> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Complete an interactive CLI sign-in > Finish an interactive CLI sign-in after the user picks a workspace and scopes. Send the `selection_token` from the poll response. The workspace must be one of the user's memberships. The server always includes the minimum scopes and the member's role limits the final set. When `workspace_name` is present, the server checks that the user is an admin, mints the token, and then renames the chosen workspace. A failed rename does not fail the sign-in. The selection token expires after 10 minutes. This endpoint does not require authentication. ## OpenAPI ````yaml /openapi.json post /cli/login/complete openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /cli/login/complete: post: tags: - CLI summary: Complete an interactive CLI sign-in description: >- Finish an interactive CLI sign-in after the user picks a workspace and scopes. Send the `selection_token` from the poll response. The workspace must be one of the user's memberships. The server always includes the minimum scopes and the member's role limits the final set. When `workspace_name` is present, the server checks that the user is an admin, mints the token, and then renames the chosen workspace. A failed rename does not fail the sign-in. The selection token expires after 10 minutes. This endpoint does not require authentication. operationId: completeCliLogin requestBody: required: true content: application/json: schema: type: object properties: selection_token: type: string description: >- Selection token from POST /cli/login/poll with `interactive` set to true. organization_id: type: string description: >- Workspace that receives the token. Without this field, the server uses the user's first workspace. workspace_name: type: string maxLength: 100 description: >- New name for the chosen workspace. Use it when the workspace option has `has_default_name` set to true. The user must be an admin of the workspace. An empty value keeps the current name. When the value equals the current default name, the server records that the user chose the name and `onboarding.workspace_named` becomes true. If the rename fails, the sign-in still completes and `organization_name` shows the current name. scopes: type: array items: $ref: '#/components/schemas/ApiV1Scope' description: >- Scopes the user selected. The server always includes the minimum scopes scans:read, scans:write, and billing:read. The member's role limits the final set. scope_profile: $ref: '#/components/schemas/CliScopeProfile' required: - selection_token responses: '200': description: >- Sign-in complete. The `api_token` field contains the raw secret — store it securely. content: application/json: schema: $ref: '#/components/schemas/CliLoginResult' '400': description: The selection token or a requested scope is missing or invalid. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: The selection token is invalid or expired. Start the sign-in again. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- The user is not a member of the selected workspace, or `workspace_name` was sent and the user is not an admin (`not_an_admin`). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Too many requests from this client. Wait and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': $ref: '#/components/responses/InternalError' security: [] components: schemas: ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read CliScopeProfile: type: string enum: - minimal - recommended - full - custom description: >- Named CLI authority preference. Minimal grants scans and billing:read. Recommended adds every scope that everyday `strix cloud` commands use: vulnerabilities, dependencies, supply chain, schedules, assets, knowledge, PR reviews, connectors, chat, uploads, integrations, analytics, license, webhooks:read, audit:read, organizations:read, organizations:write, and billing:write. Full means the session's approved ceiling after login and adds account administration (members, invitations, tokens, webhooks:write, LLM, test users). Custom requires an explicit scopes array. The member's role caps every profile. CliLoginResult: type: object properties: api_token: type: string description: Raw personal API token secret. Only returned at sign-in time. organization_id: type: string organization_name: type: string email: type: string expires_at: type: string format: date-time description: Expiry of the API token. is_new_user: type: boolean description: True when this sign-in created the account. scopes: type: array items: $ref: '#/components/schemas/ApiV1Scope' description: Scopes granted to the minted token. scope_ceiling: type: array items: $ref: '#/components/schemas/ApiV1Scope' description: Maximum authority approved for this session at login. requested_scopes: type: array items: $ref: '#/components/schemas/ApiV1Scope' scope_profile: $ref: '#/components/schemas/CliScopeProfile' token_id: type: string format: uuid credential_source: type: string enum: - api - cli device_name: type: - string - 'null' onboarding: $ref: '#/components/schemas/CliOnboardingState' description: >- Setup state of the workspace that received the token. Omitted when the server cannot read the live workspace state. The token is still valid in that case. next_steps_hint: type: string description: >- One short paragraph with the first commands to run after sign-in. When the workspace still has its default name, the text names the rename command for a session with organizations:write, and tells other sessions to ask a workspace admin or to sign in again with the full profile. When `onboarding.github_install_url` is present, the text tells the person to open the link. When the session also has integrations:write, the text names the command that creates a new link. When the workspace can still start the Cloud plan trial and the new session can call the billing checkout operation, the text also offers the trial. The session must have the billing:write scope and no asset scopes. next_steps: type: array items: $ref: '#/components/schemas/CliNextStep' description: >- Suggested first actions, in order. Each item names the CLI command and the matching API operation. Setup steps come first: name the workspace when the session has organizations:write and the workspace still has its default name, and connect GitHub when the session has integrations:write, no asset scopes, and `onboarding.github_install_url` is present. A deployment without the GitHub App never gets the GitHub step. When the workspace can still start the Cloud plan trial and the new session can call the billing checkout operation, the last item starts the trial. The session must have the billing:write scope and no asset scopes. dashboard_url: type: string format: uri description: URL of the Strix dashboard. required: - api_token - organization_id - organization_name - email - expires_at - is_new_user - scopes - scope_ceiling - requested_scopes - scope_profile - token_id - credential_source ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail CliOnboardingState: type: object description: >- Setup state of the workspace that received the token. The server computes it from live data on every sign-in, so it is correct for new and returning users. When the server cannot read the live state, the sign-in response omits this object instead of reporting unverified values. properties: workspace_named: type: boolean description: >- False while the workspace still has the name the server generated at sign-up, for example `Alex's Workspace`. The server records the origin of the name, so a later profile change does not alter this value. Rename the workspace with PATCH /organization. repositories_connected: type: boolean description: >- True when at least one repository has an active installation in the workspace. Repositories from a disconnected installation do not count. domains_added: type: boolean description: True when at least one domain is added to the workspace. github_install_url: type: string format: uri description: >- Link to install the Strix GitHub App on the workspace. Present for an admin session without asset scopes while no repository is connected. A person opens the link in a browser. When the browser has no dashboard session, the dashboard asks the person to sign in with the same account and returns to the installation. The new browser session is bound to this workspace. The link expires after 10 minutes. POST /integrations/github/install-url creates a new one. Absent when this deployment has no GitHub App. required: - workspace_named - repositories_connected - domains_added CliNextStep: type: object properties: action: type: string description: What the step does, for example `List your workspaces`. cli: type: string description: The Strix CLI command for this step. method: type: string enum: - GET - POST - PATCH path: type: string description: The API path for this step, relative to the API root. required: - action - cli - method - path responses: InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.