Create a schedule
Create a recurring scan schedule. Optionally trigger an immediate scan with also_run_now. Supply Chain schedules require the Enterprise Supply Chain entitlement. When also_run_now creates a chargeable scan, the optional Idempotency-Key covers both schedule creation and that immediate scan; reuse the exact same key only to retry the exact same request. Replay and in-progress responses are still subject to current authorization against the persisted schedule when it exists.
Authorizations
API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.
Headers
Opaque caller-generated key for at-most-once billable scan creation; use a high-entropy value such as a UUID. Reuse the exact same key only when retrying the exact same request. Completed keys are retained for at least 24 hours; an unfinished accepted worker receipt may be held longer until its downstream queue horizon is safely reconciled. A completed failure is terminal for that key. Keyed terminal responses echo Idempotency-Key and set Idempotency-Replayed to true only when returning a stored outcome.
1 - 200^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,199}$Body
Recurring scan definition. Accepts every CreateScanRequest field plus the schedule fields.
Cron expression, e.g. 0 9 * * 1.
IANA timezone, e.g. America/New_York.
Custom scan title. When you set a title, the server does not generate one. The server trims the value.
120Which engagement type this run is. When omitted, source-only scopes infer code_review, domain scopes infer live_test, and internal targets infer internal_infra.
code_review, live_test, internal_infra, compliance_pentest UUIDs of verified domains to test. Use listDomains to find them.
Map of domain ID to specific paths to scan.
UUIDs of connected repositories to test. Use listRepositories to find them.
Map of repository ID to branch name.
Test accounts the agent logs in with during the scan. Stored encrypted and never returned. Prefer saved test users where available.
Custom HTTP headers the agent sends on every request, for example an API key header. Stored encrypted and never returned.
Free-text security concerns to prioritize, for example IDOR on the invoices API.
Free-text areas of the target to test first, for example the checkout flow.
Free-text background about the target that helps the agent, for example architecture notes or recent changes.
Completed upload IDs to attach. A repository upload can be the sole target of a code review or provide white-box context for a domain pentest.
ID of a network connector that gives the agent access to a private network. Use listConnectors to find it.
Hosts or URLs inside a private network to test through the connector, for example http://10.0.0.5:8080.
When true, the agent uses the organization knowledge base during the scan.
Email the scan creator when the pentest finishes.
Extra addresses to CC on the completion email. Validated only when notify_on_completion is true.
Scan tier that sets how deep the pentest goes and which model quality it uses. The tier changes the credit price (lite ×0.3, standard ×0.75, ultra ×1). Defaults to ultra. Not applicable on self-hosted deployments, for organizations with raw model selection, and for organizations on the Enterprise plan.
lite, standard, ultra Self-hosted only: run the scan with a named model config from Settings → LLM Models instead of the default assignment.
Self-hosted only: stop the pentest gracefully once total LLM spend reaches this amount (USD). Omit for no limit.
x <= 1000000If true, immediately launch a scan in addition to creating the schedule.
If true, each fire runs a free supply-chain (dependency) scan of each repository in repository_ids. Supply-chain schedules accept repository targets only.