Create a scan
Launch a new penetration test scan against the specified targets. For retry-safe at-most-once creation, send an Idempotency-Key and reuse the exact same key and request after a lost or ambiguous response. The key is optional for backward compatibility, retained for 24 hours, and cannot be reused with a different actor, operation, or payload. A terminal response is replayed only after the caller still passes current target/resource authorization; revoked access returns a fresh 403/404 without exposing the receipt. Use a new key only for a deliberate new attempt. On a free pentest day, an eligible work-email user’s first one-off pentest reserves no credits, and so does a free pentest earned through the user’s referral link (one per new business domain that signs up) on any day; if the allowance is taken by a concurrent launch or the day ends mid-request, the response is 400 with code: free_pentest_rejected and a reason (already_used, off).
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Headers
Opaque caller-generated key for at-most-once billable scan creation; use a high-entropy value such as a UUID. Reuse the exact same key only when retrying the exact same request. Completed keys are retained for at least 24 hours; an unfinished accepted worker receipt may be held longer until its downstream queue horizon is safely reconciled. A completed failure is terminal for that key. Keyed terminal responses echo Idempotency-Key and set Idempotency-Replayed to true only when returning a stored outcome.
1 - 200^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,199}$Body
At least one target (domain_ids, repository_ids, upload_ids, or internal_targets) should be provided.
Cloud connections this run may read. If you omit this field, the run uses the connections that apply to its targets. A connection with empty applies_to_domain_ids and applies_to_repository_ids applies to every run. A connection with values in those lists applies only to a run that targets one of the listed domains or repositories. Send an empty array for no cloud connections.
Free-text security concerns to prioritize, for example IDOR on the invoices API.
ID of a network connector that gives the agent access to a private network. Use listConnectors to find it.
Free-text background about the target that helps the agent, for example architecture notes or recent changes.
Test accounts the agent logs in with during the scan. Stored encrypted and never returned. Prefer saved test users where available.
UUIDs of verified domains to test. Use listDomains to find them.
Map of domain ID to specific paths to scan.
Which engagement type this run is. When omitted, source-only scopes infer code_review, domain scopes infer live_test, and internal targets infer internal_infra.
code_review, live_test, internal_infra, compliance_pentest Free-text areas of the target to test first, for example the checkout flow.
Custom HTTP headers the agent sends on every request, for example an API key header. Stored encrypted and never returned.
Hosts or URLs inside a private network to test through the connector, for example http://10.0.0.5:8080.
Provider resources selected for this run in addition to organization-wide pins.
100Self-hosted only: stop the pentest gracefully once total LLM spend reaches this amount (USD). Omit for no limit.
x <= 1000000Self-hosted only: what happens when max_budget_usd is reached. pause parks every agent before its next model call until an operator resumes the scan with a higher limit or stops it (see POST /scans/{scanId}/budget); a paused scan waits with no deadline. stop ends the run at the limit. Defaults to pause. Ignored without max_budget_usd.
stop, pause Self-hosted only: run the scan with a named model config from Settings → LLM Models instead of the default assignment.
Extra addresses to CC on the completion email. Validated only when notify_on_completion is true.
Email the scan creator when the pentest finishes.
When true, the agent uses the organization knowledge base during the scan.
Map of repository ID to branch name.
UUIDs of connected repositories to test. Use listRepositories to find them.
Scan tier that sets how deep the pentest goes and which model quality it uses. The tier changes the credit price (lite ×0.3, standard ×0.75, ultra ×1). Defaults to ultra. Not applicable on self-hosted deployments, for organizations with raw model selection, and for organizations on the Enterprise plan.
lite, standard, ultra Saved test users to authenticate with. The server resolves their secrets. Each test user must cover one of the scan's domains. Use getScanTemplate to get the IDs of a previous scan.
Custom scan title. When you set a title, the server does not generate one. The server trims the value.
120Completed upload IDs to attach. A repository upload can be the sole target of a code review or provide white-box context for a domain pentest.