> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a schedule > Create a recurring scan schedule. Optionally trigger an immediate scan with `also_run_now`. ## OpenAPI ````yaml /openapi.json post /schedules openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. paths: /schedules: post: tags: - Schedules summary: Create a schedule description: >- Create a recurring scan schedule. Optionally trigger an immediate scan with `also_run_now`. operationId: createSchedule requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateScheduleRequest' responses: '200': description: Schedule created. content: application/json: schema: type: object properties: schedule_id: type: string name: type: string scan_id: type: - string - 'null' description: >- Set when also_run_now was true and scan launched successfully. scan_error: type: - string - 'null' required: - schedule_id - name '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/TierLimitError' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - schedules:write components: schemas: CreateScheduleRequest: allOf: - $ref: '#/components/schemas/CreateScanRequest' - type: object properties: cron_expression: type: string description: Cron expression, e.g. `0 9 * * 1`. timezone: type: string description: IANA timezone, e.g. `America/New_York`. name: type: string also_run_now: type: boolean description: >- If true, immediately launch a scan in addition to creating the schedule. required: - cron_expression - timezone CreateScanRequest: type: object description: >- At least one target (domain_ids, repository_ids, or internal_targets) should be provided. properties: engagement_type: type: string enum: - code_review - live_test - internal_infra - compliance_pentest default: live_test description: >- Which engagement type this run is. Defaults to `live_test` server-side. domain_ids: type: array items: type: string format: uuid domain_paths: type: object additionalProperties: type: array items: type: string description: Map of domain ID to specific paths to scan. repository_ids: type: array items: type: string format: uuid repository_branches: type: object additionalProperties: type: string description: Map of repository ID to branch name. credentials: type: array items: type: object properties: username: type: string password: type: string notes: type: string mfa_method: type: string enum: - none - totp - email_otp - magic_link description: Multi-factor method for authenticated scans. totp_secret: type: string description: Base32 TOTP secret, used when mfa_method is `totp`. mfa_email: type: string format: email description: >- Inbox to read one-time codes / magic links from, used when mfa_method is `email_otp` or `magic_link`. login_url: type: string format: uri description: Login page URL for this credential set. required: - username - password headers: type: array items: type: object properties: name: type: string value: type: string notes: type: string required: - name - value concerns: type: string focus: type: string context: type: string upload_ids: type: array items: type: string connector_id: type: string internal_targets: type: array items: type: string org_knowledge_enabled: type: boolean notify_on_completion: type: boolean description: Email the scan creator when the pentest finishes. notification_emails: type: array items: type: string format: email description: >- Extra addresses to CC on the completion email. Validated only when notify_on_completion is true. ErrorResponse: type: object properties: detail: type: string required: - detail TierLimitErrorResponse: type: object properties: detail: type: string requiredTier: type: string code: type: string required: - detail responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' TierLimitError: description: Plan or credit limit reached. content: application/json: schema: $ref: '#/components/schemas/TierLimitErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint. Include as `Authorization: Bearer `. ````