Skip to main content
Non-Enterprise workspaces use scan credits for standard managed pentests. One credit costs $1.00. Enterprise scans are included in the plan and do not consume the credit wallet. Retests and supply-chain dependency scans are also credit-exempt. These endpoints let an API caller or agent read the balance, buy credits, and manage automatic top-ups. The scan price is calculated from the requested scope before launch. At the current default ultra tier, a standard code review or live test starts at 60 credits for one target, then adds 20 credits for each additional repository or domain. A local-source-only code review therefore starts at 60 credits; uploading source does not make the scan free. Other scan tiers and full-audit engagements have different estimates, so treat the estimate returned for the request as authoritative. If a non-Enterprise workspace cannot cover the estimate, scan creation returns HTTP 402 Payment Required with code scan_credit_limit_reached. The CLI maps this to exit code 5. The rejected request creates no scan and consumes no credits. Validation and plan rejections that occur before launch also consume no credits.

​
Get the credit balance

Required scope: billing:read The response contains the current balance and price_per_credit_cents. An Enterprise workspace may still have a wallet balance, but normal Enterprise scan launches do not debit it.

​
Buy credits with a machine payment

This endpoint accepts agent payments through the Stripe Machine Payments Protocol (MPP). The purchase requires an admin role on the workspace.
Required scope: billing:write Send the API token in the X-Strix-Authorization header for this endpoint. MPP uses the standard Authorization header for the payment credential. The first request returns HTTP 402 Payment Required with a payment challenge in the WWW-Authenticate header. Pay the challenge with an MPP wallet, for example the Stripe Link agent wallet, and retry the request with the payment credential. See the Stripe machine payments documentation for wallet setup. When the payment succeeds, the response confirms the grant:
Credit grants are idempotent on the payment reference. A retry with the same paid credential returns duplicate: true and grants no additional credits.

​
Get automatic top-up settings

Required scope: billing:read The response contains enabled, topup_credits, monthly_cap_credits, and used_this_month.

​
Update automatic top-up settings

Automatic top-ups charge the saved payment method of the workspace when the balance runs out. The update requires an admin role on the workspace.
Required scope: billing:write Set monthly_cap_credits to null to remove the monthly limit. Use this endpoint to buy a plan or a credit pack. The response contains a hosted checkout page. A person must open the page and complete the payment.
Required scope: billing:write The accepted products are strix_cloud for the Cloud plan, strix_startup for an approved startup offer, and strix_top_up for a credit pack. The request needs an admin role on the workspace. The response contains checkout_url. The open-source CLI opens this page with the strix cloud billing subscribe --plan strix_cloud command. The billing portal shows the invoices of the workspace. A person can change the payment method and the plan there.
Required scope: billing:write The request needs an admin role on the workspace. The response contains portal_url. If the workspace does not yet have a billing customer, the endpoint returns HTTP 409 Conflict with instructions to subscribe first. Create a checkout link with the preceding endpoint, complete that handoff as a person, and then request the portal again. Provider failures return 502 Bad Gateway; an on-premises deployment where the hosted portal is unavailable returns 400 Bad Request. The CLI equivalent is strix cloud billing portal. It prints or opens the hosted link; it never changes payment details by itself. For machine-payment top-ups, strix cloud billing topup --credits <N> --no-pay prints the payment challenge without paying it. In an interactive terminal, the paying form asks for confirmation. In an agent, CI, or other non-interactive process, payment cannot proceed unless --yes is present; obtain the user’s approval before running strix cloud billing topup --credits <N> --yes. The --yes and --no-pay options are mutually exclusive. --yes authorizes the CLI to invoke the configured wallet, but Link may still require the user to approve or complete the payment.