> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Verify a test user's login > Starts a short agent run (usually a minute or two) that drives the target's real login form with the saved credentials and reports a structured outcome, so a broken login surfaces before a scan. Returns 202 with a pending verification, or 200 with an in-flight / recent one that is reused. The login URL must use HTTP(S). Network test users can use private addresses because verification runs on the selected network. ## OpenAPI ````yaml /openapi.json post /networks/{networkId}/test-users/{userId}/verify openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /networks/{networkId}/test-users/{userId}/verify: post: tags: - Test Users summary: Verify a test user's login description: >- Starts a short agent run (usually a minute or two) that drives the target's real login form with the saved credentials and reports a structured outcome, so a broken login surfaces before a scan. Returns 202 with a pending verification, or 200 with an in-flight / recent one that is reused. The login URL must use HTTP(S). Network test users can use private addresses because verification runs on the selected network. operationId: verifyNetworkTestUserLogin parameters: - name: networkId in: path required: true description: >- A network connector id, or `direct` for this install (self-hosted only). schema: type: string - name: userId in: path required: true description: Test user id. schema: type: string format: uuid - name: force in: query required: false description: >- Set to `1` to re-verify even when a recent result exists (use after changing the credentials or headers). schema: type: string enum: - '1' requestBody: required: false content: application/json: schema: type: object properties: headers: type: array maxItems: 10 description: >- Custom HTTP headers the scan will send, for example a bot-protection bypass header. The verification sends them on requests to the login URL's origin, so the check reaches the login page the same way the scan will. Values are stored encrypted and never returned. Rows with a blank name or value are ignored. items: type: object properties: name: type: string value: type: string required: - name - value responses: '200': description: An in-flight or recent verification was reused. content: application/json: schema: $ref: '#/components/schemas/TestUserAuthCheck' '202': description: Verification started. content: application/json: schema: $ref: '#/components/schemas/TestUserAuthCheck' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/ValidationError' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - test_users:write components: schemas: TestUserAuthCheck: type: object description: Outcome of a pre-scan login verification run for a saved test user. properties: id: type: string format: uuid domain_id: type: string format: uuid description: >- The domain the check ran against. Use it as `domainId` when you download evidence. test_user_id: type: - string - 'null' format: uuid status: type: string enum: - pending - running - succeeded - failed failure_code: type: - string - 'null' enum: - invalid_credentials - login_page_not_found - mfa_required_not_configured - mfa_code_unavailable - account_locked - target_unreachable - bot_protection - launch_failed - other - null description: Category of the failure when `status` is `failed`. detail: type: - string - 'null' description: >- Human-readable explanation of the outcome. Never contains credentials or email contents. created_at: type: string format: date-time started_at: type: - string - 'null' format: date-time finished_at: type: - string - 'null' format: date-time evidence: type: - array - 'null' description: >- Evidence of the login attempt, when the agent recorded one. Download one artifact with `GET /domains/{domainId}/login-evidence/{checkId}/{attempt}/{kind}`, where `checkId` is this check's `id` and `attempt` is the index in this list. items: $ref: '#/components/schemas/LoginEvidenceAttempt' required: - id - domain_id - status - created_at LoginEvidenceAttempt: type: object description: >- What the agent captured for one login attempt. Only the kinds the agent captured are present in `artifacts`. properties: success: type: boolean description: Whether this attempt logged in. failure_code: type: - string - 'null' description: Category of the failure when `success` is `false`. account_index: type: integer description: Zero-based index of the test account the agent used. captured_at: type: string format: date-time artifacts: type: object properties: recording: $ref: '#/components/schemas/LoginEvidenceArtifact' screenshot: $ref: '#/components/schemas/LoginEvidenceArtifact' response: $ref: '#/components/schemas/LoginEvidenceArtifact' required: - success - failure_code - account_index - captured_at - artifacts ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail LoginEvidenceArtifact: type: object properties: content_type: type: string description: >- Media type of the artifact: `video/webm`, `video/mp4`, `image/png`, `image/jpeg`, or `text/plain`. bytes: type: integer description: Size of the artifact in bytes. required: - content_type - bytes ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read responses: Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' Forbidden: description: >- Insufficient permissions or missing scope. A missing scope returns the `insufficient_scope` code, the `required_scope` field, and a `hint` with the command or page that grants the scope, so a client can request the correct scope and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ValidationError: description: Request failed validation (e.g. malformed value or unsupported enum). content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.