> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Trigger a schedule immediately > Trigger an immediate run of a scheduled scan. Stored Supply Chain schedules require the Enterprise Supply Chain entitlement. When a pentest schedule fires, the open issues of its earlier runs also get separate retest scans (up to 50 issues each), in their own sandboxes and with their own agents, so the new pentest does not know the old issues. Each open issue is retested once, in a run scoped like the newest earlier run whose scope still reaches it. An open issue that the retest scan does not reproduce is set to `fixed`. Read the retest scans through `GET /scans/{scanId}/retests` on each earlier run that has open issues. A 200 acknowledges durable queue acceptance; later execution failures are reported in the schedule's run health and are never silently launched a second time. Manual schedule fires support the optional Idempotency-Key contract used by scan creation: reuse the exact same key only to retry the same schedule trigger after a lost or ambiguous response. Replay and in-progress responses are returned only after current authorization against the schedule succeeds. ## OpenAPI ````yaml /openapi.json post /schedules/{scheduleId}/trigger openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /schedules/{scheduleId}/trigger: post: tags: - Schedules summary: Trigger a schedule immediately description: >- Trigger an immediate run of a scheduled scan. Stored Supply Chain schedules require the Enterprise Supply Chain entitlement. When a pentest schedule fires, the open issues of its earlier runs also get separate retest scans (up to 50 issues each), in their own sandboxes and with their own agents, so the new pentest does not know the old issues. Each open issue is retested once, in a run scoped like the newest earlier run whose scope still reaches it. An open issue that the retest scan does not reproduce is set to `fixed`. Read the retest scans through `GET /scans/{scanId}/retests` on each earlier run that has open issues. A 200 acknowledges durable queue acceptance; later execution failures are reported in the schedule's run health and are never silently launched a second time. Manual schedule fires support the optional Idempotency-Key contract used by scan creation: reuse the exact same key only to retry the same schedule trigger after a lost or ambiguous response. Replay and in-progress responses are returned only after current authorization against the schedule succeeds. operationId: triggerSchedule parameters: - $ref: '#/components/parameters/ScheduleId' - $ref: '#/components/parameters/IdempotencyKey' responses: '200': description: >- The manual fire was durably accepted by the queue. This does not assert that the asynchronously launched scan has completed successfully. headers: Idempotency-Key: $ref: '#/components/headers/IdempotencyKeyResponse' Idempotency-Replayed: $ref: '#/components/headers/IdempotencyReplayed' content: application/json: schema: $ref: '#/components/schemas/SuccessResponse' '400': $ref: '#/components/responses/IdempotencyBadRequest' '401': $ref: '#/components/responses/Unauthorized' '402': $ref: '#/components/responses/PaymentRequired' '403': description: >- The plan or Enterprise Supply Chain entitlement does not allow this request. content: application/json: schema: $ref: '#/components/schemas/TierLimitErrorResponse' '404': $ref: '#/components/responses/NotFound' '409': $ref: '#/components/responses/IdempotencyConflictOrInProgress' '500': $ref: '#/components/responses/IdempotencyInternalOrAbandoned' '503': $ref: '#/components/responses/IdempotencyOutcomeUnknown' security: - BearerAuth: - schedules:write components: parameters: ScheduleId: description: >- ID of the schedule. Use the `id` field of a schedule from `listSchedules`. name: scheduleId in: path required: true schema: type: string IdempotencyKey: name: Idempotency-Key in: header required: false description: >- Opaque caller-generated key for at-most-once billable scan creation; use a high-entropy value such as a UUID. Reuse the exact same key only when retrying the exact same request. Completed keys are retained for at least 24 hours; an unfinished accepted worker receipt may be held longer until its downstream queue horizon is safely reconciled. A completed failure is terminal for that key. Keyed terminal responses echo Idempotency-Key and set Idempotency-Replayed to true only when returning a stored outcome. schema: type: string minLength: 1 maxLength: 200 pattern: ^[A-Za-z0-9][A-Za-z0-9._:/=-]{0,199}$ headers: IdempotencyKeyResponse: description: Echoes the caller's Idempotency-Key on keyed operation responses. schema: type: string IdempotencyReplayed: description: >- `true` when this response was replayed from the durable receipt; `false` on the original keyed response. schema: type: string enum: - 'true' - 'false' IdempotencyRetryAfter: description: >- Minimum seconds to wait before retrying the exact request with the same Idempotency-Key. schema: type: integer minimum: 1 schemas: SuccessResponse: type: object properties: success: type: boolean required: - success TierLimitErrorResponse: type: object properties: detail: type: string requiredTier: type: string code: type: string required: - detail ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail InvalidIdempotencyKeyError: type: object properties: detail: type: string code: const: invalid_idempotency_key terminal: const: true required: - detail - code - terminal ScanCreditPaywallResponse: type: object description: >- Returned with status 402 when the workspace has no credits for the request. No scan or chat turn starts and no credits are consumed. The body leads with a credit purchase sized to this request: open `checkout_url` when present, otherwise create one with `topup_options[0]`. properties: detail: type: string description: >- Human-readable explanation with the short recovery instruction (how many credits to buy, at what price, and where). When `plan_trial` is present, the text also mentions the Cloud plan trial as a separate offer. requiredTier: type: string code: type: string enum: - scan_credit_limit_reached - chat_credit_limit_reached reason: type: string description: >- Why automatic top-up did not refill the wallet, when the organization has it on. `chat_cap_reached` means the per-chat limit stopped the purchase. Lift it for that chat with `PUT /chat/{chatId}/auto-topup-limit`. `monthly_cap_reached` means the monthly cap stopped it. enum: - disabled - not_needed - exceeds_max_topup - monthly_cap_reached - chat_cap_reached - no_customer - no_payment_method - not_configured - charge_in_progress - authentication_required - charge_failed hint: type: string description: >- Short recovery instruction: buy `credits_to_buy` credits at `checkout_url` (or the dashboard billing page when no checkout could be created), then retry. checkout_url: type: string format: uri description: >- Hosted checkout for exactly `credits_to_buy` credits, already created for this caller. The user pays in the browser and the credits are granted when the payment completes. Present only when the caller could have created it through `POST /billing/checkout` itself (token with `billing:write`, not asset-scoped, admin role for personal tokens) and the checkout provider answered. credits_to_buy: type: integer description: >- Credits this request is short by, rounded up and clamped to the top-up bounds. Falls back to the dashboard default when the request could not be estimated. price_usd: type: number description: Price of `credits_to_buy` credits in US dollars. topup_url: type: string format: uri description: The dashboard billing page where a user can buy credits. topup_options: type: array description: >- Ways to add credits, in the order a headless caller should try them: a hosted checkout link for `credits_to_buy` credits first, then the opt-in agent-wallet payment, then a balance check. items: type: object properties: method: type: string enum: - GET - POST path: type: string description: The API path, relative to the API root. body: type: object description: >- The JSON request body to send, already filled in with `credits_to_buy`. additionalProperties: true cli: type: string description: The matching Strix CLI command. description: type: string required: - method - path - cli - description plan_trial: type: object description: >- The Cloud plan trial, offered separately from the credit purchase. Present only when the workspace has not subscribed before, can still start the trial, and checkout would grant this buyer the trial. The plan includes PR security reviews and does not include scan credits. properties: plan: type: string enum: - strix_cloud description: The `product` value for `POST /api/v1/billing/checkout`. trial_days: type: integer description: Maximum length of the free trial in days. includes: type: string description: What the plan includes. adds_scan_credits: type: boolean enum: - false description: >- Always false: subscribing does not add scan credits, so it does not clear this 402. method: type: string enum: - POST path: type: string description: The API path, relative to the API root. cli: type: string description: The matching Strix CLI command. url: type: string format: uri description: The dashboard billing page where a user can start the trial. description: type: string required: - plan - trial_days - includes - adds_scan_credits - method - path - cli - url - description required_credits: type: integer description: Total credits the request needs. available_credits: type: integer description: Credits currently in the workspace wallet. required: - detail - code - hint - credits_to_buy - price_usd - topup_url - topup_options IdempotencyKeyConflictError: type: object properties: detail: type: string code: const: idempotency_key_conflict terminal: const: true required: - detail - code - terminal IdempotencyRequestInProgressError: type: object properties: detail: type: string code: const: idempotency_request_in_progress retry_safe: const: true terminal: const: false required: - detail - code - retry_safe - terminal IdempotencyAcceptedResponseUnavailableError: type: object description: >- The scan reached durable acceptance, but the endpoint resource needed to reconstruct its original response was removed. The launch is terminal and must not be repeated with a new key. properties: detail: type: string code: const: idempotency_accepted_response_unavailable terminal: const: true scan_id: type: string format: uuid required: - detail - code - terminal - scan_id IdempotencyAttemptAbandonedError: type: object description: >- The prior attempt did not reach durable acceptance. This key is terminal; a deliberate new attempt requires a new key. properties: detail: type: string code: const: idempotency_attempt_abandoned terminal: const: true scan_id: type: string format: uuid required: - detail - code - terminal - scan_id IdempotencyOutcomeUnknownError: type: object properties: detail: type: string code: const: idempotency_outcome_unknown retry_safe: const: true terminal: const: false scan_id: type: string format: uuid required: - detail - code - retry_safe - terminal - scan_id ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: IdempotencyBadRequest: description: Bad request, including a malformed Idempotency-Key. headers: Idempotency-Key: $ref: '#/components/headers/IdempotencyKeyResponse' Idempotency-Replayed: $ref: '#/components/headers/IdempotencyReplayed' content: application/json: schema: oneOf: - $ref: '#/components/schemas/ErrorResponse' - $ref: '#/components/schemas/InvalidIdempotencyKeyError' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' PaymentRequired: description: >- Out of credits. The body leads with a credit purchase sized to the request (`checkout_url` when the caller may buy credits, otherwise the API, CLI, or dashboard steps), then retry the request. content: application/json: schema: $ref: '#/components/schemas/ScanCreditPaywallResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' IdempotencyConflictOrInProgress: description: >- The key is bound to a different request (terminal), the exact matching request is still in progress (retry-safe), or an accepted launch can no longer reconstruct its original endpoint resource (terminal; do not launch again). headers: Idempotency-Key: $ref: '#/components/headers/IdempotencyKeyResponse' Idempotency-Replayed: $ref: '#/components/headers/IdempotencyReplayed' Retry-After: $ref: '#/components/headers/IdempotencyRetryAfter' content: application/json: schema: oneOf: - $ref: '#/components/schemas/IdempotencyKeyConflictError' - $ref: '#/components/schemas/IdempotencyRequestInProgressError' - $ref: >- #/components/schemas/IdempotencyAcceptedResponseUnavailableError IdempotencyInternalOrAbandoned: description: >- Internal server error, or a reconciled attempt that did not reach durable acceptance. An `idempotency_attempt_abandoned` response is terminal for this key; use a new key only for a deliberate new launch. headers: Idempotency-Key: $ref: '#/components/headers/IdempotencyKeyResponse' Idempotency-Replayed: $ref: '#/components/headers/IdempotencyReplayed' content: application/json: schema: oneOf: - $ref: '#/components/schemas/ErrorResponse' - $ref: '#/components/schemas/IdempotencyAttemptAbandonedError' IdempotencyOutcomeUnknown: description: >- The outcome is still being reconciled. Retry the exact request with the same key after Retry-After; do not generate a new key. headers: Idempotency-Key: $ref: '#/components/headers/IdempotencyKeyResponse' Idempotency-Replayed: $ref: '#/components/headers/IdempotencyReplayed' Retry-After: $ref: '#/components/headers/IdempotencyRetryAfter' content: application/json: schema: $ref: '#/components/schemas/IdempotencyOutcomeUnknownError' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.