Live Scan Prompt - Strix

With live scan prompts, you can send a message into a running pentest agent graph. This feature is available only on the enterprise plan. Use this endpoint to send the message to the agent that is selected in the scan UI. If you omit agent_id, the message goes to the root agent.

Send a live prompt

curl -X POST "https://app.strix.ai/api/v1/scans/<SCAN_ID>/message" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "message": "Check whether the login form is protected against CSRF",
    "agent_id": "<AGENT_ID>"
  }'

The request body accepts these fields:

message — required. The text to send to the running scan.
cancel_current — optional boolean. Set it to true to stop the active agent turn before Strix sends the message.
agent_id — optional target agent id. If you omit it, the message goes to the scan root agent.

Required scope: scans:message

Readiness and errors

The API applies the same guardrails as the dashboard UI:

403 if the organization does not have the enterprise live_scan_prompt feature
409 if the scan is not active (pending or running)
503 until the scan sandbox bridge is ready

When the bridge is ready, Strix sends the prompt to the running agent through the /user-message endpoint of the scan sandbox.