> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Retest all findings > Starts retest scans for the findings of the scan. A single finding gets one targeted retest scan. Several findings share retest scans: one scan per group of up to 50 findings, in which every finding is checked by its own agent, all in parallel. The request checks access, the findings in scope, and the replacement uploads. Then it answers with status 202 and creates the retest scans in the background. The retest scans do not appear in the scan list. Read them, and the launches that are still starting or that failed to start, through `GET /scans/{scanId}/retests` on the source scan. A finding with a retest that is still running is skipped. ## OpenAPI ````yaml /openapi.json post /scans/{scanId}/retest-all openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /scans/{scanId}/retest-all: post: tags: - Scans summary: Retest all findings description: >- Starts retest scans for the findings of the scan. A single finding gets one targeted retest scan. Several findings share retest scans: one scan per group of up to 50 findings, in which every finding is checked by its own agent, all in parallel. The request checks access, the findings in scope, and the replacement uploads. Then it answers with status 202 and creates the retest scans in the background. The retest scans do not appear in the scan list. Read them, and the launches that are still starting or that failed to start, through `GET /scans/{scanId}/retests` on the source scan. A finding with a retest that is still running is skipped. operationId: retestAllScanFindings parameters: - $ref: '#/components/parameters/ScanId' requestBody: required: false content: application/json: schema: type: object properties: scope: type: string enum: - all - open description: Choose whether to retest all findings or only open findings. upload_ids: type: array minItems: 1 maxItems: 20 items: type: string minLength: 1 description: >- Optional upload IDs that replace the repository uploads of the source scan for this retest. additionalProperties: false responses: '200': description: >- No retest started. Every finding in scope is already retesting, or the scope has no findings. content: application/json: schema: $ref: '#/components/schemas/ScanRetestBatch' '202': description: The retests are starting in the background. content: application/json: schema: $ref: '#/components/schemas/ScanRetestBatch' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/TierLimitError' '404': $ref: '#/components/responses/NotFound' '409': description: A replacement upload is still being inspected. Try again shortly. content: application/json: schema: type: object properties: detail: type: string code: type: string enum: - UPLOAD_PROCESSING required: - detail - code '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - scans:write components: parameters: ScanId: description: UUID of the scan. Use the `id` field of a scan from `listScans`. name: scanId in: path required: true schema: type: string format: uuid schemas: ScanRetestBatch: type: object properties: batch_id: type: - string - 'null' format: uuid description: >- The batch that starts the retests. The value is null when no retest was accepted. accepted: type: integer description: The number of retests that are starting in the background. total: type: integer description: The number of findings in the requested scope. skipped_running: type: integer description: >- The number of findings that the request skipped because a retest of the finding is still running or starting. required: - batch_id - accepted - total - skipped_running ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail TierLimitErrorResponse: type: object properties: detail: type: string requiredTier: type: string code: type: string required: - detail ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' TierLimitError: description: Plan or credit limit reached. content: application/json: schema: $ref: '#/components/schemas/TierLimitErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.