> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Test Users

> Manage authenticated test users and inboxes for a domain

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

With test users, Strix can log in to your application during a pentest. Each test user belongs to a domain. A test user can also have an MFA configuration and a Strix-managed inbox for email-OTP and magic-link flows.

To find which method a login needs, or why a login failed, refer to [Login Methods](/guides/login-methods).

## List test users

```bash theme={null}
curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `test_users:read`

## Create a test user

```bash theme={null}
curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Standard user",
    "username": "tester@example.com",
    "password": "<PASSWORD>",
    "login_url": "https://app.example.com/login"
  }'
```

Strix stores passwords and TOTP secrets in encrypted form. Strix does not return them in responses.

### MFA

Set `mfa_method` to `totp`, `email_otp`, or `magic_link`:

* `totp` requires `totp_secret`.
* `email_otp` and `magic_link` require `mfa_email`. This must be a Strix-managed inbox address (refer to the section below).

The only accepted values are `none`, `totp`, `email_otp`, and `magic_link`.
Any other value is rejected with `422`; it is never silently treated as no MFA.

**Required scope:** `test_users:write`

## Update a test user

This is a partial update. Only the fields that you send change:

```bash theme={null}
curl -X PATCH "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"notes": "Rotated password 2026-06"}'
```

**Required scope:** `test_users:write`

## Delete a test user

```bash theme={null}
curl -X DELETE "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `test_users:write`

## Provision a managed inbox

Create a Strix-managed inbox address to receive MFA emails for a test user:

```bash theme={null}
curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/provision-inbox" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"label": "otp-inbox"}'
```

Use the returned address as `mfa_email` when you create or update a test user.

**Required scope:** `test_users:write`

## Verify a test user's login

Start a short verification to make sure that Strix can sign in with the stored credentials. The verification usually takes one or two minutes. It runs in the same sandbox that a scan uses. You must first verify that you are the owner of the domain.

```bash theme={null}
curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/verify" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

Strix uses a recent result again. To do the verification one more time after you change the credentials, add `?force=1`.

**Required scope:** `test_users:write`

Get the result:

```bash theme={null}
curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/verify" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

The `status` field is `pending`, `running`, `succeeded`, or `failed`. A failed verification also gives a `failure_code` field and a short `detail` field. Strix removes all secrets from the `detail` field.

These are the possible values of `failure_code`: `invalid_credentials`, `login_page_not_found`, `mfa_required_not_configured`, `mfa_code_unavailable`, `account_locked`, `target_unreachable`, `bot_protection`, and `other`.

**Required scope:** `test_users:read`

## Read a test user's inbox

```bash theme={null}
curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/inbox?limit=25" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

Read a single message by id:

```bash theme={null}
curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/inbox/<MESSAGE_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `test_users:read`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.