary: Update the asset discovery schedule description: >- Sets when runs start (`cron` read in `timezone`), which verified domains they start from (`seeds`), the outcomes that send a notification, and the notification targets. Discovery schedules may recur hourly. The notification settings also apply to runs started by hand. operationId: updateAssetDiscoverySchedule requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateAssetDiscoveryScheduleRequest' responses: '200': description: The schedule. content: application/json: schema: type: object properties: schedule: $ref: '#/components/schemas/AssetDiscoverySchedule' required: - schedule '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - discovery:write components: schemas: UpdateAssetDiscoveryScheduleRequest: type: object description: Fields you omit keep their current value. properties: cron: type: - string - 'null' description: >- A 5-field cron expression read in `timezone`, for example `0 9 * * 1` for every Monday at 09:00. It may fire as often as once an hour, for example `0 * * * *` or `0 */2 * * *`. The API accepts any cadence of one hour or longer, including cron expressions that the dashboard controls cannot represent. Send null to stop recurring runs. Strix rejects a malformed or too frequent expression with status 422. timezone: type: string description: >- An IANA timezone name, for example `America/New_York`. The default is `UTC` until you set it. seeds: type: - array - 'null' items: type: string minItems: 1 maxItems: 25 description: >- Replaces the full list. Each entry must be a domain that is verified for the organization, up to 25 domains. Send null to start scheduled runs from every verified domain, or from the first 25 in alphabetical order when more than 25 are verified. Strix rejects an empty list, a malformed domain, or a domain that is not verified with status 422. A domain that is removed later marks the next scheduled fire as failing until you update the list. notify_events: type: array items: $ref: '#/components/schemas/AssetDiscoveryNotifyEvent' uniqueItems: true description: >- Replaces the full list. Send an empty list to stop all notifications. notify_slack: type: boolean description: Post to Slack through the connected workspace. slack_channel_id: type: - string - 'null' description: >- A channel id from the connected Slack workspace, for example `C0123456789`. Strix rejects a channel that the workspace does not know with status 422. Send null to use the default channel of the Slack integration. notify_emails: type: array items: type: string format: email maxItems: 10 description: >- Replaces the full list. Send an empty list to stop email notifications. AssetDiscoverySchedule: type: object description: >- The organization's recurring discovery settings and notification settings. Each scheduled run starts from the verified domains in `seeds`, or from every verified domain when `seeds` is null. The notification settings also apply to runs started by hand. properties: cron: type: - string - 'null' description: >- A 5-field cron expression (minute, hour, day of month, month, day of week) read in `timezone`, for example `0 9 * * 1` for every Monday at 09:00. Null when recurring runs are off. timezone: type: string description: >- The IANA timezone the cron expression is read in, for example `America/New_York`. seeds: type: - array - 'null' items: type: string minItems: 1 maxItems: 25 description: >- The verified domains a scheduled run starts from. Null means every domain that is verified when the run starts, including domains verified after the schedule was saved. A run starts from at most 25 domains, so with more than 25 verified domains a null scope covers the first 25 in alphabetical order; send a list to choose which. notify_events: type: array items: $ref: '#/components/schemas/AssetDiscoveryNotifyEvent' uniqueItems: true description: >- The outcomes that send a message. An empty list turns notifications off. notify_slack: type: boolean description: Post to Slack through the connected workspace. slack_channel_id: type: - string - 'null' description: >- The Slack channel that gets the post. Null uses the default channel of the Slack integration. notify_emails: type: array items: type: string format: email maxItems: 10 description: Addresses that get an email. next_run_at: type: - string - 'null' format: date-time description: >- When the next scheduled run starts, as a UTC timestamp. Null when `cron` is null. last_fired_at: type: - string - 'null' format: date-time description: When the schedule last started a run. last_run_status: type: - string - 'null' enum: - ok - skipped - failing - null description: The result of the last scheduled fire. last_run_code: type: - string - 'null' description: A short code for the last skipped or failing fire. last_run_error: type: - string - 'null' description: A plain language reason for the last skipped or failing fire. updated_at: type: - string - 'null' format: date-time required: - cron - timezone - seeds - notify_events - notify_slack - slack_channel_id - notify_emails - next_run_at - last_fired_at - last_run_status - last_run_code - last_run_error - updated_at AssetDiscoveryNotifyEvent: type: string enum: - new_assets - completed - failed description: >- An outcome of a discovery run that sends a notification. `new_assets` is a completed run that found assets that were not in the inventory before. `completed` is every completed run. `failed` is a run that stopped without a result. A completed run with new assets sends one message, as `new_assets` when that event is on. ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ValidationError: description: Request failed validation (e.g. malformed value or unsupported enum). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.