Create a scan
Launch a new penetration test scan against the specified targets. For retry-safe at-most-once creation, send an Idempotency-Key and reuse the exact same key and request after a lost or ambiguous response. The key is optional for backward compatibility, retained for 24 hours, and cannot be reused with a different actor, operation, or payload. A terminal response is replayed only after the caller still passes current target/resource authorization; revoked access returns a fresh 403/404 without exposing the receipt. Use a new key only for a deliberate new attempt.
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Headers
Opaque caller-generated key for at-most-once billable scan creation; use a high-entropy value such as a UUID. Reuse the exact same key only when retrying the exact same request. Completed keys are retained for at least 24 hours; an unfinished accepted worker receipt may be held longer until its downstream queue horizon is safely reconciled. A completed failure is terminal for that key. Keyed terminal responses echo Idempotency-Key and set Idempotency-Replayed to true only when returning a stored outcome.
1 - 200^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,199}$Body
At least one target (domain_ids, repository_ids, upload_ids, or internal_targets) should be provided.
Custom scan title. When you set a title, the server does not generate one. The server trims the value.
120Which engagement type this run is. When omitted, source-only scopes infer code_review, domain scopes infer live_test, and internal targets infer internal_infra.
code_review, live_test, internal_infra, compliance_pentest UUIDs of verified domains to test. Use listDomains to find them.
Map of domain ID to specific paths to scan.
UUIDs of connected repositories to test. Use listRepositories to find them.
Map of repository ID to branch name.
Test accounts the agent logs in with during the scan. Stored encrypted and never returned. Prefer saved test users where available.
Custom HTTP headers the agent sends on every request, for example an API key header. Stored encrypted and never returned.
Free-text security concerns to prioritize, for example IDOR on the invoices API.
Free-text areas of the target to test first, for example the checkout flow.
Free-text background about the target that helps the agent, for example architecture notes or recent changes.
Completed upload IDs to attach. A repository upload can be the sole target of a code review or provide white-box context for a domain pentest.
ID of a network connector that gives the agent access to a private network. Use listConnectors to find it.
Hosts or URLs inside a private network to test through the connector, for example http://10.0.0.5:8080.
When true, the agent uses the organization knowledge base during the scan.
Email the scan creator when the pentest finishes.
Extra addresses to CC on the completion email. Validated only when notify_on_completion is true.
Scan tier that sets how deep the pentest goes and which model quality it uses. The tier changes the credit price (lite ×0.3, standard ×0.75, ultra ×1). Defaults to ultra. Not applicable on self-hosted deployments, for organizations with raw model selection, and for organizations on the Enterprise plan.
lite, standard, ultra Self-hosted only: run the scan with a named model config from Settings → LLM Models instead of the default assignment.
Self-hosted only: stop the pentest gracefully once total LLM spend reaches this amount (USD). Omit for no limit.
x <= 1000000