> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Arm a chat with engagement credentials > Attaches saved domain test users and/or credentials supplied in the request to a chat, so its agent can authenticate to the target. Values are encrypted at rest and handed only to the chat's trusted orchestrator, where host-side auth tools expose derived values (a resolved login, a TOTP code) to the agent; they never enter the chat transcript, the model context, or the agent sandbox. Re-attaching an account replaces it. Recorded as a chat.credentials.attached audit event. ## OpenAPI ````yaml /openapi.json post /chat/{chatId}/credentials openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. paths: /chat/{chatId}/credentials: post: tags: - Chat summary: Arm a chat with engagement credentials description: >- Attaches saved domain test users and/or credentials supplied in the request to a chat, so its agent can authenticate to the target. Values are encrypted at rest and handed only to the chat's trusted orchestrator, where host-side auth tools expose derived values (a resolved login, a TOTP code) to the agent; they never enter the chat transcript, the model context, or the agent sandbox. Re-attaching an account replaces it. Recorded as a chat.credentials.attached audit event. operationId: attachChatCredentials parameters: - name: chatId in: path required: true description: Chat id. schema: type: string format: uuid requestBody: required: true content: application/json: schema: type: object properties: test_user_ids: type: array items: type: string format: uuid description: >- Saved domain test users to attach; each must sit on a domain within the caller's access scope. credentials: type: array description: >- Credentials supplied for this chat only (not saved to a domain). items: type: object properties: label: type: string description: Display label; defaults to the username. username: type: string password: type: string login_url: type: string notes: type: string mfa_method: type: string enum: - none - totp - email_otp - magic_link totp_secret: type: string description: Shared TOTP seed; used when mfa_method is totp. mfa_email: type: string description: >- Strix inbox that receives the email code or magic link. required: - username scan_ids: type: array items: type: string format: uuid description: >- Pentests whose stored credentials this chat should reuse; the caller must have access to each pentest's targets. responses: '200': description: Credentials armed. content: application/json: schema: type: object properties: credentials: type: array items: type: object properties: label: type: string username: type: string login_url: type: - string - 'null' mfa_method: type: string enum: - none - totp - email_otp - magic_link has_password: type: boolean has_totp_secret: type: boolean test_user_id: type: - string - 'null' description: >- Set when the credential came from a saved domain test user. required: - label - username - mfa_method - has_password - has_totp_secret delivered: type: boolean description: >- False when the chat was still booting; the credentials are stored and handed to its orchestrator at launch. required: - credentials - delivered '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - chat:write components: responses: Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code and the `required_scope` field, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ValidationError: description: Request failed validation (e.g. malformed value or unsupported enum). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' schemas: ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. required: - detail ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - license:read - supply_chain:read - supply_chain:write securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint. Include as `Authorization: Bearer `. ````