> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Send a chat message > Sends a message to an active chat. Use `application/json` for text-only, or `multipart/form-data` to attach files. `message` may be omitted for a control-only request when `cancel_current` or `stop_agent` is true. ## OpenAPI ````yaml /openapi.json post /chat/{chatId}/message openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /chat/{chatId}/message: post: tags: - Chat summary: Send a chat message description: >- Sends a message to an active chat. Use `application/json` for text-only, or `multipart/form-data` to attach files. `message` may be omitted for a control-only request when `cancel_current` or `stop_agent` is true. operationId: sendChatMessage parameters: - name: chatId in: path required: true description: Chat id. schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SendChatMessageRequest' multipart/form-data: schema: type: object properties: message: type: string minLength: 1 cancel_current: type: string stop_agent: type: string description: >- "true" parks the target agent and its descendants instead of only cancelling the current turn. files: type: array items: type: string format: binary repos: type: string description: JSON-encoded array of {repoId, branch}. images: type: string description: JSON-encoded array of {url}. agent_id: type: string description: >- Deliver the message to this subagent instead of the chat's root agent. anyOf: - required: - message - required: - cancel_current properties: cancel_current: const: 'true' - required: - stop_agent properties: stop_agent: const: 'true' responses: '200': description: Message accepted. content: application/json: schema: type: object additionalProperties: true '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '402': $ref: '#/components/responses/PaymentRequired' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - chat:write components: schemas: SendChatMessageRequest: type: object description: >- Send a `message`, or set `cancel_current` or `stop_agent` to true. Attach `repos` or `images` as context for the message. properties: message: description: Next instruction for the agent, in natural language. type: string minLength: 1 cancel_current: type: boolean description: Cancel the in-flight agent turn before sending. stop_agent: type: boolean description: >- Park the target agent and its descendants (leaves first) instead of only cancelling the current turn. Parked agents resume when messaged again. Send with agent_id and no message to stop a subagent. repos: description: Additional connected repositories to attach as context. type: array items: $ref: '#/components/schemas/ChatRepoRef' images: description: Image URLs to attach to the message. type: array items: type: object properties: url: type: string required: - url agent_id: type: string description: >- Deliver the message to this subagent instead of the chat's root agent. anyOf: - required: - message - required: - cancel_current properties: cancel_current: const: true - required: - stop_agent properties: stop_agent: const: true ChatRepoRef: type: object properties: repoId: type: string description: Connected repository id to attach as context. branch: type: string required: - repoId ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail ScanCreditPaywallResponse: type: object description: >- Returned with status 402 when the workspace has no credits for the request. No scan or chat turn starts and no credits are consumed. The body leads with a credit purchase sized to this request: open `checkout_url` when present, otherwise create one with `topup_options[0]`. properties: detail: type: string description: >- Human-readable explanation with the short recovery instruction (how many credits to buy, at what price, and where). When `plan_trial` is present, the text also mentions the Cloud plan trial as a separate offer. requiredTier: type: string code: type: string enum: - scan_credit_limit_reached - chat_credit_limit_reached reason: type: string description: >- Why automatic top-up did not refill the wallet, when the organization has it on. `chat_cap_reached` means the per-chat limit stopped the purchase. Lift it for that chat with `PUT /chat/{chatId}/auto-topup-limit`. `monthly_cap_reached` means the monthly cap stopped it. enum: - disabled - not_needed - exceeds_max_topup - monthly_cap_reached - chat_cap_reached - no_customer - no_payment_method - not_configured - charge_in_progress - authentication_required - charge_failed hint: type: string description: >- Short recovery instruction: buy `credits_to_buy` credits at `checkout_url` (or the dashboard billing page when no checkout could be created), then retry. checkout_url: type: string format: uri description: >- Hosted checkout for exactly `credits_to_buy` credits, already created for this caller. The user pays in the browser and the credits are granted when the payment completes. Present only when the caller could have created it through `POST /billing/checkout` itself (token with `billing:write`, not asset-scoped, admin role for personal tokens) and the checkout provider answered. credits_to_buy: type: integer description: >- Credits this request is short by, rounded up and clamped to the top-up bounds. Falls back to the dashboard default when the request could not be estimated. price_usd: type: number description: Price of `credits_to_buy` credits in US dollars. topup_url: type: string format: uri description: The dashboard billing page where a user can buy credits. topup_options: type: array description: >- Ways to add credits, in the order a headless caller should try them: a hosted checkout link for `credits_to_buy` credits first, then the opt-in agent-wallet payment, then a balance check. items: type: object properties: method: type: string enum: - GET - POST path: type: string description: The API path, relative to the API root. body: type: object description: >- The JSON request body to send, already filled in with `credits_to_buy`. additionalProperties: true cli: type: string description: The matching Strix CLI command. description: type: string required: - method - path - cli - description plan_trial: type: object description: >- The Cloud plan trial, offered separately from the credit purchase. Present only when the workspace has not subscribed before, can still start the trial, and checkout would grant this buyer the trial. The plan includes PR security reviews and does not include scan credits. properties: plan: type: string enum: - strix_cloud description: The `product` value for `POST /api/v1/billing/checkout`. trial_days: type: integer description: Maximum length of the free trial in days. includes: type: string description: What the plan includes. adds_scan_credits: type: boolean enum: - false description: >- Always false: subscribing does not add scan credits, so it does not clear this 402. method: type: string enum: - POST path: type: string description: The API path, relative to the API root. cli: type: string description: The matching Strix CLI command. url: type: string format: uri description: The dashboard billing page where a user can start the trial. description: type: string required: - plan - trial_days - includes - adds_scan_credits - method - path - cli - url - description required_credits: type: integer description: Total credits the request needs. available_credits: type: integer description: Credits currently in the workspace wallet. required: - detail - code - hint - credits_to_buy - price_usd - topup_url - topup_options ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' PaymentRequired: description: >- Out of credits. The body leads with a credit purchase sized to the request (`checkout_url` when the caller may buy credits, otherwise the API, CLI, or dashboard steps), then retry the request. content: application/json: schema: $ref: '#/components/schemas/ScanCreditPaywallResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.