> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # List scans > Returns a paginated list of scans for the authenticated organization. Each scan carries finding counts. A pentest's counts omit dependency CVE findings. A supply-chain scan's findings are all dependency CVEs, so its counts are nonzero only when the token also holds the `dependencies:read` scope. ## OpenAPI ````yaml /openapi.json get /scans openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /scans: get: tags: - Scans summary: List scans description: >- Returns a paginated list of scans for the authenticated organization. Each scan carries finding counts. A pentest's counts omit dependency CVE findings. A supply-chain scan's findings are all dependency CVEs, so its counts are nonzero only when the token also holds the `dependencies:read` scope. operationId: listScans parameters: - $ref: '#/components/parameters/Page' - $ref: '#/components/parameters/Limit' - description: Return only scans in this status. name: status in: query schema: $ref: '#/components/schemas/ScanStatus' - description: >- Return only scans of this type. `whitebox` scans include source code, `blackbox` scans test targets externally. name: scan_type in: query schema: type: string enum: - whitebox - blackbox - name: date_from in: query description: Filter scans created on or after this date (ISO 8601). schema: type: string format: date-time - name: date_to in: query description: Filter scans created on or before this date (inclusive, end-of-day). schema: type: string format: date-time - description: Return only scans that target this domain UUID. name: domain_id in: query schema: type: string format: uuid - name: repository_id in: query description: Return only the scans that include this repository. schema: type: string format: uuid - name: search in: query description: Case-insensitive substring match on the scan title. schema: type: string - name: include_retests in: query description: >- Include per-finding retest scans in the results. Excluded by default, matching the dashboard pentest list. schema: type: boolean default: false - $ref: '#/components/parameters/SortBy_CreatedAt' - $ref: '#/components/parameters/SortOrder' responses: '200': description: Paginated list of scans. content: application/json: schema: allOf: - $ref: '#/components/schemas/PaginatedResponse_Scan' - type: object properties: scansThisMonth: type: integer '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - scans:read components: parameters: Page: description: Page number of the result set. The first page is 1. name: page in: query schema: type: integer minimum: 1 default: 1 Limit: description: >- Maximum number of items per page. The default is 20 and the maximum is 100. name: limit in: query schema: type: integer minimum: 1 maximum: 100 default: 20 SortBy_CreatedAt: description: Field to sort by. Only `created_at` is supported. name: sort_by in: query schema: type: string enum: - created_at default: created_at SortOrder: description: Sort direction. Use `asc` for oldest first or `desc` for newest first. name: sort_order in: query schema: type: string enum: - asc - desc default: desc schemas: ScanStatus: type: string enum: - pending - running - completed - failed - cancelled PaginatedResponse_Scan: type: object properties: items: type: array items: $ref: '#/components/schemas/Scan' meta: $ref: '#/components/schemas/PaginationMeta' required: - items - meta Scan: type: object properties: auth_checked_at: type: - string - 'null' format: date-time auth_detail: type: - string - 'null' description: Short, secret-free explanation of the login outcome. auth_failure_code: type: - string - 'null' description: >- Category of the login failure (e.g. invalid_credentials, mfa_required_not_configured). auth_status: type: - string - 'null' description: >- Whether the agent could log in with the provisioned test credentials, when any were configured: succeeded | failed. cloud_connection_checked_at: type: - string - 'null' format: date-time description: Time when the orchestrator checked the selected cloud connections. cloud_connection_status: type: - array - 'null' items: $ref: '#/components/schemas/CloudConnectionStatusEntry' description: Attachment outcome for each cloud connection selected for the scan. completed_at: type: string format: date-time connector_id: type: - string - 'null' created_at: type: string format: date-time domain_ids: type: array items: type: string format: uuid duration: type: - string - 'null' executive_summary: type: string findings: $ref: '#/components/schemas/ScanFindings' id: type: string format: uuid is_retest: type: boolean description: >- True for a retest scan. A retest scan verifies one or more existing issues and does not appear in the scan list. knowledge_resource_pins: type: - array - 'null' items: $ref: '#/components/schemas/RunKnowledgeResourcePin' description: >- Public provider-resource metadata selected specifically for this scan. live_prompt_enabled: type: boolean live_prompt_ready: type: boolean max_budget_usd: type: - number - 'null' description: 'Self-hosted only: per-scan LLM cost limit (USD), if one was set.' budget_policy: type: - string - 'null' enum: - stop - pause - null description: >- Self-hosted only: cost-limit policy the scan runs with, if a limit was set. methodology: type: string org_knowledge_enabled: type: - boolean - 'null' parent_scan_id: type: - string - 'null' description: 'Retest scans only: the scan that found the source issue.' parent_scan_title: type: - string - 'null' description: 'Retest scans only: the title of the parent scan.' recommendations: type: string repositories: type: array items: $ref: '#/components/schemas/Repository' repository_ids: type: array items: type: string format: uuid retest_source: type: - object - 'null' description: >- Retest scans that a Retest issue request started: the current state of that issue. Null for a retest that a rerun started, even when `retest_target_count` is 1. properties: id: type: string title: type: string severity: $ref: '#/components/schemas/VulnerabilitySeverity' status: $ref: '#/components/schemas/VulnerabilityStatus' required: - id - title - severity - status retest_source_scan_id: type: - string - 'null' description: >- Retest scans that a rerun started: the scan whose open issues the retest verifies. retest_source_vulnerability_id: type: - string - 'null' description: >- Retest scans that a Retest issue request started: the issue that the retest verifies. Null for a retest that a rerun started, even when `retest_target_count` is 1. retest_target_count: type: integer description: >- Retest scans only: the number of issues that the retest verifies. 0 for other scans. scan_tier: type: - string - 'null' enum: - lite - standard - ultra - null description: >- Scan tier the run used. A null value means the scan was launched without a tier. scan_type: type: string enum: - whitebox - blackbox schedule_id: type: - string - 'null' status: $ref: '#/components/schemas/ScanStatus' stop_reason: type: - string - 'null' enum: - budget_exceeded - rate_limited - agents_incomplete - null description: >- Why the engine ended the scan before its agents finished: the cost limit was reached, the model provider rate-limited the scan, or a sub-agent never finished. Null when the agents finished on their own. A retest scan that stopped early does not mark any issue fixed; its issues without a finding are `inconclusive`. status_detail: type: - string - 'null' description: >- Secret-free explanation of `status_detail_code`. Self-hosted installs return the exact infrastructure message, for example the Kubernetes scheduler message. The hosted product returns generic wording. For `budget_near_limit` every install returns the cost figures, for example `The run used $96.13 of its $100.00 cost limit (96%)…`. status_detail_code: oneOf: - $ref: '#/components/schemas/RunStatusDetailCode' - type: 'null' description: >- Reason code behind the current status. Set when the launch path or the infrastructure set the status, or when a `completed` scan ended early near its cost limit (`budget_near_limit`). `null` for an ordinary engine-owned status. technical_analysis: type: string title: type: string updated_at: type: string format: date-time urls: type: array items: type: string user_id: type: string required: - id - user_id - title - status - created_at PaginationMeta: type: object properties: page: type: integer limit: type: integer total_items: type: integer total_pages: type: integer has_next: type: boolean has_prev: type: boolean required: - page - limit - total_items - total_pages - has_next - has_prev ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail CloudConnectionStatusEntry: type: object required: - connection_id - provider - name - status - tool_count - reason properties: connection_id: type: string provider: type: string name: type: string status: type: string enum: - attached - failed tool_count: type: - integer - 'null' reason: type: - string - 'null' enum: - not_ready - duplicate_name - connect_failed - client_unavailable - null ScanFindings: type: object properties: total: type: integer critical: type: integer high: type: integer medium: type: integer low: type: integer required: - total - critical - high - medium - low RunKnowledgeResourcePin: type: object additionalProperties: false properties: connection_id: type: string minLength: 1 description: Organization cloud connection that owns the resource. page_id: type: string minLength: 1 description: Provider-specific opaque resource identifier. label: type: string minLength: 1 maxLength: 200 url: type: - string - 'null' format: uri guidance: type: string maxLength: 500 description: >- Optional context: what the resource holds and when Strix should read it. required: - connection_id - page_id - label - url Repository: type: object properties: url: type: string branch: type: string provider: type: string required: - url - branch - provider VulnerabilitySeverity: type: string enum: - critical - high - medium - low VulnerabilityStatus: type: string enum: - open - in_progress - snoozed - fixed - ignored - not_affected RunStatusDetailCode: type: string enum: - sandbox_pending - config_missing - llm_not_configured - secrets_missing - connector_unavailable - credentials_unreadable - image_pull_failed - pod_unschedulable - pod_rejected - container_config_failed - volume_failed - sandbox_ended - sandbox_timeout - docker_unavailable - sandbox_create_failed - launch_failed - retest_already_running - watchdog_timeout - launch_no_telemetry - relaunch_failed - relaunches_exhausted - engine_failed - budget_near_limit description: >- Machine-readable reason behind a run status. `sandbox_pending` means the run still waits for the sandbox. `budget_near_limit` qualifies a `completed` scan: the run used 85% or more of its cost limit, so Strix stopped the investigation early and the result may be incomplete. `retest_already_running` qualifies a `failed` retest that never ran: another retest already held one of its issues when it was launched. All other codes explain a failure that the launch path or the infrastructure set, not the engine. ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.