> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update trust page settings > Publishes or unpublishes the trust page and sets its hidden sections. Omitted fields keep their current values. The first update assigns the random id in the page URL. Publishing requires at least one domain the organization verified in Strix, otherwise the request fails with 409. Requires the admin role. ## OpenAPI ````yaml /openapi.json patch /trust-page openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /trust-page: patch: tags: - Organization summary: Update trust page settings description: >- Publishes or unpublishes the trust page and sets its hidden sections. Omitted fields keep their current values. The first update assigns the random id in the page URL. Publishing requires at least one domain the organization verified in Strix, otherwise the request fails with 409. Requires the admin role. operationId: updateTrustPage requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateTrustPageRequest' responses: '200': description: Updated settings. content: application/json: schema: $ref: '#/components/schemas/UpdateTrustPageResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '409': $ref: '#/components/responses/Conflict' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - organizations:write components: schemas: UpdateTrustPageRequest: type: object additionalProperties: false properties: enabled: type: boolean hidden_items: type: array maxItems: 64 items: type: string maxLength: 64 description: >- Replaces the list of sections hidden from the public page. Unknown keys are dropped. Keys: `programs`, `pentests`, `checks`. Empty shows everything. UpdateTrustPageResponse: allOf: - type: object properties: success: type: boolean required: - success - $ref: '#/components/schemas/TrustPage' TrustPage: type: object properties: organization_id: type: string enabled: type: boolean description: >- Whether the page and badge are publicly reachable. Publishing requires at least one domain the organization verified in Strix. slug: type: - string - 'null' description: >- Random UUID Strix assigns to the public page: /trust/{slug}. Null until the first update. verified_domains: type: array items: type: string description: >- Domains the organization verified in Strix. The page can be published only while this list is not empty. hidden_items: type: array items: type: string description: >- Sections the admin hides from the public page. Keys: `programs`, `pentests`, `checks`. Empty shows everything. page_url: type: - string - 'null' format: uri badge_url: type: - string - 'null' format: uri description: SVG badge. Append ?theme=light for light backgrounds. badge_embed_html: type: - string - 'null' description: Ready-to-paste HTML that links the badge to the page. updated_by: type: - string - 'null' updated_at: type: - string - 'null' format: date-time summary: oneOf: - $ref: '#/components/schemas/TrustPageSummary' - type: 'null' required: - organization_id - enabled - slug - verified_domains - hidden_items - page_url - badge_url - badge_embed_html - updated_by - updated_at - summary ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail TrustPageSummary: type: object description: >- What the public page shows, read live from the workspace. Only dates and on or off facts, no counts and no findings. The `pentests` and `programs` fields already exclude hidden items. properties: slug: type: string displayName: type: string generatedAt: type: string format: date-time pentests: type: object properties: lastCompletedAt: type: - string - 'null' format: date-time description: When the most recent shown pentest completed. cadence: type: - string - 'null' description: >- Cadence of the active pentest schedule, for example `Weekly`. The next run date is never included. coverage: type: array description: >- Engagement types the organization has completed at least once, with the latest completion date of each. items: type: object properties: kind: type: string enum: - live_test - code_review - internal_infra description: Legacy full audits are reported as `live_test`. lastCompletedAt: type: string format: date-time required: - kind - lastCompletedAt testedTargets: type: array description: >- Targets covered by the completed engagement types. The public checklist marks a check as tested when one of its targets is in this list. items: type: string enum: - web - code - network required: - lastCompletedAt - cadence - coverage - testedTargets programs: type: object description: Which Strix programs are active and shown for the organization. properties: continuousPentesting: type: boolean description: An unpaused pentest schedule exists. prReview: type: boolean description: At least one repository has pull request review on. supplyChain: type: boolean description: At least one repository has supply chain monitoring on. containers: type: boolean description: At least one container image is monitored. required: - continuousPentesting - prReview - supplyChain - containers hiddenItems: type: array description: >- Sections the admin hides from the public page. Keys: `programs`, `pentests`, `checks`. items: type: string required: - slug - displayName - generatedAt - pentests - programs - hiddenItems ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Conflict: description: Conflict. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.