> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Search across the workspace > One query across issues (STRIX id, title, CVE, CWE, host), pentests, PR reviews (repository, title, number), chats, repositories, domains, network connectors and schedules. Results come back grouped by kind, each group ranked exact match first, then prefix, then substring, newest first within a rank. Only the kinds the token has a read scope for are searched (`vulnerabilities:read` for issues, `scans:read` for pentests, `pr_reviews:read`, `chat:read`, `assets:read` for repositories and domains, `connectors:read`, `schedules:read`); kinds outside the token's scopes are skipped, and the same asset scopes and plan features apply as on each kind's own list endpoint. An empty `q` returns the most recent items of each kind. A kind whose lookup failed is listed in `failed` while the other groups are still returned. ## OpenAPI ````yaml /openapi.json get /search openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /search: get: tags: - Search summary: Search across the workspace description: >- One query across issues (STRIX id, title, CVE, CWE, host), pentests, PR reviews (repository, title, number), chats, repositories, domains, network connectors and schedules. Results come back grouped by kind, each group ranked exact match first, then prefix, then substring, newest first within a rank. Only the kinds the token has a read scope for are searched (`vulnerabilities:read` for issues, `scans:read` for pentests, `pr_reviews:read`, `chat:read`, `assets:read` for repositories and domains, `connectors:read`, `schedules:read`); kinds outside the token's scopes are skipped, and the same asset scopes and plan features apply as on each kind's own list endpoint. An empty `q` returns the most recent items of each kind. A kind whose lookup failed is listed in `failed` while the other groups are still returned. operationId: search parameters: - name: q in: query required: false description: Search text, at most 200 characters. Empty returns recent items. schema: type: string maxLength: 200 - name: kinds in: query required: false description: >- Comma-separated kinds to search. Defaults to every kind the token can read. schema: type: string example: issue,pentest - name: limit in: query required: false description: Maximum results per kind. schema: type: integer minimum: 1 maximum: 20 default: 5 responses: '200': description: Grouped search results. content: application/json: schema: $ref: '#/components/schemas/SearchResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - vulnerabilities:read - BearerAuth: - scans:read - BearerAuth: - pr_reviews:read - BearerAuth: - chat:read - BearerAuth: - assets:read - BearerAuth: - connectors:read - BearerAuth: - schedules:read components: schemas: SearchResponse: type: object properties: query: type: string description: The normalized query that was searched. groups: type: array items: $ref: '#/components/schemas/SearchGroup' description: >- One group per kind with at least one result, in the fixed kind order. failed: type: array items: $ref: '#/components/schemas/SearchKind' description: Kinds whose lookup failed; their results are missing from `groups`. required: - query - groups - failed SearchGroup: type: object properties: kind: $ref: '#/components/schemas/SearchKind' items: type: array items: $ref: '#/components/schemas/SearchResult' truncated: type: boolean description: True when more records matched than `limit` allowed. required: - kind - items - truncated SearchKind: type: string enum: - issue - pentest - pr_review - chat - repository - domain - network - schedule description: The kind of record a search result points at. ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail SearchResult: type: object properties: kind: $ref: '#/components/schemas/SearchKind' id: type: string description: >- The record's id in its own API (`/vulnerabilities/{id}`, `/scans/{id}`, ...). title: type: string identifier: type: string description: Short handle shown next to the title, such as `STRIX-41` or `#128`. subtitle: type: string description: >- Secondary line, such as the host, the repository or the cron expression. href: type: string description: Dashboard path of the record. status: type: string description: >- The record's own status vocabulary (scan status, issue status, verified/unverified, ...). severity: $ref: '#/components/schemas/VulnerabilitySeverity' timestamp: type: - string - 'null' format: date-time description: When the record was created or last active; the recency tiebreaker. required: - kind - id - title - href - timestamp ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read VulnerabilitySeverity: type: string enum: - critical - high - medium - low responses: Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.