Test Users

With test users, Strix can log in to your application during a pentest. Each test user belongs to a domain. A test user can also have an MFA configuration and a Strix-managed inbox for email-OTP and magic-link flows. To find which method a login needs, or why a login failed, refer to Login Methods.

List test users

curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Required scope: test_users:read

Create a test user

curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Standard user",
    "username": "tester@example.com",
    "password": "<PASSWORD>",
    "login_url": "https://app.example.com/login"
  }'

Strix stores passwords and TOTP secrets in encrypted form. Strix does not return them in responses.

MFA

Set mfa_method to totp, email_otp, or magic_link:

totp requires totp_secret.
email_otp and magic_link require mfa_email. This must be a Strix-managed inbox address (refer to the section below).

Required scope: test_users:write

Update a test user

This is a partial update. Only the fields that you send change:

curl -X PATCH "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"notes": "Rotated password 2026-06"}'

Required scope: test_users:write

Delete a test user

curl -X DELETE "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Required scope: test_users:write

Provision a managed inbox

Create a Strix-managed inbox address to receive MFA emails for a test user:

curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/provision-inbox" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"label": "otp-inbox"}'

Use the returned address as mfa_email when you create or update a test user. Required scope: test_users:write Start a short verification to make sure that Strix can sign in with the stored credentials. The verification usually takes one or two minutes. It runs in the same sandbox that a scan uses. You must first verify that you are the owner of the domain.

curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/verify" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Strix uses a recent result again. To do the verification one more time after you change the credentials, add ?force=1. Required scope: test_users:write Get the result:

curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/verify" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

The status field is pending, running, succeeded, or failed. A failed verification also gives a failure_code field and a short detail field. Strix removes all secrets from the detail field. These are the possible values of failure_code: invalid_credentials, login_page_not_found, mfa_required_not_configured, mfa_code_unavailable, account_locked, target_unreachable, bot_protection, and other. Required scope: test_users:read

Read a test user’s inbox

curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/inbox?limit=25" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Read a single message by id:

curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/inbox/<MESSAGE_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Required scope: test_users:read

Getting Started

Guides

List test users

Create a test user

MFA

Update a test user

Delete a test user

Provision a managed inbox

Read a test user’s inbox

​List test users

​Create a test user

​MFA

​Update a test user

​Delete a test user

​Provision a managed inbox

​Verify a test user’s login

​Read a test user’s inbox

List test users

Create a test user

MFA

Update a test user

Delete a test user

Provision a managed inbox

Verify a test user’s login

Read a test user’s inbox