> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # List captured HTTP exchanges > Returns the HTTP request metadata that supports a vulnerability. Set `include_content` to `true` to include stored request and response text. ## OpenAPI ````yaml /openapi.json get /vulnerabilities/{vulnerabilityId}/http-exchanges openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. paths: /vulnerabilities/{vulnerabilityId}/http-exchanges: get: tags: - Vulnerabilities summary: List captured HTTP exchanges description: >- Returns the HTTP request metadata that supports a vulnerability. Set `include_content` to `true` to include stored request and response text. operationId: listVulnerabilityHttpExchanges parameters: - $ref: '#/components/parameters/VulnerabilityId' - name: include_content in: query description: Includes stored request and response text when true. schema: type: boolean default: false responses: '200': description: Captured HTTP exchanges. content: application/json: schema: $ref: '#/components/schemas/VulnerabilityHttpExchangesResponse' '401': $ref: '#/components/responses/Unauthorized' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalError' security: - BearerAuth: - vulnerabilities:read components: parameters: VulnerabilityId: description: >- ID of the vulnerability. Use the `id` field of a finding from `listVulnerabilities`. name: vulnerabilityId in: path required: true schema: type: string schemas: VulnerabilityHttpExchangesResponse: type: object properties: exchanges: type: array items: $ref: '#/components/schemas/VulnerabilityHttpExchange' required: - exchanges VulnerabilityHttpExchange: type: object description: A captured HTTP exchange that supports a vulnerability. properties: run_id: type: string request_id: type: string ordinal: type: integer minimum: 0 lookup_state: type: string enum: - resolved - not_found - unavailable request: oneOf: - $ref: '#/components/schemas/VulnerabilityHttpExchangeRequest' - type: 'null' state: type: string enum: - archived - unarchived - unavailable - not_found exchange: oneOf: - $ref: '#/components/schemas/ArchivedHttpExchange' - type: 'null' required: - run_id - request_id - ordinal - lookup_state - request ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail VulnerabilityHttpExchangeRequest: type: object description: Metadata for one captured HTTP request. properties: run_id: type: string method: type: string host: type: string port: type: integer path: type: string query: type: string status_code: type: - integer - 'null' response_time_ms: type: - number - 'null' response_length: type: - integer - 'null' is_tls: type: boolean in_scope: type: boolean file_extension: type: - string - 'null' timestamp: type: string format: date-time has_archived_exchange: type: boolean required: - run_id - method - host - path - timestamp - has_archived_exchange ArchivedHttpExchange: type: object description: Stored request and response text for one captured HTTP exchange. properties: raw_request: type: string raw_response: type: string request_truncated: type: boolean response_truncated: type: boolean required: - raw_request - raw_response - request_truncated - response_truncated ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write responses: Unauthorized: description: Missing or invalid API token. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ````