> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Live Scan Prompt

> Send live prompts to a running pentest agent

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

Live scan prompts let you send a message into a running pentest agent graph. The
feature is enterprise-only.

Use this endpoint to target the currently selected agent in the scan UI, or omi
t `agent_id` to default to the root agent.

## Send a live prompt

```bash theme={null}
curl -X POST "https://app.strix.ai/api/v1/scans/<SCAN_ID>/message" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "message": "Check whether the login form is protected against CSRF",
    "agent_id": "<AGENT_ID>"
  }'
```

The request body supports:

* `message` — required text to send to the running scan
* `cancel_current` — optional boolean; set to `true` to interrupt the active a
  gent turn before sending
* `agent_id` — optional target agent id; defaults to the scan root agent

**Required scope:** `scans:message`

## Readiness and errors

The API enforces the same guardrails as the dashboard UI:

* `403` if the organization does not have the enterprise `live_scan_prompt` fea
  ture
* `409` if the scan is not active (`pending` or `running`)
* `503` until the scan sandbox bridge is ready

When the bridge is ready, the prompt is forwarded to the running agent over the
scan sandbox's `/user-message` endpoint.