Test Users

Test users let Strix authenticate to your application during a pentest. Each test user belongs to a domain and can optionally carry MFA configuration and a Strix-managed inbox for email-OTP / magic-link flows.

List test users

curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Required scope: test_users:read

Create a test user

curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Standard user",
    "username": "tester@example.com",
    "password": "<PASSWORD>",
    "login_url": "https://app.example.com/login"
  }'

Passwords and TOTP secrets are stored encrypted and never returned in responses.

MFA

Set mfa_method to totp, email_otp, or magic_link:

totp requires totp_secret.
email_otp / magic_link require mfa_email, which must be a Strix-managed inbox address (see below).

Required scope: test_users:write

Update a test user

Partial update — only provided fields change:

curl -X PATCH "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"notes": "Rotated password 2026-06"}'

Required scope: test_users:write

Delete a test user

curl -X DELETE "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Required scope: test_users:write

Provision a managed inbox

Create a Strix-managed inbox address to receive MFA emails for a test user:

curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/provision-inbox" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"label": "otp-inbox"}'

Use the returned address as mfa_email when creating/updating a test user. Required scope: test_users:write

Read a test user’s inbox

curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/inbox?limit=25" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Read a single message by id:

curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/inbox/<MESSAGE_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Required scope: test_users:read

Getting Started

Guides

List test users

Create a test user

MFA

Update a test user

Delete a test user

Provision a managed inbox

Read a test user’s inbox

​List test users

​Create a test user

​MFA

​Update a test user

​Delete a test user

​Provision a managed inbox

​Read a test user’s inbox

List test users

Create a test user

MFA

Update a test user

Delete a test user

Provision a managed inbox

Read a test user’s inbox