> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update a schedule > Update a schedule's configuration, cron expression, or pause/resume it. Send `action: "pause"` or `action: "resume"` to toggle, or provide fields to update. ## OpenAPI ````yaml /openapi.json patch /schedules/{scheduleId} openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /schedules/{scheduleId}: patch: tags: - Schedules summary: Update a schedule description: >- Update a schedule's configuration, cron expression, or pause/resume it. Send `action: "pause"` or `action: "resume"` to toggle, or provide fields to update. operationId: updateSchedule parameters: - $ref: '#/components/parameters/ScheduleId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateScheduleRequest' responses: '200': description: Schedule updated. content: application/json: schema: type: object properties: success: type: boolean isPaused: type: boolean required: - success '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/TierLimitError' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - schedules:write components: parameters: ScheduleId: description: >- ID of the schedule. Use the `id` field of a schedule from `listSchedules`. name: scheduleId in: path required: true schema: type: string schemas: UpdateScheduleRequest: type: object properties: action: type: string enum: - pause - resume description: Pause or resume the schedule. Mutually exclusive with other fields. cloud_connection_ids: type: - array - 'null' items: type: string description: >- Full replacement cloud-connection selection. Null restores the default, so each run uses the connections that apply to its targets. An empty array means no cloud connections. concerns: description: Free-text security concerns to prioritize on each run. type: string connector_id: description: >- ID of the network connector each run uses to reach a private network. type: string context: description: Free-text background about the target for each run. type: string credentials: type: array items: type: object properties: username: type: string password: type: string notes: type: string mfa_method: type: string enum: - none - totp - email_otp - magic_link description: Multi-factor method for authenticated scans. totp_secret: type: string description: Base32 TOTP secret, used when mfa_method is `totp`. mfa_email: type: string format: email description: >- Inbox to read one-time codes / magic links from, used when mfa_method is `email_otp` or `magic_link`. login_url: type: string format: uri description: Login page URL for this credential set. required: - username - password description: >- Replaces ALL stored manual credentials for the schedule. Omit to keep the stored credentials unchanged (the template endpoint returns their metadata only). cron_expression: description: New cron expression, for example `0 9 * * 1`. type: string domain_ids: description: Full replacement list of domain UUIDs to test on each run. type: array items: type: string domain_paths: description: Map of domain ID to specific paths to scan on each run. type: object additionalProperties: type: array items: type: string focus: description: Free-text areas of the target to test first on each run. type: string headers: type: array description: >- Full replacement set of custom headers. Stored header values are never returned by the template endpoint. Send keep_stored_value: true (with no value) to reuse the stored value of the existing schedule header with the same name. items: type: object properties: name: type: string value: type: string notes: type: string keep_stored_value: type: boolean description: >- Reuse the stored value of the existing header with the same name instead of sending one. required: - name internal_targets: description: >- Full replacement list of private-network hosts or URLs to test through the connector. type: array items: type: string knowledge_resource_pins: type: - array - 'null' maxItems: 100 items: $ref: '#/components/schemas/RunKnowledgeResourcePin' description: >- Full replacement set of per-run provider resources. Send null to clear. max_budget_usd: type: - number - 'null' exclusiveMinimum: 0 maximum: 1000000 description: >- Self-hosted only: per-run LLM cost limit (USD) applied to each fired scan. Send null to clear. budget_policy: type: - string - 'null' enum: - stop - pause - null description: >- Self-hosted only: cost-limit policy applied to each fired scan. Send null to use the deployment default. name: description: New display name of the schedule. type: string notification_emails: type: array items: type: string format: email description: >- Extra addresses to CC on each run's completion email. Validated only when notify_on_completion is true. notify_on_completion: type: boolean description: Email the schedule owner when each run completes. org_knowledge_enabled: description: When true, each run uses the organization knowledge base. type: boolean repository_branches: description: Map of repository ID to the branch name to test on each run. type: object additionalProperties: type: string repository_ids: description: Full replacement list of repository UUIDs to test on each run. type: array items: type: string scan_tier: type: - string - 'null' enum: - lite - standard - ultra - null description: >- Scan tier for each fired pentest. The tier changes the credit price of each run. Send null to reset to ultra. Not applicable on self-hosted deployments, for organizations with raw model selection, and for organizations on the Enterprise plan. scope: type: object description: >- Per-run scope control applied to each fire. Send an empty object to clear the stored scope. properties: seeds: type: array items: type: string allow: type: array items: $ref: '#/components/schemas/ScopeEntry' visible: type: array items: $ref: '#/components/schemas/ScopeEntry' deny: type: array items: $ref: '#/components/schemas/ScopeEntry' test_user_ids: type: array items: type: string format: uuid description: Saved test users to authenticate with on each run. timezone: description: >- New IANA timezone for the cron expression, for example `America/New_York`. type: string upload_ids: type: array items: type: string format: uuid description: >- Replaces the schedule's uploads. Stored uploads the caller cannot access (hidden from the template for target-scoped actors) are preserved automatically. RunKnowledgeResourcePin: type: object additionalProperties: false properties: connection_id: type: string minLength: 1 description: Organization cloud connection that owns the resource. page_id: type: string minLength: 1 description: Provider-specific opaque resource identifier. label: type: string minLength: 1 maxLength: 200 url: type: - string - 'null' format: uri guidance: type: string maxLength: 500 description: >- Optional context: what the resource holds and when Strix should read it. required: - connection_id - page_id - label - url ScopeEntry: type: object properties: kind: type: string enum: - domain - subdomain - wildcard value: type: string description: e.g. "app.acme.com" or "*.acme.com". source: type: string enum: - seed - discovery - manual required: - kind - value - source ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail TierLimitErrorResponse: type: object properties: detail: type: string requiredTier: type: string code: type: string required: - detail ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: BadRequest: description: Bad request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' TierLimitError: description: Plan or credit limit reached. content: application/json: schema: $ref: '#/components/schemas/TierLimitErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.