> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Add a domain > Register a domain asset for the authenticated organization. Strix probes HTTPS reachability and checks the allowlist, existing verified domains, the DNS TXT record, the verification file, and the meta tag. The ownership checks share one deadline of 4 seconds and run at the same time as the 5 second reachability probe. When no record is found, `verified` is false and `detail` names the DNS TXT record to add. Add the record, then call `verifyDomain`. ## OpenAPI ````yaml /openapi.json post /domains openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /domains: post: tags: - Assets summary: Add a domain description: >- Register a domain asset for the authenticated organization. Strix probes HTTPS reachability and checks the allowlist, existing verified domains, the DNS TXT record, the verification file, and the meta tag. The ownership checks share one deadline of 4 seconds and run at the same time as the 5 second reachability probe. When no record is found, `verified` is false and `detail` names the DNS TXT record to add. Add the record, then call `verifyDomain`. operationId: createDomain requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateDomainRequest' responses: '200': description: Domain already exists. content: application/json: schema: $ref: '#/components/schemas/DomainCreateResponse' '201': description: Domain added. content: application/json: schema: $ref: '#/components/schemas/DomainCreateResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - assets:write components: schemas: CreateDomainRequest: type: object properties: domain: description: >- Hostname to add, for example `app.example.com`. Do not include a scheme or path. type: string asset_type: $ref: '#/components/schemas/DomainAssetType' description: >- Kind of asset the domain is. Use `web_app` for browser applications, `api` for HTTP APIs, and `attack_surface` for external discovery. context: description: >- Free-text background about the domain that the agent uses on every scan. Send null to clear it. type: - string - 'null' tags: type: array items: type: string description: >- Enterprise asset labels for RBAC scoping. Requires the Enterprise plan. business_unit: type: - string - 'null' description: >- Enterprise asset label for RBAC scoping. Requires the Enterprise plan. required: - domain - asset_type DomainCreateResponse: type: object description: >- The stored domain plus its ownership state. Read `verified` before you start a scan. Strix rejects a scan against a domain that is not verified, unless the organization is on the Enterprise plan or has a configured verification bypass. properties: domain: $ref: '#/components/schemas/Domain' status: type: string enum: - added - exists description: >- `added` when this call created the domain. `exists` when the organization already had it. reachable: type: boolean description: >- True when an HTTPS HEAD request to the domain got a response within 5 seconds. Informational only. verified: type: boolean description: True only when Strix confirmed ownership of the domain. detail: type: string description: >- Human-readable ownership state. When the domain is not verified, this names the DNS TXT record to add and the retry command. verification_method: type: string enum: - allowlist - existing - dns - file - meta_tag - email description: >- The method that confirmed ownership during this call. Present only when this call verified the domain. next_steps: type: array items: type: string description: >- One instruction per verification method, the retry command, and a reachability note when the HTTPS probe failed. Present only when `verified` is false. verification: $ref: '#/components/schemas/VerificationMethods' required: - domain - status - reachable - verified - detail - verification DomainAssetType: type: string enum: - web_app - api - attack_surface Domain: type: object properties: id: type: string format: uuid organization_id: type: string domain: type: string verified: type: boolean tags: type: array items: type: string description: Enterprise asset labels used for RBAC scoping. business_unit: type: - string - 'null' description: Enterprise asset label used for RBAC scoping. created_at: type: string format: date-time last_scan_at: type: - string - 'null' format: date-time last_scan_status: type: - string - 'null' description: >- Status of the newest scan that targets this domain (pending, running, completed, failed, cancelled). test_user_count: type: integer description: >- The number of test users that apply to this domain. This includes users that are shared with the domain and users that apply to every domain in the organization. login_check_status: type: - string - 'null' description: >- Status of the newest login check across the domain's test users (pending, running, succeeded, failed). Null when no check has run. open_issue_count: type: integer description: >- The number of active findings (open, in_progress, snoozed) that are attributed to this asset. Dependency findings are not counted. open_issues: allOf: - $ref: '#/components/schemas/ScanFindings' description: The same active findings as open_issue_count, grouped by severity. required: - id - organization_id - domain - verified - created_at VerificationMethods: type: object properties: dns: type: object properties: record_name: type: string record_value: type: string required: - record_name - record_value file: type: object properties: url: type: string file_content: type: string required: - url - file_content meta_tag: type: object properties: tag: type: string required: - tag hash: type: string required: - dns - file - meta_tag - hash ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ScanFindings: type: object properties: total: type: integer critical: type: integer high: type: integer medium: type: integer low: type: integer required: - total - critical - high - medium - low ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ValidationError: description: Request failed validation (e.g. malformed value or unsupported enum). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.