Create a schedule
Create a recurring scan schedule. Optionally trigger an immediate scan with also_run_now. Supply Chain schedules require the Enterprise Supply Chain entitlement. When also_run_now creates a chargeable scan, the optional Idempotency-Key covers both schedule creation and that immediate scan; reuse the exact same key only to retry the exact same request. Replay and in-progress responses are still subject to current authorization against the persisted schedule when it exists.
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Headers
Opaque caller-generated key for at-most-once billable scan creation; use a high-entropy value such as a UUID. Reuse the exact same key only when retrying the exact same request. Completed keys are retained for at least 24 hours; an unfinished accepted worker receipt may be held longer until its downstream queue horizon is safely reconciled. A completed failure is terminal for that key. Keyed terminal responses echo Idempotency-Key and set Idempotency-Replayed to true only when returning a stored outcome.
1 - 200^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,199}$Body
Recurring scan definition. Accepts every CreateScanRequest field plus the schedule fields.
Cron expression, e.g. 0 9 * * 1.
IANA timezone, e.g. America/New_York.
Cloud connections this run may read. If you omit this field, the run uses the connections that apply to its targets. A connection with empty applies_to_domain_ids and applies_to_repository_ids applies to every run. A connection with values in those lists applies only to a run that targets one of the listed domains or repositories. Send an empty array for no cloud connections.
Free-text security concerns to prioritize, for example IDOR on the invoices API.
ID of a network connector that gives the agent access to a private network. Use listConnectors to find it.
Free-text background about the target that helps the agent, for example architecture notes or recent changes.
Test accounts the agent logs in with during the scan. Stored encrypted and never returned. Prefer saved test users where available.
UUIDs of verified domains to test. Use listDomains to find them.
Map of domain ID to specific paths to scan.
Which engagement type this run is. When omitted, source-only scopes infer code_review, domain scopes infer live_test, and internal targets infer internal_infra.
code_review, live_test, internal_infra, compliance_pentest Free-text areas of the target to test first, for example the checkout flow.
Custom HTTP headers the agent sends on every request, for example an API key header. Stored encrypted and never returned.
Hosts or URLs inside a private network to test through the connector, for example http://10.0.0.5:8080.
Provider resources selected for this run in addition to organization-wide pins.
100Self-hosted only: stop the pentest gracefully once total LLM spend reaches this amount (USD). Omit for no limit.
x <= 1000000Self-hosted only: what happens when max_budget_usd is reached. pause parks every agent before its next model call until an operator resumes the scan with a higher limit or stops it (see POST /scans/{scanId}/budget); a paused scan waits with no deadline. stop ends the run at the limit. Defaults to pause. Ignored without max_budget_usd.
stop, pause Self-hosted only: run the scan with a named model config from Settings → LLM Models instead of the default assignment.
Extra addresses to CC on the completion email. Validated only when notify_on_completion is true.
Email the scan creator when the pentest finishes.
When true, the agent uses the organization knowledge base during the scan.
Map of repository ID to branch name.
UUIDs of connected repositories to test. Use listRepositories to find them.
Scan tier that sets how deep the pentest goes and which model quality it uses. The tier changes the credit price (lite ×0.3, standard ×0.75, ultra ×1). Defaults to ultra. Not applicable on self-hosted deployments, for organizations with raw model selection, and for organizations on the Enterprise plan.
lite, standard, ultra Saved test users to authenticate with. The server resolves their secrets. Each test user must cover one of the scan's domains. Use getScanTemplate to get the IDs of a previous scan.
Custom scan title. When you set a title, the server does not generate one. The server trims the value.
120Completed upload IDs to attach. A repository upload can be the sole target of a code review or provide white-box context for a domain pentest.
If true, immediately launch a scan in addition to creating the schedule.
If true, each fire runs a free supply-chain (dependency) scan of each repository in repository_ids. Supply-chain schedules accept repository targets only.